-5

So it would be illegal to run a metasploit attack against a computer you don't have permission to do so against, right? But what if I configure a web server to nmap scan, then metasploit attack against everyone that connects to me. This is an automated process, so no human is breaking the law, the computers doing it. And, there would be no way to prove which human configured the server to do this. And, even then this was my personal web server for playing with myself, I never intended for any random internet user to stumble across it; they did so at their own risk, I never forced them to.

Has any law been broken by a human here? And how would I stand legally?

Thanks

Improve this question
3
  • What did your lawyer say? None of us can provide you with good legal advice; we're mostly technology people.
    – Tom Marthenal
    Commented Jan 20, 2013 at 7:21
  • 3
    Most legal frameworks cover this by criminalising cases where a person has rigged an automated or mechanical system to "commit" a crime by proxy. Even worse, your planning shows premeditation and intent, which puts you firmly in the firing line of any competent prosecution lawyer.
    – Polynomial
    Commented Jan 21, 2013 at 14:45
  • 1
    In all honesty, every 1st week law student should be able to tell you why this is nonsense and would undermine the concept of a legal system.
    – Jeff Ferland ♦
    Commented Jan 21, 2013 at 19:45

4 Answers 4

Reset to default
5

You have set up the system with the intent that it will attempt running metasploit attacks, therefore by proxy you are actively running metasploit attacks. Basically you're just playing word games and trying to pretend you aren't doing what you've designed the system to do.

It's no different than setting up one of those infection servers crackers currently use, and if you use your activity to deliver a payload, then you are personally responsible. At least that's the way it's been playing out. Make sure you're in an area where jurisdiction can't touch you and you can get away with it.

Improve this answer
4

"People don't kill people, guns do." "It's your own fault the land mine buried in the park blew up, why did you step on it." etc.

Until Skynet takes charge, it will ultimately always be humans who are responsible.

Improve this answer
2

If charges are filled, law enforcement will look for the person who pays the bill for this server. Depending on the jurisdiction, it is very likely that a search warrant is issued. This usually results in a seizure of all electronic devices (including mobile phones, printers, video game consoles, ...).

Going from there, it is quite likely that they will end up finding you, which obviously results in said trouble again, if they got the wrong person in the first place.

In the end it will boil down to: Did the victim consent to being attacked. I seriously doubt that any judge will recognize the simple visit of a web site as giving consent.

Keep in mind that judges are trained to see through elaborated stories and excuses.

I strongly suggest to ask for explicit consent after giving clear information. And no, you won't be able to fake the logging after the server was seizured.

Improve this answer
1
  • Keep in mind that judges are trained to see through elaborated stories and excuses. Hence the saying "He's so sharp, he'd cut himself." Many's the time I've seen a case built on Rube Goldberg logic collapse because someone out-tricked themselves. Wile E. Coyote is funny in cartoons, not so funny if you've personally played the role in real life.
    – Fiasco Labs
    Commented Jan 20, 2013 at 22:55
0

It very much depends on your jurisdiction so I recommend contacting a lawyer who can address the specific issue. I am not a lawyer, but most jurisdictions consider the person who operates the server responsible for the server's actions in many cases. It may or may not help to have a full disclosure on your server about the acceptable terms of use and the actions that the server will take if someone continues. If someone is intruding on your system, you've made it clear to them what will occur if they continue and they choose to continue, it might make it an approval on their part, but that is something that would need to be asked to a lawyer as it will very much depend on jurisdiction and local law. None of this post is legal advise, it is simply intended to help know what questions would be good to ask a lawyer.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .