0

Would designing a crawling bot to detect and inform vulnerable website owners be legal?

closed as off-topic by Xander, TildalWave, Eric G, Adi, AviD Apr 10 '14 at 11:07

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    This question appears to be off-topic because it is requesting legal advice which varies by jurisdiction and should be obtained from a legal professional and not the Internet. – Xander Apr 10 '14 at 0:15
3

Assuming that you had the website owners express permission to test for the vulnerability - probably, depending on your location (UK/US/EU laws appropriate).

Having a crawler that scans for the vulnerability is (in my opinion) almost certainly breaking some law in whatever country. Not only this though, imagine it from the business/website owner's perspective - what's your real intention?

As a side note - You've got to be careful going down this route as, even though you're trying to do the right thing (presumably) and make a small amount of money (again, assuming) this can be interpreted in two different ways:

  1. I know how to fix this issue, I'll let the client know and they can pay me a tiny fee for doing so (or free because I care about security).
  2. I know how to fix this issue, I'll let the client know and force them to pay me a ransom or else I'll tell everyone about their flaw.

Almost everyone reading your email/letter or listening to your phone call is going to think they're being scammed. Further to this, if you inform a client that the vulnerability exists and that you've scanned their server/site and found it there - you've just sent them an email saying the following (in the eyes of the UK law, others might be different):

"Hi, I scanned your website without permission and discovered a flaw. I can bypass security/access confidential data. Please secure this."

What happens if within 3 minutes of sending that email, the server is compromised using the method your just described? Even if they know it's not you, they'll be ticked off that they've just lost data and assume it was you. Even if there's a lack of evidence it's still hassle you'd rather be without.

I'd suggest creating a website where people can test their own sites and servers by typing a hostname/IP Address into a box and agreeing to some t's and c's that make you non-liable.

  • That tool to check for the vulnerability already exists: filippo.io/Heartbleed – Joshua Dwire Apr 10 '14 at 1:58
  • I was assuming that the OP wanted to design a custom tool for learning purposes but yeah, sometimes it's best not to reinvent the wheel! – ScottMcGready Apr 10 '14 at 2:41