Hot answers tagged

145

You don't punish the hacker. The law does. Just report whatever pieces of information you have to the police and let them handle it. However, it is very unlikely that the attacker will be caught. The IP address you posses most likely belongs to another system that the attacker has compromised and is using as a proxy. Just treat it as a lesson learnt and ...


138

There's no way that a pentester can 100% assure that data will not be modified or deleted, in the same way as they can't assure that system availability won't be affected (I've knocked systems over with a port scan or a single ' character). as you say a web crawler can delete data from a system if it's been set-up badly. I'd say that what should be said is ...


87

A pentester who claims that he will never alter production data is either a filthy liar, or thinks himself to be a lot more competent than he really is, or strongly intends to do nothing at all (that's the only surefire way of never breaking anything). In any case, you don't want to work with that guy. A prospective customer who believes that skilled ...


77

The fundamental question here is authorization, not access. If you break into your neighbor's house, clearly you are in violation of the law. But if he lets you in, then you are not. So what if you have a key? If he gave you the key along with permission to enter (to feed his dog while he's away), then you have authorization to enter. No trespass there. ...


77

If there is a teacher or counselor you can trust completely, that you know will keep your name secret even if the school administration starts making threats about firing people, I'd go to them first and talk to them in private. They don't need to understand computers or security (and you don't need to go into detail about the issue), they just need to be ...


74

So you have identified the IP address involved in the process of hacking your website. Congratulations! What makes you believe that this IP is indeed a hacker's IP address, and not simply another hacked into computer running in zombie mode? And who is to say, that your own web server didn't run in exactly the same zombie mode until you removed the shells ...


64

To the best of my knowledge, yes, it's legal. Every anti-hacking law I'm aware of refers to unauthorized access, and if you've got permission to hack it, it's not unauthorized, is it? Note that there are some things you'll need to watch out for. Some jurisdictions prohibit the possession of "hacking tools" (akin to prohibiting possession of lockpicks, but ...


55

Another thought struck me as I re-read your question (emphasis mine): How should I tell school that they are vulnerable when I wasn't given permission to check? Could you get permission? Once you have permission, you could "discover" the issue (without telling anyone you'd found it before) and report it without worrying about being blamed for hacking ...


48

Despite the media hype, the key thing here is not that the FBI/NSA/US Government was intercepting all phone calls, but that it was collecting all phone 'metadata' records which includes: Originating Phone Number Terminating Phone NUmber IMSI Number IMEI Number Trunk Identifier (which relates to the location) Telephone Calling Card numbers Time of the call ...


46

The term most often used to describe what you're talking about is Hacking Back. It's part of the Offensive Countermeasures movement that's gaining traction lately. Some really smart people are putting their heart and soul into figuring out how we, as an industry, should be doing this. There are lots of things you can do, but unless you're a nation-state, or ...


37

Cardholder name, 4 last digits of CC number and its expiration date are all NOT sensitive data. The cardholder name and expiration date only require protection if you are storing them with the full primary account number, not the truncated 4 digit number. If you are storing, processing, or transmitting cardholder data then you must meet all of the other PCI ...


36

You can't allow customers to be on the same network as your own computers. A lot of new WiFi access-points take care of this for you, by creating two wifi networks, where the "guest" network does not have access to internal computers. The Cisco/Linksys 4200 is what I have at home for guests, and it's easy to setup, but there are many other systems that have ...


35

It is an information leak on the Silk Road server. It appears somebody located a debug or info screen on the Silk Road server that dumped configuration and environment variables. Some possibilities: The output of Apache's mod_status (example) Output of phpinfo() (example) A custom debug page that is part of the Silk Road application It could have been ...


34

http://www.economist.com/node/18529895 "Spare us the e-mail yada-yada Automatic e-mail footers are not just annoying. They are legally useless" At least in the EU. And no case has ever succeeded in the US either.


34

To add to the answer from @RoryAlsop I'd agree that you probably don't, as an average person, have a lot to worry about in terms of the PRISM/phone tapping by the NSA being used for it's intended purprose (anti-terrorism operations by the US gov.) as people's concept of security/privacy most of the time isn't too great. There are other good reasons to be ...


34

It is legal to tell them about the bug, giving them a detailed description of the bug and how you came across it. What is unpredictable is the company's reaction. It could vary to something such as them sending you a reward/small gift (has happened to me), to them trying to prosecute you as a criminal (tipping them off anonymously could help with this ...


34

As pointed out by begueradj, any government agencies can access your cloud-stored files through a subpoena to Google. But your question was what they can do when they have your laptop alone and nothing else. This is not an unlikely scenario. It is the situation you have, for example, when you get arrested by law enforcement and they do not have sufficient ...


33

Don't play their game, you'll lose I've learned not to play that game, hackers by nature have more spare time than you and will ultimately win. Even if you get him back, your website will be unavailable to your customers for a solid week afterwards. Remember, you're the one with public facing servers, you have an IP of a random server that he probably used ...


29

Don't do it! Don't do it! If you are in the US, the law is very broad. You don't want to even tiptoe up to the line. The relevant law is the Computer Fraud and Abuse Act (18 U.S.C. 1030). In a nutshell (and simplifying slightly), under the CFAA, it is a federal crime to "intentionally access a computer without authorization or exceed authorized access". ...


28

In Canada it appears as though that you're safe ... for now. Anywhere else, it depends on whether by "search bugs" you mean to find exploits on someone's site that might violate their Terms and Conditions of usage for the website (Eg. Penetration Testing). There are a couple of different ways this could go, depending on the reaction of the person who ...


26

There is a classic phrase: "If you are not paying for it, you're not the customer; you're the product being sold" In case of companies' liquidation, they openly sell their user databases on the internet as one of the liquidated assets. Well, think this way. If Microsoft bought , say, Skype, had Skype sold its user database and what is the sense/...


26

First, this question has to be answered in a country-specific context, because each country has its own laws and regulation regarding computer crimes, intrusions, data manipulation etc. One important thing to consider also is that the persons who will judge those cases are not technical aware people. They usually have no clear idea of what a database is, ...


26

[Update #2] According to the Washington Post, sources familiar with the matter, have stated that the initially suspected collaboration with Cellebrite is not how the data from the encrypted iPhone was recovered. Instead an unknown security vulnerability was used (purchased) from "professional hackers" to prevent the phone from erasing its data and slowing ...


25

The law is unclear. Anything you do, no matter how innocent, could be considered a crime. All the website owner has to do is say "I didn't want that to happen", and you could be convicted of a crime. Before donating to a tsunami relief website, Daniel Cuthbert typed in ../../../ in the URL. He was convicted of "intent to hack" (in the UK). Lori Drew was ...


23

I don’t think that “legal” is the right term to use. It’s not wise, a lot of times “right” password is only one letter different from the “wrong” password (typo/capital letters/…). So if somebody evil will get this log he may easily guess the correct password. Other problem is that people re-use passwords, so they use same password for your site/gmail/...


22

As someone who tracks people and their habits for a living, I will share a few observations about the average user. Implications of the phone information collection initiative on the internet: There will be a little more activity online worrying about privacy. The twitterverse will "explode" momentarily, but people will be aware of this as something going ...


21

There is no copyright on algorithms. Algorithms are like ideas; the kind of intellectual property which applies to them is patents, not copyrights. There are some cryptographic algorithms which are patented, but most are not and some used to be patented (but patents ultimately expire). Neither DES, AES, Blowfish or Twofish is patented. An example of patented ...



Only top voted, non community-wiki answers of a minimum length are eligible