Vnc-roulette – Randomly connects to open VNC servers | Hacker News Reader

Vnc-roulette – Randomly connects to open VNC servers

allsprk.koding.io

31 pointsallsprk44 comments

Thankfully, it's down right now.

If you knowingly tinker with a system you're not supposed to have access to --- that is, you either VNC into a system that isn't yours and see things that a reasonable person would react to as an indication that they weren't welcome, or that a prosecutor can claim a reasonable person would react that way to --- you're violating the CFAA.

All current indications are that scanning the whole Internet for open VNC systems is, if not lawful, then at least so close to the line that nobody's going to make an issue of it.

But logging into a VNC server and poking around crosses a bright line. Arguments about the implied welcome given by lack of a login screen will probably not persuade a jury, let alone a prosecutor.

The idea of hooking open VNC servers up to a "roulette" game seems beyond stupid. Maybe someone's thought about this more carefully than I have and can explain why I'm wrong?

Ditto. The CFAA is pretty draconian. Be careful peeps.

You are of course right. The only caveat I would remind you of is that not everyone is in the US. :)

Does not mean Uncle Sam won't extradite your ass and hold you up to his law. 'Murica!

I'm reasonably certain this sort of thing is some degree of illegal just about everywhere.

Not that that doesn't make it fun, but still.

Unlikely unless significant financial fraud is involved. Nobody is going to get extradited over poking around an unsecured server.

All you have to do is butthurt a CEO of a fortune 500 company and FBI will be all up in your business... claiming loss of untold millions, etc.

So where are the boatloads of Chinese hackers being extradited to California to face their CFAA charges?

China don't play dat, homie!

China has no extradition treaty with the US, and even if they did, there is no equivalent of the CFAA in China. Extradition treaties usually cover only offenses that are crimes in both countries.

Obviously deeply immoral and unethical, but illegal? No... Not unless there is a warning that what you are doing is wrong. Maybe they are test VNC servers? Scanning is definitely not illegal, nor immoral IMHO. Studying the Internet is a valid exercise when done responsibly.

I would be willing to put some money on you being very, very wrong about it being legal to tinker with passwordless VNC server simply because there was no explicit warning.

Why do you (and everyone else) get to tinker with passwordless HTTP servers?

Because every reasonable Internet user believes they're allowed to do that, whereas when you get access to a passwordless VNC server, it's so newsworthy that it immediately gets voted onto the front page of Hacker News.

I've seen plenty of links (including this one) to passwordless HTTP servers on the front page.

A reasonable person would assume that a server with no password, intentionally has no password.

Yeah good luck with that.

The legal system really doesn't like "cute", "technically-correct" arguments, as a general rule. If you fell afoul of the CFAA on this and were dragged in front of a judge, I'd put good money on that argument being laughed out of court for this particular case. An HTTP server is very different to a VNC server. Misconfiguration doesn't typically grant right to access, in a legal sense anyway.

The problem is that it's not obvious that there is a misconfiguration. Public sandbox environments are not uncommon on the Internet.

I do not support malice or vandalism, but there is no indication that a system is misconfigured merely because it does not have password protection. Users should not be expected to know the intricacies and technical details of every program they use. The responsibility for ensuring that servers are not publicly accessible is on the person running the server. Not requiring a password to access a system on a public network, when you require that only certain people are allowed access to that system, is negligence at best. I'd argue gross negligence.

> but there is no indication that a system is misconfigured merely because it does not have password protection

And there is no indication it's not a misconfiguration. Look, I completely agree with what you're saying, but judges won't (and don't).

Would they? Or would they assume that a VNC server was left open either through malice or incompetence, and it's presence therefore not an invitation to be accessed?

This is the difference between a storefront being left unlocked, versus a private home being left unlocked. An unlocked storefront is likely to be open for business, so entering is reasonable. An unlocked house is a security mistake, and entering is trespassing.

You might think you're clever. Hell, you probably are clever. Unfortunately, that's not what matters. What matters is how the owner of the server will react, and how important they are. If you're identified and charged, the DA will levy absurdly burdensome charges against you. You'll be forced to spend thousands of dollars on defense. You'll spend months distracted by the proceedings, and will inevitably be asked about it by peers/employers when the news hits the streets.

But you're right. You may never be convicted. Go ahead and try your luck.

IANAL but I'd have to agree. It reminds me of the time I got money deposited in to my bank account that I knew wasn't mine. I asked my girlfriend's dad - a lawyer - if I could keep it. Of course not, he said. It's like someone parking their car in your driveway, he said, and leaving the keys in the ignition. Are they trespassing on your driveway? Sure. Does that mean this car belongs to you now and you can do with it whatever you please? Of course not.

Nonsense. People put up open systems because they want others to enter them. That's why public wifi is public. That's why public http servers are public. That's why public restrooms are public. Et cetera, ad nauseam.

Just because you can enter someone's home because the door is unlocked does not mean you are invited.

Similarly you will find that trespassing on a system you do not have authorized use of (and no login is not implicit authorized use) is going to get you in trouble pretty much everywhere.

The difference is the degree of knowledge you have of doing something wrong while transgressing the law.

It's like if my grand-mother with alzheimer accidentally entered the wrong apartment room or house where the door was unlocked. It's not like she should go to jail or get shot by the owner pretending she was a threat.

I haven't seen the website, but if they made it really easy to enter remote systems then someone could defend himself saying he didn't know what it was all about.

One could probably argue that some Popcorn Time users would enter this gray zone.

However, the providers of those kind of services are mostly aware of the illegality of their users behaviour, so they are infringing the law clearly.

You don't have a right to mess with things just because they're "in public". If someone's front gate is open, that doesn't mean that you can just walk in and start chopping up their rosebush.

It is always a good idea to NOT have the word "welcome" your login banner as that can be used to argue that access was invited. So instead of:

  Welcome to foo.example.com

Have something like:

  foo.example.com
  For authorized use only.

"Oh no... allsprk.koding.io is sleeping right now. Check again a little later?"..

I'm taking a wild guess the host (koding.io) shut this one down, I can't imagine is takes too long to get an abuse request from an app like this..

That said - If this does what I think it does, awesome :) Maybe people will stop exposing systems over the internet like this after 5 or 10 more of these sites/apps?

On free accounts, it only lasts for an hour after a deploy.

I guess this is using massscan, pretty interesting how many power station type mainframes/servers there are

This is either fake or people have way too little sense of software visuals. Some of the stuff that it's appearing is downright nasty.

How legal is this?

As legal as walking into someone's house who didn't lock the door.

As legal as connecting to an http server, using public wifi, or a public restroom.

It's more like entering an office or shop which didn't lock the door. Anyway, it's a loose analogy.

Aaron Swartz's case, Andrew Auernheimer's case and Computer Fraud and Abuse Act would say - likely illegal.

(Or more likely - completely legal unless it affects the government or a big enough US corporation)

Flatly illegal.

Depends on intent. Connecting just to say "cool it works" - while illegal no one will care. Connecting and making malicious modifications to the system and you might have some unfriendly people knocking on your door.

Intent is indeed the key word here.

This always becomes the main subject by lawyers in courts.

Intent (or recklessness, negligence, etc..) is and ought to be a fundamental principle of deciding if something is a criminal act. However, we should be clear that Strict Liability crimes do exist by force of (portly-written) statute.

Why would anyone leave a passwordless VNC server accessible to the internet?

It is similar to the lack of oversight where people leave security cameras open to the internet. Sometimes it is even possible to control the cameras.

This is amazing, I wonder how many of these machines are out there.

These guys will tell you: https://www.youtube.com/watch?v=UOWexFaRylM

It is trivial to scan the whole ipv4 address space. I think the guys in this video did it in 40mins or so while presenting.

Reply on news.ycombinator.com