Hot answers tagged legal
95
You don't punish the hacker. The law does. Just report whatever pieces of information you have to the police and let them handle it.
However, it is very unlikely that the attacker will be caught. The IP address you posses most likely belongs to another system that the attacker has compromised and is using as a proxy. Just treat it as a lesson learnt and ...
45
So you have identified the IP address involved in the process of hacking your website. Congratulations!
What makes you believe that this IP is indeed a hacker's IP address, and not simply another hacked into computer running in zombie mode? And who is to say, that your own web server didn't run in exactly the same zombie mode until you removed the shells ...
32
You can't allow customers to be on the same network as your own computers.
A lot of new WiFi access-points take care of this for you, by creating two wifi networks, where the "guest" network does not have access to internal computers. The Cisco/Linksys 4200 is what I have at home for guests, and it's easy to setup, but there are many other systems that have ...
24
The term most often used to describe what you're talking about is Hacking Back. It's part of the Offensive Countermeasures movement that's gaining traction lately. Some really smart people are putting their heart and soul into figuring out how we, as an industry, should be doing this. There are lots of things you can do, but unless you're a nation-state, or ...
23
There is a classic phrase:
"If you are not paying for it, you're not the customer; you're the
product being sold"
In case of companies' liquidation, they openly sell their user databases on the internet as one of the liquidated assets.
Well, think this way. If Microsoft bought , say, Skype, had Skype sold its user database and what is the ...
20
I don’t think that “legal” is the right term to use.
It’s not wise, a lot of times “right” password is only one letter different from the “wrong” password (typo/capital letters/…).
So if somebody evil will get this log he may easily guess the correct password.
Other problem is that people re-use passwords, so they use same password for your ...
18
There is no copyright on algorithms. Algorithms are like ideas; the kind of intellectual property which applies to them is patents, not copyrights. There are some cryptographic algorithms which are patented, but most are not and some used to be patented (but patents ultimately expire). Neither DES, AES, Blowfish or Twofish is patented. An example of patented ...
18
There really isn't enough information here to make a determination about your question. Jurisdiction and exactly what went on with how you found a flaw in the security and how you tested it and what their terms of service (which define how you are allowed to use their computers and data) all matter. In general, "hacking" isn't what is legal or illegal, ...
17
In theory you should still be able to achieve confidentiality protection in some circumstances, because crypto isn't the only way to provide confidentiality, you can also provide it via access control.
Realistically however it is difficult to think of any real world system where you can usefully achieve this without at least something like SSL in the ...
17
Is it safe for a small business to let customers use their wifi while waiting?
No. Even if no customer intentionally attacks his WiFi network they could be carrying some type of malware on their laptop/smart phone/portable device that might spread. Additionally the WiFi signal doesn't end at the front door. You have probably connected to a WiFi some ...
17
There are lots of different ways in which PCI impacts what you do; I'd point out the data security standards (PCI-DSS). Among many other things, they require strong authentication for anyone accessing the system remotely, and have a wide variety of restrictions on what kind of data you can keep.
Don't even think about storing credit cards without ...
16
The following is information found here: http://www.out-law.com/page-5536 and is based on UK law, written by a lawyer specialised in internet law. I believe it fully answers your question.
Email confidentiality notices
The confidentiality notice is an
attempt to say that the content of the
email is confidential and that it
should not be read ...
16
The law is unclear. Anything you do, no matter how innocent, could be considered a crime. All the website owner has to do is say "I didn't want that to happen", and you could be convicted of a crime.
Before donating to a tsunami relief website, Daniel Cuthbert typed in ../../../ in the URL. He was convicted of "intent to hack" (in the UK).
Lori Drew was ...
15
Thanks for the insightful question. The more I think about it the more it feels like someone has pulled the rag below my feet (living without cryptographic protection).
Analyzing the resulting threats (strictly from the business point of view - the requirements of dissidents etc. are a different story), I see them being:
Corrupt government officials who ...
15
Letting guest coming on your network is not a good idea. But this has already been said.
A major point that must must remarked is that even for guest you need identification and authentication. In fact (I am not aware of you laws) you want to make sure to be able to track back any user of your WiFi in case of a problem with justice. If someone comes to tell ...
15
There's always an "Abuse" email address on the whois of a netblock for reporting misuse of an IP address.
You can use http://whois.domaintools.com/ to do a whois lookup to get the address.
Is it worth your time? That's your call. Will it lead to anything? Nothing you'll ever see. But many of the sites I fix come from people who were first alerted of the ...
15
First, IANAL. Secondly, this is entirely dependant on your local laws and regulations.
PCI-DSS is a guideline, but adherence to the guideline may be a requirement as part of certain laws. I'm not aware of any countries that do this, but in such a case you could be prosecuted if you violate a law that makes PCI-DSS adherence mandatory.
The more common case ...
14
The ECC implementation in OpenSSL has been contributed by Sun (now Oracle) and was, supposedly, written that way precisely to avoid any patented method. Otherwise, as AviD suggests, using an implementation which is already provided by the platform you use (Java, .NET...) is a neat way to avoid any patent trouble: if there was such trouble, it would first ...
14
This is an excellent and important question. There are several important techniques to know about:
Remote logging. Rather than store the log entries on the webserver, the webserver should be configured to send each log entry over the network to a log server. The log server should be a custom machine, configured for a single use (log recording only), and ...
13
The only instance where I can think of the FCC requiring that a password be clear is related to amateur radio, and even that isn't truly the case.
In six years at an audit firm, and all in everything I've ever read including a lot of court briefings, I've never heard anything that hints that such madness is actually justified anywhere.
It's not uncommon ...
13
Yes - Facebook's customers are not you, me or other individuals, but companies. Individuals and their data are the product, not the customer.
Companies who provide a Facebook app can get any information about you that they want.
Facebook is allowed to provide this information to their customers - you can prevent it by never installing any Facebook apps, ...
13
Cardholder name, 4 last digits of CC number and its expiration date are all NOT sensitive data. The cardholder name and expiration date only require protection if you are storing them with the full primary account number, not the truncated 4 digit number.
If you are storing, processing, or transmitting cardholder data then you must meet all of the other PCI ...
12
From a purely objective view, I don't think there is any evidence showing that cyberlaws are having a large impact on computers not being cracked. It's too easy to avoid prosecution (jurisdiction) and it's too easy to automate mass cracking.
On a more subjective view, I think the cyberlaws do keep the highly skilled security professionals honest, because ...
12
Even without cryptography, you could use steganography to make information hard or in some cases near impossible to find. It seems difficult to imagine a situation under which government could effectively ban that, since one could claim that a secret message was hidden anywhere and it is very difficult for an accused individual to demonstrate otherwise ...
12
I think there's not enough information to answer. Without seeing the exact text of the law, we can't say whether it will be possible to communicate securely; it depends. That said, I will make two small points.
I think if legislators really want to prevent secure communication, they'll do that. Sometimes technical folks think that legislators are dumb ...
12
IBAN are used to identify a recipient.
The check digits enable the sending bank (or its customer) to verify the validity of a routing destination and account number from a single string of data at the time of data entry.
To be able to send money from your account to another account, someone needs to impersonate your identity. I doubt your bank would ...
12
Copying software for malware analysis seems like a textbook case of fair use (under U.S. law, anyway). To take the fair use criteria one by one:
Purpose and character of use: The use of the copy is legally transformative, which means that it creates something new, instead of merely attempting to recreate the original. Here, the analysts are producing a ...
12
First, I'm not a lawyer. Second, this completely depends on your local laws. I can only speak for my limited experience with UK and US law.
In most countries, you're covered by free speech laws, assuming the information you're releasing isn't protected by some form of non-disclosure agreement, and isn't classified as a military secret. If you found the 0day ...
12
-- Edit: This answer addressed the idea of applying for a job based on the discovery of a vulnerability. --
The chances are high that you would not get the job if you applied on the strength of the fact that you successfully hacked their user security. Trust me, if someone walked into an interview with me saying, "Oh, by the way, I found a hole in your ...
12
There's a decent article on the BBC on this type of information here: http://www.bbc.co.uk/news/technology-17586605
In terms of what they'd get from an ISP, the likelihood is that it would be what they accessed and when, search results, search terms etc. However, the contents of online conversations wouldn't be available though they might be identified in ...
Only top voted, non community-wiki answers of a minimum length are eligible
