Tag Info

Hot answers tagged

127

There's no way that a pentester can 100% assure that data will not be modified or deleted, in the same way as they can't assure that system availability won't be affected (I've knocked systems over with a port scan or a single ' character). as you say a web crawler can delete data from a system if it's been set-up badly. I'd say that what should be said is ...


115

You don't punish the hacker. The law does. Just report whatever pieces of information you have to the police and let them handle it. However, it is very unlikely that the attacker will be caught. The IP address you posses most likely belongs to another system that the attacker has compromised and is using as a proxy. Just treat it as a lesson learnt and ...


81

A pentester who claims that he will never alter production data is either a filthy liar, or thinks himself to be a lot more competent than he really is, or strongly intends to do nothing at all (that's the only surefire way of never breaking anything). In any case, you don't want to work with that guy. A prospective customer who believes that skilled ...


74

The fundamental question here is authorization, not access. If you break into your neighbor's house, clearly you are in violation of the law. But if he lets you in, then you are not. So what if you have a key? If he gave you the key along with permission to enter (to feed his dog while he's away), then you have authorization to enter. No trespass there. ...


60

So you have identified the IP address involved in the process of hacking your website. Congratulations! What makes you believe that this IP is indeed a hacker's IP address, and not simply another hacked into computer running in zombie mode? And who is to say, that your own web server didn't run in exactly the same zombie mode until you removed the shells ...


59

Foreword: This problem isn't necessarily about governments. At the most general level, it's about online services giving their data about you (willingly or accidentally) to any third party. For the purposes of readability, I'll use the term "government" here, but understand that it could instead be replaced with any institution that a service provider has a ...


44

Despite the media hype, the key thing here is not that the FBI/NSA/US Government was intercepting all phone calls, but that it was collecting all phone 'metadata' records which includes: Originating Phone Number Terminating Phone NUmber IMSI Number IMEI Number Trunk Identifier (which relates to the location) Telephone Calling Card numbers Time of the call ...


36

The term most often used to describe what you're talking about is Hacking Back. It's part of the Offensive Countermeasures movement that's gaining traction lately. Some really smart people are putting their heart and soul into figuring out how we, as an industry, should be doing this. There are lots of things you can do, but unless you're a nation-state, or ...


34

You can't allow customers to be on the same network as your own computers. A lot of new WiFi access-points take care of this for you, by creating two wifi networks, where the "guest" network does not have access to internal computers. The Cisco/Linksys 4200 is what I have at home for guests, and it's easy to setup, but there are many other systems that have ...


32

It is legal to tell them about the bug, giving them a detailed description of the bug and how you came across it. What is unpredictable is the company's reaction. It could vary to something such as them sending you a reward/small gift (has happened to me), to them trying to prosecute you as a criminal (tipping them off anonymously could help with this ...


31

http://www.economist.com/node/18529895 "Spare us the e-mail yada-yada Automatic e-mail footers are not just annoying. They are legally useless" At least in the EU. And no case has ever succeeded in the US either.


31

To add to the answer from @RoryAlsop I'd agree that you probably don't, as an average person, have a lot to worry about in terms of the PRISM/phone tapping by the NSA being used for it's intended purprose (anti-terrorism operations by the US gov.) as people's concept of security/privacy most of the time isn't too great. There are other good reasons to be ...


31

It is an information leak on the Silk Road server. It appears somebody located a debug or info screen on the Silk Road server that dumped configuration and environment variables. Some possibilities: The output of Apache's mod_status (example) Output of phpinfo() (example) A custom debug page that is part of the Silk Road application It could have been ...


27

In Canada it appears as though that you're safe ... for now. Anywhere else, it depends on whether by "search bugs" you mean to find exploits on someone's site that might violate their Terms and Conditions of usage for the website (Eg. Penetration Testing). There are a couple of different ways this could go, depending on the reaction of the person who ...


25

First, this question has to be answered in a country-specific context, because each country has its own laws and regulation regarding computer crimes, intrusions, data manipulation etc. One important thing to consider also is that the persons who will judge those cases are not technical aware people. They usually have no clear idea of what a database is, ...


23

There is a classic phrase: "If you are not paying for it, you're not the customer; you're the product being sold" In case of companies' liquidation, they openly sell their user databases on the internet as one of the liquidated assets. Well, think this way. If Microsoft bought , say, Skype, had Skype sold its user database and what is the ...


22

I don’t think that “legal” is the right term to use. It’s not wise, a lot of times “right” password is only one letter different from the “wrong” password (typo/capital letters/…). So if somebody evil will get this log he may easily guess the correct password. Other problem is that people re-use passwords, so they use same password for your ...


21

Don't play their game, you'll lose I've learned not to play that game, hackers by nature have more spare time than you and will ultimately win. Even if you get him back, your website will be unavailable to your customers for a solid week afterwards. Remember, you're the one with public facing servers, you have an IP of a random server that he probably used ...


20

Cardholder name, 4 last digits of CC number and its expiration date are all NOT sensitive data. The cardholder name and expiration date only require protection if you are storing them with the full primary account number, not the truncated 4 digit number. If you are storing, processing, or transmitting cardholder data then you must meet all of the other PCI ...


20

What I'm confused about is where is the line between illegal hacking and just using information which is publicly visible? The question is whether this information is considered public, even if it's publicly visible. In this particular case it's 100% clear that this is not the case. Even when a server admin leaves this bug unpatched, it doesn't mean ...


19

The law is unclear. Anything you do, no matter how innocent, could be considered a crime. All the website owner has to do is say "I didn't want that to happen", and you could be convicted of a crime. Before donating to a tsunami relief website, Daniel Cuthbert typed in ../../../ in the URL. He was convicted of "intent to hack" (in the UK). Lori Drew was ...


19

There really isn't enough information here to make a determination about your question. Jurisdiction and exactly what went on with how you found a flaw in the security and how you tested it and what their terms of service (which define how you are allowed to use their computers and data) all matter. In general, "hacking" isn't what is legal or illegal, ...


18

There is no copyright on algorithms. Algorithms are like ideas; the kind of intellectual property which applies to them is patents, not copyrights. There are some cryptographic algorithms which are patented, but most are not and some used to be patented (but patents ultimately expire). Neither DES, AES, Blowfish or Twofish is patented. An example of patented ...


18

Thanks for the insightful question. The more I think about it the more it feels like someone has pulled the rag below my feet (living without cryptographic protection). Analyzing the resulting threats (strictly from the business point of view - the requirements of dissidents etc. are a different story), I see them being: Corrupt government officials who ...


18

This is an excellent and important question. There are several important techniques to know about: Remote logging. Rather than store the log entries on the webserver, the webserver should be configured to send each log entry over the network to a log server. The log server should be a custom machine, configured for a single use (log recording only), and ...


18

Is it safe for a small business to let customers use their wifi while waiting? No. Even if no customer intentionally attacks his WiFi network they could be carrying some type of malware on their laptop/smart phone/portable device that might spread. Additionally the WiFi signal doesn't end at the front door. You have probably connected to a WiFi some ...


18

The ECC implementation in OpenSSL has been contributed by Sun (now Oracle) and was, supposedly, written that way precisely to avoid any patented method. Otherwise, as AviD suggests, using an implementation which is already provided by the platform you use (Java, .NET...) is a neat way to avoid any patent trouble: if there was such trouble, it would first ...


18

As someone who tracks people and their habits for a living, I will share a few observations about the average user. Implications of the phone information collection initiative on the internet: There will be a little more activity online worrying about privacy. The twitterverse will "explode" momentarily, but people will be aware of this as something going ...


17

In theory you should still be able to achieve confidentiality protection in some circumstances, because crypto isn't the only way to provide confidentiality, you can also provide it via access control. Realistically however it is difficult to think of any real world system where you can usefully achieve this without at least something like SSL in the ...



Only top voted, non community-wiki answers of a minimum length are eligible