5

I found a security hole in an organisation in the UK with many employees. Login form sends user name and password in clear text to the public facing IP via HTTP. Initially I pointed this to IT but they didn't understand and asked for screenshot. I used a sniffer to show my user name and password, on our guest WiFi network which does not have access to the internal network. I didn't use ARP poisoning.

The IT responded to my request saying that they are aware of that and will not fix the problem in the nearest time. IT also reported me to the Head of Security due to the fact I used sniffer.

Q: What shall I do? What are the consequences of using a sniffer within an organisation in the UK?

Lesson learnt
Talk to boss rather than reporting it directly to IT.

Improve this question
8
  • 1
    Did you "just" sniff or did you also used tricks like ARP poisoning to receive more traffic than you ought to? If you just sniffed traffic that was sent your way without any fool play on your part to be honest I don't see what could be used against you, then IANAL and I know very little of UK law anyway.
    – Bruno Rohée
    May 28, 2011 at 17:59
  • I did not use ARP poisoning, it was enough for me to see my user name and my password in the sniffer. But because this is a public IP anyone can do poisoning.
    – bob
    May 28, 2011 at 18:03
  • 1
    @bob - Is this on your own employer's network? Are you a member of the IT staff? Is IT security part of your function? Did you load the sniffing software on company hardware yourself? Does that software have a business-relevant purpose?
    – Iszi
    May 28, 2011 at 18:21
  • @Iszi It was on the employer's open guest WiFi network. I am an employee but not a member of IT, I do not do IT work there
    – bob
    May 28, 2011 at 18:25
  • 1
    @Iszi The company has ethernet connection where everybody gets authorised in Domain. Additionally, the company provides publicly available guest unencrypted WiFi, anyone can connect and use internet from there. I used WiFi.
    – bob
    May 28, 2011 at 19:05

6 Answers 6

Reset to default
8

I'll start with the usual statements that I am not a lawyer and this is not legal advice :)

That said as far as I'm aware use of a Network sniffer, in and of itself, isn't illegal in the UK (a large number of IT professionals would be in deep trouble if it were!).

If there is relevant legislation i'd think it'd be the Computer Misuse Act, the Regulation of Investigatory Powers Act and/or the Data Protection Act.

If you've intercepted and viewed traffic belonging to other people, that could be a problem, but if you installed it on your own PC and the target network is running a standard switched environment, then I wouldn't have thought it likely that you'd have had access to other users traffic, so effectively all you've done is view your own information.

The company could be considered to be in breach of the Data Protection Act, if they're sending personally identifiable data over an untrusted network (eg, the Internet) without appropriate protection (eg, SSL)

However unless you were authorised, you could be in breach of the IT Policy of the company, which you may have been given and asked to sign when you joined (I'm assuming here that you're an employee of the company) if you used unauthorised software within their network

as @Iszi said if you're concerned that they may actually charge you, I'd thoroughly recommend speaking to a lawyer.

Improve this answer
8
  • @Rory thanks for the reply. I intercepted only my own traffic. I hope I will get a warning and it is not going to go the court.
    – bob
    May 28, 2011 at 18:59
  • @RoryMcCune - See @bob's comment on the question post - he was sniffing unencrypted WiFi. So, he definitely had access to "traffic belonging to other people".
    – Iszi
    May 28, 2011 at 19:23
  • @Iszi @Roy I sniffed packets for 3 seconds between me and the remote publicly available login server, and found that it is sent as clear text. Then I stopped sniffing.
    – bob
    May 28, 2011 at 19:56
  • 2
    Ouch, well, they are either incompetent or they did that to entrap you, in any case it's worse for them than for you. The only bad part of the story is that they went to head of security before you did, and likely warped the truth to their advantage, but from what you say it would take quite a bit of warping to make them look good. I reiterate what I said in my answer, talk to head of security, it doesn't look like they could possibly have anything that would hold any water in court anyway.
    – Bruno Rohée
    May 28, 2011 at 20:40
  • 1
    @bob, there are companies that would still try to press charges against you, even if you did this from home. They would have no legal or ethical ground to stand on, but they'd still try....
    – AviD ♦
    Jun 5, 2011 at 11:02
5

The following is my personal opinion, and as everyone said, you should get legal advice from a lawyer trained in communications/computer law.

Without being a lawyer, I don't think you are in breach of any of the provisions of the UK Computer Misuse Act. Maybe you are in breach of laws related to intercepting communications, but as this was unencrypted it's hard to tell. I will remind everyone the recent Google case, where they did something similar - running sniffers on unecrypted WiFi networks - I don't think someone managed to prosecute them successfully (although I have not followed up on that story): http://www.wired.com/threatlevel/2011/04/google-wi-fi-spy-flap/

That said, what is more important is not the computer crimes, but the violation of company policy, which you signed when you got hired. This is what they will be looking at first, I don't think it is going to escalate to something more. Read your company's policies first.

Improve this answer
4

I am not a lawyer, and this is not legal advice

Q What shall I do?

A If you're seriously concerned about repercussions, get a lawyer. Laws vary greatly by jurisdiction, even within the same country. I doubt anyone here will be able to comprehensively assess what legal consequences your actions may have, without knowing a lot more about you, your job, and your actions, than you're probably willing to divulge on a public forum.

What are the consequences of using a sniffer within a private organisation in UK.

Again, this is where you really need a lawyer, and/or a union representative if you have one. As already stated, laws vary greatly by jurisdiction and corporate policies even more so. While you may not be legally culpable for any part of your actions, your employer may still find you in violation of their computer usage policies and may discipline you accordingly.

One thing, which I think anyone can recommend, is that you (and/or your lawyer) research what laws and regulations the company may be in violation of for not adequately protecting the data you were able to sniff. Then, contact whatever organization is in charge of enforcing compliance with those laws or regulations, and share your findings. In doing this though, you should also make yourself keenly aware of whatever "whistleblower" protection laws there may or may not be which are applicable to your situation.

Improve this answer
1
  • tnx @Iszi at least I know where to start - get a lawer
    – bob
    May 28, 2011 at 18:33
4

Now that we got more information I'd be tempted to say talk to Head of Security. From what you say you only sniffed your own traffic, and I don't see how they could be able to prove otherwise. The only thing they could possibly prove is use of non approved software on company hardware or such thing, if it is covered by their policy. In short, they got nothing against you (unless they took the laptop and there are still dumps with other people traffic on it, if they didn't, get the hint...), but as other said, stop incriminating yourself especially as what you did was hardly wrong.

To be honest, from what you say (and it's only one side of the story) it looks a bit like the IT department did a very bad job and tries to deflect the blame on the whistleblower (you), scaring you in the process. That may or may not fly with the head of security, most likely not. If it was me you wouldn't be disciplined nor even warned. Talked to, yes, what would be said would depend quite a bit on whatever policy is in place.

tl;dr: if they can't prove you listened to other people traffic I don't see how it could go too badly for you. Then again, IANAL.

Improve this answer
2
  • If it was me, he wouldn't be disciplined, he'd be rewarded.
    – AviD ♦
    Jun 5, 2011 at 11:04
  • Indeed, his doing would just be a good incentive to put in place proper channels for non IT staff to report security issues, that's what "the talk" would have been about in my case.
    – Bruno Rohée
    Jun 7, 2011 at 0:49
4

IANAL - but, from the sorts of legals I had to draw up when doing this for global consultancies:

  • installing sniffer on your machine - possible breach of company policy
  • passive sniffing on your company network - possible breach of company policy

both of those probably not a legal problem according to English or Scottish law

  • collecting private user data - this is a much greyer area as you could be in breach of the Data Protection Act and the Computer Misuse Act.

Case law indicates you probably are ok legally but probably in breach of company policy (which might lead to disciplinary action) , but seriously, get a lawyer just in case - as an argument of 'no intent' doesn't seem to cut it in every case

Improve this answer
1
  • thanks for the answer. Can I collect data that is sent to my only browser? I did not intercept anything else.
    – bob
    May 28, 2011 at 21:46
1

This is a classic mistake. I can't tell you how many people have been fired over this type of thing. Or worse; gone to jail. Judges & juries are not good at understanding finer points like "just sniffing" vs "arp poisoning".

To answer your question: "What shall I do?". You need to hire a lawyer. Any communications about this subject with "private organisation" need to go through counsel. Stop incriminating yourself.

Next time you find a vulnerability, keep it to yourself or figure out how to disclose it anonymously.

Improve this answer
1
  • good point, stupid me
    – bob
    May 28, 2011 at 18:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .