Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.

learn more… | top users | synonyms (1)

-4
votes
4answers
149 views

Law & Ethics - I'm not be breaking the law its the computer [closed]

So it would be illegal to run a metasploit attack against a computer you don't have permission to do so against, right? But what if I configure a web server to nmap scan, then metasploit attack ...
1
vote
3answers
189 views

Is there a law against one email containing both a login and a password?

I see most companies either supply a login or a password in an email, but never both in one email. Is this a "best practice" or is there an actual law that prevents legitimate companies from providing ...
0
votes
1answer
163 views

What defines a 'defense contractor' and what is required to be reported in new US law? [closed]

According to news articles (eg here) the 2013 National Defense Authorization Act, which was signed into US law 2-Jan-2012, apparently requires defense contractors to report intrusions. What defines a ...
6
votes
3answers
408 views

Can I develop SSH-based tools within United States?

It is well known that development of open-source cryptographic tools is very problematic within the United States: all open-source ssh-based software was specifically developed outside of the US of A ...
0
votes
2answers
99 views

Security in the breaking cloud? Storage Wars?

If access to a cloud server instance that stores personal/important information is lost or removed by the provider, is my data protected? Can the provider access my data and copy it, distribute, or ...
3
votes
2answers
184 views

are there any services to test nmap

While playing with nmap, I have started to wonder: are there any ip addresses which were specifically made to learn how to use nmap. (As far as I understood I can not just scan any ip address, ...
0
votes
1answer
144 views

How do the authorities know who's downloading protected software?

Out of curiosity do the web based file hosting services such as Oron and Rapidshare store information about who downloads what? I ask because I'm wondering, when someone is "caught" downloading ...
7
votes
1answer
5k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
7
votes
3answers
348 views

Sourcing hardware that is least likely to contain backdoors

I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
3
votes
2answers
2k views

How effectively can ISPs detect illegal file sharing?

Recently the USA passed a law requiring ISPs to spy on their customers' internet connections to check for illegal file sharing. I assume that they would do this by sniffing packets, but doesn't this ...
3
votes
6answers
460 views

Is hacking back a valid security technique for companies?

Recently it has come to light through the reverse engineering of hacking tools that there are vulnerabilities in them that could be exploited to take over an attackers computer during a remote hacking ...
3
votes
2answers
739 views

Is it legal to store/send user's device's IMEI/MEID? [closed]

I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that. Is it legal to store/send user's ...
23
votes
4answers
1k views

consequences of grey hat hacking

While I was working on a anomaly detection system (finding cheaters in a quite popular online game service) I accidentally found a way to get a password of a user in a reasonable amount of time. ...
12
votes
3answers
571 views

If I find or create a 0day exploit, can I be held liable for releasing out to the public?

If I found or created a 0day and decided to immediately release it into the wild (Giving a P.o.c w/ source). But not using it to actually exploit anything. Can I be held liable for it?
9
votes
2answers
497 views

How does the Copyright Alert System work? Who has implemented it?

Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright. I'm concerned how this oversight relates to my private traffic, and what laws ...
6
votes
3answers
1k views

attack/abuse notification email template

I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock. Are there examples of templates used for this ...
-1
votes
2answers
1k views

Port scanning legal or not? [closed]

Is port scanning legal ? In which countries ? my option : I think port scanning is like a short-walk( or a long-walk) in the neighbourhood, just curious about neighbours are up to. I think that ...
1
vote
3answers
563 views

Are tracking cookies illegal?

I have a merchant website. When a user visits the website, a cookie is set. Then when the same user visits the site again, we provide him with suggestions, content that he may enjoy based on what ...
19
votes
4answers
1k views

Are anti-virus companies companies regularly committing software piracy?

As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software: This got me to thinking, what ...
6
votes
3answers
1k views

If PCI DSS isn't a law, how can I be prosecuted for not being compliant?

PCI DSS isn't a law. Why can I be prosecuted for not being compliant?
2
votes
2answers
164 views

Cloud services - A window to outsourcing illegal activities?

Recently I was exposed to a number of stories where alleged illegal activities (for this case, we can take brute-force) are outsourced to the cloud, and are run by the cloud providers. The providers, ...
21
votes
2answers
8k views

Minimum requrements for storing last 4 digits of credit card number?

We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
9
votes
1answer
765 views

Best way to report a foreigner attacker's ip to authorities?

I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe? From your experience what is the ...
1
vote
2answers
178 views

Repost: Wappalyzer selling datasets - possible website security implications? [closed]

This question has originally been posted to Stackoverflow but then I found that this was the right place to ask. If you are a moderator, please delete this question at SO. Hello everyone, I am ...
4
votes
4answers
160 views

When should police be notified about host intrusion?

If an attacker gains unauthorized access to a host, or makes unauthorized modifications to information on that host, is it appropriate to contact the police or some other law-enforcement agency? In ...
1
vote
1answer
351 views

Web Crawling Legal Issues [closed]

I am wondering if there are any legal guidelines concerning web-crawling. Assuming that I respect the robots.txt, what else do I have to take into account. Are there any restrictions regarding e.g. ...
3
votes
3answers
720 views

How “enforcable” are email disclaimers

Perhaps a more policy questions, and undoubtedly different in differnet parts of the world, but enterprise email "signatures" often include a snippet simmilar to the following: This email and any ...
1
vote
1answer
2k views

Are SQL injection scans considered illegal? [closed]

I know that this thread mentions that Essentially, if you are seen to be someone who knows what you are doing, then even typing in a single-quote to a web form has been enough to be arrested ...
1
vote
3answers
225 views

Is purging AES keys allowed legally?

We're developing a service, that encrypt e-mail with AES algorithm. Keys are stored in our server. We thought about having an expiration service, that is deleting the key from our server. This ...
0
votes
1answer
909 views

Are phone calls normally recorded? [closed]

A person borrowed a cellphone and made a prank call and the following day the police contact the owner of the phone. The constable said "I can pull your call logs and you would have no say in it". My ...
0
votes
1answer
402 views

Data Retention Laws for ISPs in North America

I was reading an article on TorrentFreak where Private Internet Access claims the United States "is one of the only countries without a mandatory data retention law." According to the linked article ...
0
votes
2answers
324 views

Can a man engaged in phishing be prosecuted if I know his IP?

My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
2
votes
2answers
213 views

What may a Hungarian employer do with the employee monitoring logs?

Employers often monitor employee network access, even install keyloggers on their computers, etc. But the articles I found on the internet, is about the monitoring but not what they may do with the ...
4
votes
1answer
274 views

Does deliberately wrong information from a DNS server violate standards generally accepted good practices?

For certain host names my DNS gives me a wrong ip address (the ip address of a transparent proxy) for which inverse DNS look up does not give me back the host I originally looked up. This is related ...
4
votes
4answers
7k views

What are the laws regarding ISP recording IP addresses? How would they know who had which?

Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address ...
-5
votes
4answers
254 views

Is TLS-in-TLS supported in any software? Does it make sense? [closed]

I got fun idea how to increase the security of the SSL (TLS) for websites. However I think there is no support for it in the browsers, so I thought I could add it eventually, but have no idea if it's ...
4
votes
3answers
333 views

Protect our payroll data from a legal and moral obligation

We have our payroll software to be installed on our file server. This contains all the details of current and past employees. The data contained in the payroll software includes tax, bank, National ...
9
votes
4answers
420 views

How should I tell an organisation that they are vulnerable when I wasn't given permission to check?

I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
2
votes
3answers
417 views

Losing Private Keys

Suppose my friend and I make public private key pairs, send some test emails back and forth and a few days later he loses his private key. Is either of us now in potential danger? Could we be ...
2
votes
1answer
51 views

Does SGC Support reduce HTTPS security?

Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption. This article says SGC should never be ...
2
votes
1answer
290 views

Is there any reason to not use DKIM, SPF, and SenderID because it affects plausible deniability?

Is there any basis in not deploying anti-spam (or deliverability) technologies like DKIM, SPF, and SenderID because it affects plausible deniability? Some definitions to get everyone on the same ...
3
votes
1answer
1k views

How to backup database to comply with UK data protection act?

Charity has a server in their office onto which they backup a database with sensitive information. They want to get rid of this server. Is there a cost effective solution that would allow them to ...
5
votes
3answers
376 views

Is my sons' school portal in violation of any Password/UserID rules?

My sons' school sends both ID and PW for a portal through USPS at various times during the year, (e.g. class registration) whether I need it or not. If I change the password, it sends a confirmation ...
2
votes
2answers
352 views

Google Account Compromised - Possible Investigation?

This morning, I've not been able to login to my Google Account. Google says, my account has been compromised and I had to walk through account credentials recovery and verify (SMS to verify phone ...
1
vote
3answers
1k views

Is scanning a site directory considered illegal penetration testing?

Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
-1
votes
2answers
169 views

Is it Illegal to break out of a forum post by using CSS for example?

Is it illegal in the UK to post styling that breaks out of a post? For instance, if styling were allowed here and I were to use it to change some stackexchange pictures on this page, would that be ...
3
votes
5answers
329 views

Laws on Programming Security Tools

I am currently working on some POST GATHER modules for the Metasploit Framework the idea is that after a shell is spawned on the target, it will gather certain files from the target such as chat logs. ...
2
votes
2answers
616 views

Hacking / Penetration Testing Laws

Is it illegal to post tutorials and articles on hacking related things? In particular in the UK. For example would it be illegal under this law? http://www.legislation.gov.uk/ukpga/1990/18/section/3A ...
2
votes
4answers
252 views

What actions should be taken by site according to Data Protection legislations?

Many countries have data protection legislation: Data Protection Directive in EU Data Protection Act 1998 in UK privacy laws in USA Web application may have registration form where fields for ...
12
votes
2answers
718 views

What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?

I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder. Lets assume, for the sake of this rather hypothetical question, that a ...