Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 15 down vote favorite
1

So I've begun learning to penetration test and I want to try it on a real system, (apart from my own), and so I have asked a friend if I can hack their computer. He is as interested as I am on the subject of computing and has agreed. I'm just wondering if it is strictly legal, and if it is likely for anyone else to be checking his system (doubtful, I know). As a point of reference, I live in Australia..

share|improve this question
2  
Is this just your friend's personal computer, or is it a server used for some public business or service? Also, does your friend live in Australia? – Nathan Long Oct 25 '11 at 12:21
Just a personal computer and we both live fairly close to each other. – Shadow Oct 25 '11 at 12:28
1  
Take care of doing that from a freshly installed OS, you don't want the credentials of your friend to be snatched by a trojan when you browse/decrypt them. – Shadok Oct 25 '11 at 14:44

3 Answers

up vote 18 down vote

If the system is private and you don't use any other infrastructure or services to carry out your testing, then you probably don't violate any statutes.

However:

  • If you are attacking through an ISP - get their agreement first, as they could see what you are doing as an attack and pass the info to law enforcement
  • If there is data on the server which could come under data protection regulation then you want to look into implications of having that data end up on your computer as part of the attack.
  • and as @espengra says - get approval in writing, in case you break something and your friend decides to take you to court!
share|improve this answer
In regards to the ISP issue, what if I took my laptop to his house and used his wifi? – Shadow Oct 25 '11 at 20:55
@Shadow - if you aren't using an ISP, you can ignore that point :-) – Rory Alsop♦ Oct 25 '11 at 21:11
5  
I would second getting it in writing. I once got verbal approval from the Managing Director of a company I worked for to demonstrate a vulnerability to the Finance Director. The FD subsequently recorded the incident on my staff record as a technical breach of my employment contract. – Mark Booth Oct 26 '11 at 10:59
@Mark - that's frightening! – Rory Alsop♦ Oct 26 '11 at 11:00
up vote 9 down vote

This constitutes as a fairly regular pentest and is indeed legal if the victim system's legal owner (your friend) allows you to perform this test. Make sure to have the entire scope of the test declared in a written contract between the two of you just to be sure if he should change his mind later on.

The scope would include the physical equipment involved, as well as the targeted software.

share|improve this answer
up vote 5 down vote

Why don't you just knock up some virtual servers to play with .. or get some vulnerable iso's to play with (metasploitable comes to mind for one)

You could always do a p2v of a physical system so you have it as a virtual machine. That way you can take backups and restore points etc.

Otherwise, as the posts above state, get a written agreement, and ensuer that your ISP allows it (I'm pretty sure Telstra don't like it)

PS - im from Australia too :)

You should check out http://www.pentest-standard.org/index.php/Pre-engagement for all your scope and agreement stuff

share|improve this answer
upvote for pentest-standard. – lew Oct 26 '11 at 6:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.