Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question has originally been posted to Stackoverflow but then I found that this was the right place to ask. If you are a moderator, please delete this question at SO.


Hello everyone,

I am using Wappalyzer everyday as it provides me with some interesting data about the websites I visit.

Today I noticed that they actually sell full datasets/lists of sites using certain technology. You can see an example here:

The full list of 825,070 websites using WordPress costs US $1,575

Now, I know that most of those toolbar additions to your browsers actually collect information on the sites you visit and use them later on for statistics and other purposes (Alexa, visit count websites etc.). But the fact that these guys were actually selling it openly on their site, sounded almost as if someone would sell your email address publicly.

What am I aiming at?

Well, for $1,575 someone could get a really good base for doing some nasty things. They could hit all those websites and check the core versions and let's say plugins they use. After that they could filter the older ones and perform a series of attacks to infect visitors and spread out whatever they want.

The fact that an attacker would be able to get such huge already filtered list of websites, without any effort is what makes me question if this should be allowed to be done.

My questions are:

  1. Is this legal?

  2. What do you think about it?

  3. Is selling website data widely done on the net?

I am asking more because of curiosity than getting really concerned. Having read that on their site made me feel it was not something completely normal.

If I'm wrong in something - please explain.

Thank you!

share|improve this question

closed as not constructive by Iszi, Scott Pack, AviD Aug 27 '12 at 17:48

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
"Is this legal?" In general SE sites don't provide legal advice, but surely this depends on the Terms and Conditions you've agreed to when installing that toolbar (that thing almost no one ever reads when you click next, next, next on the installer). This may also depend on the jurisdiction. –  Bruno Aug 27 '12 at 10:49
    
I don't need legal advice on what Wappalyzer does. I wanted this to be a discussion on the way Wappalyzer sells their data. –  Ivanhoe123 Aug 27 '12 at 10:55
2  
For future reference, please don't re-post/cross-post. If a question is not a good fit for one site, but would be okay on another, flag it for migration. As it is, I'm not sure this is really a good fit for any StackExchange site. "What do you think about it?" questions are generally looking for subjective opinions about a topic. StackExchange is meant to be used for objectively answerable questions - questions for which "there really is no single right answer" generally do not belong. –  Iszi Aug 27 '12 at 12:59
    
I understand now; thanks for clearing that up. –  Ivanhoe123 Aug 27 '12 at 13:32

2 Answers 2

up vote 3 down vote accepted

Is this legal?
The usual IANAL disclaimer applies here. First, it depends on which country you're in. However, selling a list of URLs that happen to run a particular bit of software is most likely legal in many countries. Remember that, in most legal systems, the action is illegal, not the tool. Possession of a tool that can be used to cause harm is not illegal, but using that tool to cause harm is illegal. If the data includes any personal details of users, though, the legality becomes a grey area.

What do you think about it?
I think that the list has some legitimate uses:

  • Tracking the number of sites that use WordPress, for business modelling purposes.
  • Tracking the number of sites that use old versions of WordPress, for security statistics.
  • Indexing purposes (e.g. an Internet-wide WordPress search engine)
  • General marketing purposes.

However, that doesn't mean that there aren't illegitimate purposes:

  • Spam.
  • Attacking vulnerable WordPress sites.
  • Collection of user credentials.

Ultimately, it's something that can be used to facilitate harm, but it's also not malicious in intent. It's a moral grey area, since what clients do with it isn't really up to the vendor. However, I do think the pricing is a little crazy. I could knock up the same set of data in a few weeks with a simple spidering tool.

Is website data widely sold on the net?
Yes, though usually it's in statistical form rather than raw data. It's important for businesses to know what their target market size is, when developing addons for webapps. The same thing applies to user data - social networking sites such as Facebook and Twitter are built around the concept of selling marketing data to companies, and targeting adverts at users. Similar stats for webapps makes total sense in such a business environment.

share|improve this answer
    
Thanks for the answer! It cleared up this for me. –  Ivanhoe123 Aug 29 '12 at 16:57

If something is sold somewhere, then there is some good chance that it is (also) sold "on the net" because that's what the Internet is good at: to allow people to relate to each other easily, without any constraint on distance and location. Intrinsically, it offers the kind of "social anonymity" which is needed for the shadier business proposals, too (you are not really anonymous on the Internet -- you leave traces everywhere, which law enforcement agencies are eager to explore -- but when buying "on the net", nobody you know sees you entering a disreputable shop).

(I lost my faith in the alleged benevolence of Internet when I received my first spam offering discreet abortions at a premium price. It showed me that Mankind is still Mankind when electrons in wires are involved.)

Legality is a tougher question. Against which law ? The Internet is international, whereas Law is not. Some providers even try to go for "international waters" legal status (e.g. the self-styled principality of Sealand) or try to exploit loopholes in some countries (for instance the Mohawk Internet Technologies, located in Kahnawake, hosts gambling sites in a way which is of dubious legality, but since "Native American" affairs are handled by the federal government of Canada, not the provincial government, any action against it is improbable because of the political storm which would ensue).

A lot of things happen on the Internet should not "be allowed", although people on the Earth do not seem to be able to reach a consensus on what exactly should be allowed or not. But that's not the right way to see it: in practice, things on the Internet are not potentially allowed but potentially forbidden. Everything is, by default, "allowed", at least technically, and the law systems of many countries work by explicit prohibitions.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.