Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investiagtion and trial.
54
votes
11answers
6k views
How can I punish a hacker?
I am a small business owner. My website was recently hacked, although no damage was done; non-sensitive data was stolen and some backdoor shells were uploaded. Since then, I have deleted the shells, ...
41
votes
16answers
2k views
Can we still provide confidentiality when cryptography is outlawed?
In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are ...
27
votes
7answers
2k views
Is it illegal to read an e-mail that was accidentally sent to you?
I'm not sure if this is the right website to ask this but I'm giving it a shot.
I got the following message in an email today: (it's translated so sorry for the typo's/mistakes)
This e-mail and ...
23
votes
4answers
1k views
consequences of grey hat hacking
While I was working on a anomaly detection system (finding cheaters in a quite popular online game service) I accidentally found a way to get a password of a user in a reasonable amount of time. ...
21
votes
6answers
5k views
Sharing wifi at a business - Bad Policy?
Is it safe for a small business to let customers use their wifi while waiting?
My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
21
votes
3answers
968 views
What access does UK Police currently have to ISP logs, and what information can said logs provide?
I'm currently researching a novel that has a crime element that centres around Internet-exclusive relationships and I would appreciate any help you might be able to offer regarding how much access the ...
18
votes
6answers
6k views
Is Facebook allowed to sell/give your information away to anyone willing to buy it?
Is Facebook allowed to sell information about their users to other companies?
For example selling name, address and IP information on a specific geographic location could be very valuable ...
18
votes
4answers
1k views
Are anti-virus companies companies regularly committing software piracy?
As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software:
This got me to thinking, what ...
17
votes
5answers
681 views
Is there any legal reason to save a cleartext password?
I called customer service of a well known company and discovered that the operator had the ability to view my website password in clear text on her screen.
I asked her about this and she defended the ...
17
votes
2answers
430 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
16
votes
2answers
3k views
Minimum requrements for storing last 4 digits of credit card number?
We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
15
votes
4answers
746 views
Can ECC be used without infringing on patents?
Can ECC (Elliptic Curve Cryptography) be safely used without infringing on Certicom's patents?
I would like to make use of ECC in an embedded system to establish a secure channel. But, I am concerned ...
14
votes
3answers
674 views
Techniques for ensuring verifiability of event log files
Bit of newbie at the whole forensics stuff - but I'm trying to find out what I should have in place before an attack. While there is no end of material on the internet about forensics from seizure ...
12
votes
5answers
721 views
Is it legal to log passwords from failed logins?
Is it legal to store/log mistyped passwords?
How many of you have seen this happen in a log file or DB?
12
votes
5answers
28k views
Can someone steal money from my bank account if they know my IBAN and personal details?
To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
12
votes
4answers
777 views
Is Steganography considered encryption and subject to USA export restrictions?
I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume ...
11
votes
6answers
3k views
At what point does “hacking” become illegal?
Hypothetical situation:
before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites.
Issue:
this situation raises a big ...
11
votes
5answers
359 views
How can citizens prevent government-led Internet blackouts?
The United Nations now considers Internet access a basic human right. [PDF]
Despite the questionable effectiveness of Internet blackouts in silencing a populace and preventing uprisings1, it's ...
11
votes
3answers
414 views
If I find or create a 0day exploit, can I be held liable for releasing out to the public?
If I found or created a 0day and decided to immediately release it into the wild (Giving a P.o.c w/ source). But not using it to actually exploit anything. Can I be held liable for it?
11
votes
3answers
328 views
How to secure identity after someone dies?
How would you go about securing the online identity(ies) of someone as best you can after they've died, when they haven't put anything in place ahead of time for this event?
Assume we don't know how ...
10
votes
7answers
492 views
Is the law the only thing stopping many sites from being hacked/cracked?
There are so many common vulnerabilities out there, so how is it that every Wordpress blog, for example, isn't hacked into often?
It seems like the security community is overly paranoid, unless the ...
10
votes
2answers
492 views
What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?
I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder.
Lets assume, for the sake of this rather hypothetical question, that a ...
10
votes
3answers
2k views
Should anyone support / implement P3P policies? Do they matter? Are they legally binding?
Google and Facebook authentication both have fake P3P policies in the HTTP headers that link to a webpage that explains why they don't support it:
CP="This is not a P3P policy! See ...
10
votes
3answers
539 views
Encryption-Laws in Iran
According to this article Iran has criminalized the usage of encryption and VPNs.
According to this blog post it is still possible to use SSH tunnels in Iran.
For me SSH is encryption and thus ...
9
votes
1answer
330 views
Best way to report a foreigner attacker's ip to authorities?
I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe?
From your experience what is the ...
9
votes
4answers
387 views
How should I tell an organisation that they are vulnerable when I wasn't given permission to check?
I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
9
votes
2answers
141 views
War dial research
Anyone know of any specific UK Law that would prevent the use of war dialling as part of a security research project?
9
votes
2answers
366 views
How does the Copyright Alert System work? Who has implemented it?
Some ISPs are participating in a Copyright Alert System that notifies content authors of violations of their copyright.
I'm concerned how this oversight relates to my private traffic, and what laws ...
8
votes
3answers
373 views
How do researchers “gain control of an attacking PC” and not themselves be considered attackers / criminals?
In reference to this Network Computing Report article titled "'Operation Shady Rat' Perpetrated Five Years Of Long-Term Attacks On Government, Enterprises"
The Cliff's Notes to the article is thus: ...
8
votes
2answers
174 views
How can one easily determine which IT Security related regulations apply?
Joe Tech gets a job managing Acme Startup's IT services. Acme Startup handles information of X, Y, and Z data types, and offers services A, B, and C. Joe Tech is aware that some of these data types ...
8
votes
5answers
1k views
Privacy issues with email providers
I am looking for an email provider (or for a way to do it myself) that will not divulge my personal information under no circumstances. I found out that getting this information with a order for ...
7
votes
7answers
2k views
Storing credit cards for automatic payments?
I have no experience with storing credit cards and I do not know anything about the legal end of this.
The company I work for / develop for wants to store credit cards to process auto payments for ...
7
votes
4answers
738 views
Copyright issues with encryption algorithms
I'm developing application for Android/Java. Application is a kind of password manager, so I'm storing encrypted passwords under the hood of master password. There are number of encryption algorithms ...
7
votes
5answers
488 views
What security requirements are a defacto standard in the Financial Industry?
What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry?
If you're familliar with the Financial Industry, can you share details? For example:
What ...
7
votes
3answers
720 views
What does a court need to successfully prosecute a hacker? Please cite previous cases if possible
Once a business decides it is worthwhile to persue legal action against the attacker, what information and processes should be followed so that:
Integrity of the investigation is maintained
The ...
7
votes
2answers
208 views
Business-to-Business Security Disclosure and Agreement
Looking for a template covering the disclosure information security practices that are standard in Business-to-Business partnerships that share data.
For example:
Access management
Password ...
6
votes
3answers
297 views
Can I develop SSH-based tools within United States?
It is well known that development of open-source cryptographic tools is very problematic within the United States: all open-source ssh-based software was specifically developed outside of the US of A ...
6
votes
3answers
488 views
attack/abuse notification email template
I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.
Are there examples of templates used for this ...
6
votes
1answer
3k views
Why is it so hard to close onion domains (e.g. The Silkroad)?
A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor)
For those who do not know what Tor is and who do not want to waste their time ...
5
votes
3answers
473 views
If PCI DSS isn't a law, how can I be prosecuted for not being compliant?
PCI DSS isn't a law. Why can I be prosecuted for not being compliant?
5
votes
7answers
2k views
Can I reclaim ex employee gmail account?
This is the best place in SE I can find to post this.
We have an ex employee who created a gmail account for work purposes that looks like staff_name.company_name@gmail.com
He left the company and ...
5
votes
2answers
280 views
How to refute “don't use internet if you don't like it” answer?
I hope it is legit question, similar to, for example, Why do law-abiding citizens need strong security?, et al. and it is tightly conected with user's security, privacy, etc.
The response I always ...
5
votes
2answers
998 views
Is strong cryptography legal across the internet?
In many countries strong cryptography is outlawed. That means you must store the data of your users in such a way, that government of that country can always decrypt it. And if you don't, you are a ...
5
votes
3answers
350 views
Is my sons' school portal in violation of any Password/UserID rules?
My sons' school sends both ID and PW for a portal through USPS at various times during the year, (e.g. class registration) whether I need it or not.
If I change the password, it sends a confirmation ...
5
votes
2answers
661 views
Export laws on the cloud (key size)
Do the U.S. export laws around AES-256 apply to applications hosted in the cloud?
5
votes
3answers
184 views
Sourcing hardware that is least likely to contain backdoors
I understand that CPU silicon (for example) is scrutinized for backdoors but there are other aspects of a computer system that may "leak data" to the outside world unbeknownst to the owner regardless ...
5
votes
1answer
236 views
How does sound signature recognition work and how to override it?
Today a lot of websites that allow the upload of media content are implementing automatic sound signature checks to prevent the illegal distribution of videos containing copyrighted content.
How ...
4
votes
6answers
539 views
What might be the legal and policy consequences of traffic sniffing?
I found a security hole in an organisation in the UK with many employees. Login form sends user name and password in clear text to the public facing IP via HTTP. Initially I pointed this to IT but ...
4
votes
2answers
162 views
What to do in response to a source code and/or database leak by a third party hosting provider?
My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak.
On first appearances, the web host ...
4
votes
4answers
381 views
What particular concerns should one bear in mind when wardriving?
I'm considering starting a neighborhood-wide wardrive, with the objective of raising awareness to the risks of running unsecured wireless networks.
Right now, I'm still in the planning stages of this ...
