Laws on Programming Security Tools

Question

I am currently working on some POST GATHER modules for the Metasploit Framework the idea is that after a shell is spawned on the target, it will gather certain files from the target such as chat logs.

I am confused to whether this is illegal or not as there are hundreds of modules like this, however there is no ethical use for it other than for educational purposes or in a penetration test.

An example is this module here http://www.metasploit.com/modules/post/multi/gather/firefox_creds

*EDIT* My question is related only to development of a tool, not using it.

Answer 1

You gain unauthorized shell access, and THEN you wonder if gathering chat logs is legal? :) I guess I'm not sure what you are asking. You should already have permission to attempt to breach a computer before you even fire up Metasploit, so legality is determined long before your post modules.

From a penetration test perspective, if the client is looking for certain files or proofs from a host, then those file target are within scope. If the files you are scooping up contain clues that help you penetrate further, then they could also be in scope (as long as not specifically out-of-scope).

Answer 2

The tools themselves are not illegal to possess. What is illegal is attacking a computer system without authorization. For instance, it would be illegal to use these exploit toolkits to attack a system that you do not have permission to attack. However, it is legal to use these tools to attack your own system.

(This answer is based upon US law, but I would expect the law in many other countries to be similar.)

Developing tools that would only be of use to bad guys, and are of limited or no use to good guys, is of dubious ethics, at best. It may be legal, but you need to consider carefully whether it comports with your own personal ethics. Ask yourself: am I making myself part of the problem, or part of the solution?

Answer 3

And of course, as ever, if you have a legal question you should consult a lawyer qualified in the appropriate jurisdiction who specializes in the appropriate area of the law.

(If you can't find such a lawyer, pick any lawyer and ask them to find such a lawyer for you.)

Answer 4

If you are in the us dev is ok. No need to reinvent the wheel what you are describing can be cobbled together from other modules. Sounds very gray hat I would watch out because whatever you build then share you are now helping others with less ethical intents than yourself intentional or not. Also unless you are being paid and the stuff is staying in house, the way judges are handling this stuff now is the more knowledge the more responsible. Look on lexis-nexus in the past five years the lawyers are getting more for less technical cases, so the cases are dragged out in the gray areas and you will end up broke and serving ridiculous time just because you did module chain a versus b and they argue it was for a specific intent. Do not mean to sound negative but like that guy in Austin doing SMS spoofing to pump ads got his visa yanked he was making around 75K two years out of school keeping amajority of it compared to the rest of us taxpayers but no screwed up plus deep legal crap because of tools from prior jobs on his system.
Anyway be careful. Hope that helps, iceberg

Answer 5

Since your question regards the developer's point of view, then the answer is probably simple: it is legal. If you have a computer, you can create what you want with it, the problems could arise, as the other users explained, the moment you decide to put these tools to use. You could also create something and decide never to use it, nobody stops you from doing that :)

Of course, being no lawer, I warmly suggest you to contact one whenever you have such questions.