Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.
1
vote
0answers
44 views
What parts of Bouncy Castle are affected by patents? [migrated]
Given that Bouncy Castle is an Open Source project, it's entirely possible that the contents contains implementations protected by various patents.
Since it's possible for the patent holder to sue ...
54
votes
11answers
6k views
How can I punish a hacker?
I am a small business owner. My website was recently hacked, although no damage was done; non-sensitive data was stolen and some backdoor shells were uploaded. Since then, I have deleted the shells, ...
21
votes
3answers
1k views
What access does UK Police currently have to ISP logs, and what information can said logs provide?
I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
7
votes
7answers
2k views
Storing credit cards for automatic payments?
I have no experience with storing credit cards and I do not know anything about the legal end of this.
The company I work for / develop for wants to store credit cards to process auto payments for ...
1
vote
1answer
178 views
Can we protect domain name by law? [closed]
Some company have domain names worth a million dollar. But sometime they are lost to hackers. So I wonder how can we protect domains by law instead of technology?
9
votes
2answers
366 views
How does the Copyright Alert System work? Who has implemented it?
Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright.
I'm concerned how this oversight relates to my private traffic, and what laws ...
7
votes
3answers
722 views
What does a court need to successfully prosecute a hacker? Please cite previous cases if possible
Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that:
Integrity of the investigation is maintained
The ...
0
votes
2answers
300 views
Why can't the police/government shut down black market websites? [duplicate]
I've been told that black market websites that have pretty much every drug, guns and all sorts of illegal things for sale don't actually exist on the internet, and I was then told some lengthy ...
-4
votes
2answers
129 views
Is it illegal to test a website and report the security bugs to them? [closed]
I am doing testing on some websites and I have found some serious bugs in those sites.
I am not sure if this is legal or not.
Is it ever legal?
How can I find out if it's legal where I live?
What ...
6
votes
1answer
3k views
Why is it so hard to close onion domains (e.g. The Silkroad)?
A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor)
For those who do not know what Tor is and who do not want to waste their time ...
-1
votes
1answer
77 views
For a Broker/Dealer, what technology is appropriate to limit transaction to a given state? [closed]
The SEC allows for individuals to not register with them if they don't permit business with users outside of the state:
A broker-dealer that conducts all of its business in one state does
not ...
-3
votes
1answer
98 views
Does PGP key I created and uploaded have any legal value? [closed]
Suppose you done:
gpg2 --gen-key
...
gpg2 --keyserver pgp.mit.edu --send-keys ...
Does such key have any legal meaning, e.g. to assert that it was really me that signed some message?
What can be ...
2
votes
2answers
179 views
What certification would be considered equivalent to the U.S.-EU Safe Harbor Framework?
The Safe Harbor website says the following:
The European Commission’s Directive on Data Protection went into effect in October of 1998, and would prohibit the transfer of personal data to ...
7
votes
5answers
489 views
What security requirements are a defacto standard in the Financial Industry?
What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry?
If you're familliar with the Financial Industry, can you share details? For example:
What ...
12
votes
5answers
28k views
Can someone steal money from my bank account if they know my IBAN and personal details?
To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
15
votes
4answers
762 views
Can ECC be used without infringing on patents?
Can ECC (Elliptic Curve Cryptography) be safely used without infringing on Certicom's patents?
I would like to make use of ECC in an embedded system to establish a secure channel. But, I am concerned ...
2
votes
1answer
123 views
Legality and ethics of cryptanalysis on password hashes
I'm working on my dissertation concerning cryptanalysis on password hashes. I'd like to delve into the legal and ethical aspects of cryptanalysis, however, seeing as I'n not at all well versed in law ...
0
votes
3answers
246 views
Penetration testing against an ignorant target - Is it legal? [closed]
I know it's a big no-no in terms of etiquette, but is it illegal in Canada to perform penetration testing against a commercial company without authorization?
prompted by: ...
-4
votes
4answers
123 views
Law & Ethics - I'm not be breaking the law its the computer [closed]
So it would be illegal to run a metasploit attack against a computer you don't have permission to do so against, right? But what if I configure a web server to nmap scan, then metasploit attack ...
3
votes
2answers
664 views
How effectively can ISPs detect illegal file sharing?
Recently the USA passed a law requiring ISPs to spy on their customers' internet connections to check for illegal file sharing. I assume that they would do this by sniffing packets, but doesn't this ...
1
vote
3answers
132 views
Is there a law against one email containing both a login and a password?
I see most companies either supply a login or a password in an email, but never both in one email. Is this a "best practice" or is there an actual law that prevents legitimate companies from providing ...
0
votes
1answer
130 views
What defines a 'defense contractor' and what is required to be reported in new US law? [closed]
According to news articles (eg here) the 2013 National Defense Authorization Act, which was signed into US law 2-Jan-2012, apparently requires defense contractors to report intrusions. What defines a ...
6
votes
3answers
297 views
Can I develop SSH-based tools within United States?
It is well known that development of open-source cryptographic tools is very problematic within the United States: all open-source ssh-based software was specifically developed outside of the US of A ...
3
votes
6answers
320 views
Is hacking back a valid security technique for companies?
Recently it has come to light through the reverse engineering of hacking tools that there are vulnerabilities in them that could be exploited to take over an attackers computer during a remote hacking ...
23
votes
4answers
1k views
consequences of grey hat hacking
While I was working on a anomaly detection system (finding cheaters in a quite popular online game service) I accidentally found a way to get a password of a user in a reasonable amount of time. ...
0
votes
2answers
82 views
Security in the breaking cloud? Storage Wars?
If access to a cloud server instance that stores personal/important information is lost or removed by the provider, is my data protected? Can the provider access my data and copy it, distribute, or ...
3
votes
2answers
131 views
are there any services to test nmap
While playing with nmap, I have started to wonder: are there any ip addresses which were specifically made to learn how to use nmap.
(As far as I understood I can not just scan any ip address, ...
1
vote
1answer
108 views
How do the authorities know who's downloading protected software?
Out of curiosity do the web based file hosting services such as Oron and Rapidshare store information about who downloads what? I ask because I'm wondering, when someone is "caught" downloading ...
5
votes
3answers
185 views
Sourcing hardware that is least likely to contain backdoors
I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
11
votes
6answers
3k views
At what point does “hacking” become illegal?
Hypothetical situation:
before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites.
Issue:
this situation raises a big ...
1
vote
2answers
243 views
Is it legal to store/send user's device's IMEI/MEID? [closed]
I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that.
Is it legal to store/send user's ...
41
votes
16answers
2k views
Can we still provide confidentiality when cryptography is outlawed?
In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are ...
11
votes
3answers
415 views
If I find or create a 0day exploit, can I be held liable for releasing out to the public?
If I found or created a 0day and decided to immediately release it into the wild (Giving a P.o.c w/ source). But not using it to actually exploit anything. Can I be held liable for it?
1
vote
3answers
241 views
Are tracking cookies illegal?
I have a merchant website. When a user visits the website, a cookie is set. Then when the same user visits the site again, we provide him with suggestions, content that he may enjoy based on what ...
0
votes
0answers
79 views
Exhaustive list of abuse notifications that organizations get [closed]
What are the different types of abuse notifications that organizations get? Here are some I could get off the web, but would be good to identify if someone already has a list of "types of abuse" ...
6
votes
3answers
495 views
attack/abuse notification email template
I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.
Are there examples of templates used for this ...
18
votes
4answers
1k views
Are anti-virus companies companies regularly committing software piracy?
As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software:
This got me to thinking, what ...
3
votes
1answer
186 views
HITECH : New United States Federal Act on Data Security
Has anyone heard of the new HITECH Federal Act? I understand that it is an underscore of the HIPAA Federal Act but am unclear of the requirements that they are requesting.
It targets companies that ...
-1
votes
2answers
401 views
Port scanning legal or not? [closed]
Is port scanning legal ?
In which countries ?
my option :
I think port scanning is like a short-walk( or a long-walk) in the neighbourhood, just curious about neighbours are up to.
I think that ...
10
votes
7answers
492 views
Is the law the only thing stopping many sites from being hacked/cracked?
There are so many common vulnerabilities out there, so how is it that every Wordpress blog, for example, isn't hacked into often?
It seems like the security community is overly paranoid, unless the ...
9
votes
1answer
332 views
Best way to report a foreigner attacker's ip to authorities?
I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe?
From your experience what is the ...
5
votes
3answers
478 views
If PCI DSS isn't a law, how can I be prosecuted for not being compliant?
PCI DSS isn't a law. Why can I be prosecuted for not being compliant?
16
votes
2answers
3k views
Minimum requrements for storing last 4 digits of credit card number?
We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
2
votes
2answers
127 views
Cloud services - A window to outsourcing illegal activities?
Recently I was exposed to a number of stories where alleged illegal activities (for this case, we can take brute-force) are outsourced to the cloud, and are run by the cloud providers. The providers, ...
5
votes
1answer
236 views
How does sound signature recognition work and how to override it?
Today a lot of websites that allow the upload of media content are implementing automatic sound signature checks to prevent the illegal distribution of videos containing copyrighted content.
How ...
10
votes
3answers
540 views
Encryption-Laws in Iran
According to this article Iran has criminalized the usage of encryption and VPNs.
According to this blog post it is still possible to use SSH tunnels in Iran.
For me SSH is encryption and thus ...
1
vote
2answers
110 views
Repost: Wappalyzer selling datasets - possible website security implications? [closed]
This question has originally been posted to Stackoverflow but then I found that this was the right place to ask. If you are a moderator, please delete this question at SO.
Hello everyone,
I am ...
12
votes
5answers
721 views
Is it legal to log passwords from failed logins?
Is it legal to store/log mistyped passwords?
How many of you have seen this happen in a log file or DB?
4
votes
4answers
150 views
When should police be notified about host intrusion?
If an attacker gains unauthorized access to a host, or makes unauthorized modifications to information on that host, is it appropriate to contact the police or some other law-enforcement agency? In ...
0
votes
1answer
457 views
Are phone calls normally recorded? [closed]
A person borrowed a cellphone and made a prank call and the following day the police contact the owner of the phone. The constable said "I can pull your call logs and you would have no say in it". My ...
