I realize that this may be more of an opinion type question, but I see a lot of questions on ethics in this forum so I hope mine fits in.

I was reading a BBC article about Heartbleed, and in the article it references couple of sites that can test other websites for presence of Heartbleed vulnerability. The sites' stated purpose is to help users see if a site that they use is currently vulnerable (e.g. test if the site I'm about to purchase from is vulnerable to Heartbleed), which in itself is a good thing.

However, they're essentially sending an attack against a target for which they have not obtained a permission to do pentesting (since any user can test any site they wish). Does this not, by itself, violate ethical boundaries?

  • 1
    Better answers will probably abound at philosophy.stackexchange.com – scuzzy-delta Apr 11 '14 at 19:06
  • 1
    @scuzzy-delta The question is more grounded in real terms rather than excursion into theories of philosophy. I used to work for a web security company developing a scanner, and we for the most part did not exercise our attack engines against public sites (unless we had permission to) for ethical (as well as legal) reasons as believed it amounted to hacking, even though it could help us improve our engine for benefit of customers. So this is not so much about philosophy, but rather industry norms of ethics and its boundaries in real and practical terms. – LB2 Apr 11 '14 at 19:26
  • 1
    It is easy to test for heartbleed vulnerability without the risk of getting any valuable data; e.g., you have payload length of 20, but only send 16 bytes (minimum size). Does it fail as it should or does it return 4 extra bytes? Those four bytes of exposed memory will not in anyway be useful to attack the system. However, it does indicate the system is likely vulnerable. – dr jimbob Apr 11 '14 at 20:37
  • Ethically, the question is one of philosophy, but legally the answer is somewhat more clear: attempting to exploit heartbleed against a website with the intention to cause the computer to do something (like leak keys and heap memory) that the owner of the computer did not intend it to do breaches the Computer Misuse Act in the United Kingdom and the Computer Fraud and Abuse Act in the United States. – Matt Apr 14 '14 at 1:42

The particular site linked in that BBC article is not launching attacks. It simply is checking the HTTP headers of the website you enter and decides if the site is vulnerable or not based on if it can identify the version of open SSL it is using, the date of the certificate and a database of known vulnerable sites. It does this because this is all public information, attacking it would have legal consecuences like you mention.To answer your question in my opinion there is nothing ethically wrong with testing for it as long as you donĀ“t use or store the information you would obtain by exploiting it, however it would still be illegal.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.