42

A client did an unannounced penetration test on our platform (SaaS, multi-tenant).

The first test, they made an extreme number of requests in a short amount of time. It was not logged in and was unannounced so I first thought it was a DDOS attack. It brought our servers down during peak hours for other clients.

The second time they did it with a logged-in account. Also unannounced but I looked up this person on LinkedIn and this was a "junior cybersecurity engineer" from the parent company of my client.

They admitted afterwards that it was a penetration test.

The penetration test clearly failed (everything was safe), but it added many MANY garbish data values to our database that we had to manually clean up. Besides all the extra work and stress it caused on the weekend.

Are they allowed to do that?

UPDATE

The client acknowledged their mistake and apoligized sincerely. I assume some eager security engineer mistook our SAAS platform for internal tools. For me this case is closed.

It is good to have heard some opinions about if this is to be expected from clients and if this is according to any code of conduct. Thanks for all the help.

9
  • 8
    For legal questions please ask at Law. Commented May 26 at 17:33
  • 5
    Aside - this shows there exist potential improvements in your software or network setup. Perhaps throwing a load balancer or WAF in front with some rate limiting for the extreme cases would 1) reduce the chance of this happening again and 2) allow you to tick more boxes in future RFPs for new clients. Spin this as a learning/improvement opportunity for your company, regardless of the question of legality. Comment because not an answer.
    – Criggie
    Commented May 27 at 1:54
  • 72
    Not your question but if it “brought our servers down during peak hours for other clients” and “added many MANY corrupt data values to our database that we had to manually clean up”, it's hard to see it as a clear failure, it did reveal serious issues with your setup.
    – Relaxed
    Commented May 27 at 9:37
  • 1
    @Relaxed Failed to get access. We have very limited resources as we are a very small company. We have to pick our battles. This is the first time our site went down because of an attack in 8 years and it was on purpose by a client of us. Downtime in case of a DDOS and 40.000 entries with ' OR '1'='1 is a consequence that we now have to accept. Doesn't mean we should just be fine with a client doing an undisclosed penetration test on our SAAS production site during peak hours.
    – Dirk Boer
    Commented May 27 at 10:19
  • 20
    @DirkBoer Definitely not but that would be true even if they did get access and manage to steal data. At the same time, it's important to realize that security is not only about confidentiality or getting access. Integrity and availability are equally important aspects of the classic security triad and as you saw, breach of either of them can be costly. The issues you describe sound serious even if they haven't been exploited until now and might signal even bigger risks (e.g. could the SQL injection be used to delete or exfiltrate data?)
    – Relaxed
    Commented May 27 at 11:45

6 Answers 6

57

Is this even legal?

As always, it depends on where you are and what the relevant laws are in your region.

But the main thing that differentiates a penetration test from criminal hacking is that you've obtained (written) legal authorisation from the system owners to carry out that testing, with a set of defined rules of engagement.

And if they've not done that, it sounds very much like they would fall on the wrong side of the law.

Definitely a issue that you should be taking to your legal department (or outside counsel).

6
  • 33
    @DirkBoer Some customer agreements allow the client to perform penetration testing or security testing. Often when they do this, there is a clause about being able to recoup reasonable costs. I would take a look at what agreements are in place and perhaps raise a discussion about recouping the costs that you had to endure as a result of these unannounced tests. I would do this as opposed to looking at some kind of a civil case, or bringing lawyers into it. It just becomes an activation of the clauses in the service agreement.
    – schroeder
    Commented May 26 at 15:04
  • 3
    @schroeder: In an ideal world, in-house counsel should be aware of the terms and conditions of whatever service you are selling, and should steer you towards using any appropriate provisions where possible.
    – Kevin
    Commented May 27 at 8:52
  • 2
    @Kevin Ideally, in-house counsel would have drafted the SLAs and the terms and conditions that would include these clauses. So of course. But there is a difference between having in house counsel guide the next interaction and lawsuits.
    – schroeder
    Commented May 27 at 9:08
  • 5
    Hi all, thanks for your help and answers. There is no contract in place that says anything about penetration tests and this has not been disclosed. I assume someone in the company thought we were an in-house developed platform and not a SAAS company.
    – Dirk Boer
    Commented May 27 at 10:17
  • 2
    @DirkBoer While it seems that the client should not have done this, the fact that brought your servers down and "it added many MANY corrupt data values to our database that we had to manually clean up" is probably something your team should look into. An actual attacker is not going to ask for forgiveness.
    – JimmyJames
    Commented May 28 at 20:01
59

Others have addressed the legality of that, I'll answer the implied question of "how should we react":

You lock their account, send them a mail explaining that your security team detected suspicious activities, and ask them to contact you to resolve this issue. Then you wait for their response.

  • If they claim that they were doing penetration tests, tell them that this is against your TOS¹, and that they should stop doing that without permission from your security team. If you want, you can use this opportunity to give them access to a test system and get a pentest there for free!

  • If they have no idea what you are talking about, explain to them what happened. Who knows, maybe they have been successfully hacked and the intruder is trying to use their credentials to attack your system.


¹ ...if it actually is against your TOS (terms of service). Otherwise, skip this step and use this opportunity to update your TOS. You should still tell them to stop doing that, because this is quite obviously not the intended use case of your service.

3
  • 4
    The second point (trampoline) is critically important and should not be overlooked!
    – Pablo H
    Commented May 28 at 12:58
  • Hi @JenserCube, we don't have a legal department. We are a very small SAAS studio and have very limited (financial) resources. Thanks for your helpful answer Heinzi !
    – Dirk Boer
    Commented May 28 at 17:55
  • 1
    @PabloH: Pretending to be a security auditor can often be a remarkably effective "get of jail free" card, especially if a phony "auditor" praises the person who caught him in a way that distracts from the important next step (validating the supposed "auditor's" relationship with the entity being attacked).
    – supercat
    Commented May 28 at 19:29
10

IANAL, but have worked in cyber for years and have some knowledge of relevant law and precedent.

In England and Wales it is an offence, under the Computer Misuse Act, to commit "unauthorised access" or "unauthorised modification". And an unsuccessful attempt to do so would still be an offence due to the Criminal Attempts Act.

However, in the circumstances you describe there is no chance such a person would be prosecuted and convicted. It lacks the element of criminal intent required to convict most offences. This is a failure to get the right paperwork, not a crime.

In terms of civil liability, you very likely would have a case to pursue either your client or the testing company for damages, which could include costs related to the outage and clearing up your database.

Laws do vary around the world, although most countries have something similar to England's Computer Misuse Act. Some countries though (e.g. France) have much stricter laws in this area.

6

Legality would vary depending on where you are in the world, and you'd need to consult a lawyer or your company's legal department.

In my experience, though, terms of service typically address how users are allowed to interact with the system. Failure to comply with the terms of service can result in access to the service being suspended or terminated. You may want to look into this with your lawyer or legal department. If such clauses don't exist, you may want to put them in place.

Technical controls can also be helpful. IP-based rate limits, blocking IP addresses or user agents from known scanners (some vendors even publish this information to ensure it is whitelisted in test environments and blocked in production environments), monitoring and alerting for abnormalities are all common controls. If you don't have these controls in place, you should consider them.

5

Legality is (mostly) irrelevant

A client is entitled to know that the organisation supplying their services is competent. However that doesn't allow them to do things which they know will impact your business.

If you want to keep the client, you're perfectly entitled to talk to them about them paying for the cost of work resulting from their actions, and/or inflating their contract rate at the next opportunity.

If you don't want to keep the client, all contracts should have a clause saying that gross misconduct by either party breaches the contract. Assuming you've included this standard feature, you can cut off their services on the spot. If they don't have backups, that's their problem. It's definitely worth considering whether you really want a client who'll do this to your company.

-3

Without permission of the company it’s illegal, and thats all there is to it. Now what you do depends on what kind of client. I am a client of Vodafone, paying then £30 a month. They would take me to court for damages. If this client is responsible for a quarter of your revenue, then you go to higher management and talk to them, and they decide.

However, you should insist on being told exactly what the client did, on payment of damages to other customers plus your cleanup cost, and if they had no permission, I’d want the person responsible to be fired.

1
  • 12
    "Without permission of the company it’s illegal, and thats all there is to it." - That is simply wrong. If it was illegal or not depends on the laws in OPs jurisdiction, what the client did exactly, possibly their intent, and finally the contents of the contract between OPs company and the client.
    – marcelm
    Commented May 27 at 8:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .