3

Recently came across a theoretical moral dilemma -

The Oxford dictionary defines the computer security form of 'hack'/'hacking' as:

"Gain unauthorized access to data in a system or computer"

Source: https://en.oxforddictionaries.com/definition/hack

Question/Explanation

With regards to modern computer systems, if one were implemented without authorization, but contains sensitive information that regular users assume is sufficiently protected against, with no real reassurance from the site they've been using, and a third party reverse-engineered the site to gain access to it, is it considered "hacking"?

Further Notes

  • The system described does not immediately provide the regular users with any legal agreements or confidential documentation ensuring that their data is secure.
  • They are however confident in this instance that the sensitive information provided to the site is somewhat secured.
  • When I mentioned 'no authorization', I mean basic authentication and session handling, but information on the back-end does not conform to this, and the API is freely poll-able.

closed as off-topic by Philipp, Purefan, Steffen Ullrich, Matthew, Polynomial Feb 3 '17 at 14:32

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • If you leave your front door open, am i authorized to walk in from the public road and look around uninvited because there was no key mechanism to stop me? Legally, that's how it's usually looked at. Ethically, my personal view is it's sometimes good for a valid security researcher to kick up some dust. I believe Google's project Zero agrees – J.A.K. Feb 3 '17 at 11:55
  • I agree with you there, had a discussion about this with a couple other people before posting it here and it's opened up a "can of worms". Let me add some specific scenarios constraints to refine the question – jarodsmk Feb 3 '17 at 11:56
  • 1
    Considered "hacking" by whom? There are people who would strongly disagree with the Oxford dictionary definition of hacking. – Philipp Feb 3 '17 at 11:59
  • 6
    I'm voting to close this question as off-topic because I think its better suited to law.stackexchange.com – Purefan Feb 3 '17 at 12:33
  • 1
    @Purefan, I think I'm on the verge of prompting both forums, the intention of me posting it here first is to gather thoughts of active security professionals. – jarodsmk Feb 3 '17 at 12:38
3

With regards to modern computer systems, if one were implemented without authorization, ...and a third party reverse-engineered the site to gain access to it, is it considered "hacking"?

Probably. While the case never resulted in a precedent-setting judgement (due to the suicide of the defendant), United States v. Swartz represents a case where charges under the Computer Fraud and Abuse Act were filed against someone who scraped an online database using guest access:

According to the indictment, Swartz surreptitiously attached a laptop to MIT’s computer network, which ran a script named "keepgrabbing.py", allowing him to "rapidly download an extraordinary volume of articles from JSTOR."

And from Wired:

But the feds clearly think they have a substantial hacking case on their hands, even though Swartz used guest accounts to access the network and is not accused of finding a security hole to slip through or using stolen credentials, as hacking is typically defined.

  • 1
    Oh come on.. seriously? Those journal paywalls are the most ridiculous thing ever invented. Imagine if Wikipedia had a $10 / month subscription fee to access content. Don't you think someone would feel compelled to "free the knowledge"? (This isn't directed at you gowenfawr, it's directly at the judge who made that ruling). Also, the fact that this resulted in the defendant committing suicide is extremely disheartening. – Dan Feb 3 '17 at 14:48
  • @Dan, it's not even directed at the Judge - there was no ruling. If you read the article, it's clear that the U.S. Attorney's Office pursued this case for their own reasons, unrelated to the concerns or desires of the "victim." But as such, it's a pretty compelling answer to the question "Is it considered 'hacking' if authorization isn't bypassed?" – gowenfawr Feb 3 '17 at 14:54
  • Wasn't there some website/API vulnerability a few years ago that allowed an attacker to retrieve millions of user emails? The guy reported it to the service but they still charged him with hacking because he chose to exploit it millions of times before reporting it. Not 100% sure what the verdict was, and I don't remember which website it was (Microsoft, Sony?). – Dan Feb 3 '17 at 14:58
  • @Dan I think you're referring to Adrian Lamo, who made a habit of grey-hat exposure of vulnerabilities to companies who weren't always happy with him revealing how massively he'd delved them - see The Homeless Hacker v. The New York Times – gowenfawr Feb 3 '17 at 15:52
  • Nah, it was much more low-profile than that. I think it was a few university researchers who wrote a simple script to take advantage of some "Forgot your password" vulnerability to scrape a bunch of email addresses and maybe some other non-sensitive account info. The authorities were arguing that since they exploited it long enough to compile a massive list of email addresses that it should be considered a criminal offense. Wish I remembered more about the details; sadly, it happens so often it's hard to find the one I'm thinking of specifically. – Dan Feb 3 '17 at 20:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.