3

is it legal to do a security review/pentest of a web application that we bought and operate on our servers? Meaning, the whole infrastructure is ours + we bought a licence for the software. Can we do an in depth review of it? Or would this be breaking some laws against reverse engineering etc.? I'm interested in USA and EU laws.

Many thanks

Improve this question
2
  • 1
    This is a question about the law.
    – Marcin
    May 5, 2014 at 17:53
  • 5
    This question appears to be off-topic because it is requesting legal advice, which not only may vary from jurisdiction to jurisdiction but also from case to case, and so should be obtained from a qualified legal practitioner in the appropriate jurisdiction rather than from the Internet where the well-meaning and logical opinions you receive on the matter may leave you more ill-advised than if you hadn't asked at all.
    – Xander
    May 5, 2014 at 19:16

2 Answers 2

Reset to default
9

Depends what kind of assessment you want to do. Maybe you should change your title to indicate "Black Box" or "White Box" or both. I've learned that vendors have a very loose definition of "security review" on their software so it is important to do your own assessment if you have the resources.

Code Review

The Vendor's code is theirs and you aren't allowed to decompile it without their permission. Most vendors are not willing to share their source code. All you can do is ask them for their report of their own internal source code review.

Static Application Assessment

There are ways to do security assessments without their decompiled code. Static code analysis like with Veracode is done on compiled code and the service never sees the source code. It helps triage the results if you can see the source code, though. Most often, I pass these results on to the vendor.
The best situation is if security assessments (static or dynamic) are written into the contract with the vendor, but it is legal to upload a compiled program to such a service.

Dynamic Web Application Assessment

A dynamic (black box) scan is totally allowed on an application in your environment and this should be your first step.

Improve this answer
2
  • +1 for defining the tests. If the OP is subject to PCI compliance, they might be forced to run some level of testing on the device/service. If nothing else, to test for default passwords.
    – schroeder ♦
    May 5, 2014 at 14:26
  • +1 for your first paragraph; when I saw the question title I assumed it was specifically about the Box cloud platform: box.com
    – Dan Is Fiddling By Firelight
    May 5, 2014 at 15:55
1

Technically, the law is that you have to follow the terms of your EULA for the software as far as it is enforceable. Your best bet, ask the vendor for permission. (Well, really, your best bet is to ask the vendor prior to purchase, but that isn't an option now.)

There isn't really a good reason they should have a problem with you ensuring the platform is secure, particularly if you agree to share any vulnerabilities you discover with them, but unless there is nothing in the EULA that restricts you from doing what you want, asking the vendor is the best bet.

Improve this answer
3
  • 3
    It would depend on the jurisdiction. In USA, you should follow the EULA; However, EU is quite different - first, it depends on your particular specifics if that EULA is in any way binding at all (clickthrough "I agree" doesn't neccessarily mean it); and if it is so, then still each specific restriction in EULA may or may not apply depending on local legislation. An "industry standard" software EULA tends to contain a bunch of restrictions that are simply null and void in EU even if the user had signed that contract with full knowledge before purchasing. In short, ask a (local) lawyer.
    – Peteris
    May 5, 2014 at 15:12
  • @Peteris - a lot of that is the same in the US. Just because a term is in the EULA doesn't mean it is enforceable. That's why I specified "as far as it is enforceable."
    – AJ Henderson
    May 5, 2014 at 15:30
  • @AJHenderson there is the additional question of validity of that EULA as such, and there are many cases where a particular EULA term is enforceable in USA, but the same term in the same EULA is unenforceable in EU - and never the other way around, as far I have seen. If you're defined as a 'consumer' (which, with some restrictions, tends to include small businesses as well), then I'd guess that in EU a typical user hasn't encountered a single binding EULA, ever.
    – Peteris
    May 5, 2014 at 15:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.