1

Is it illegal to publish an exploit against a known vulnerability in US? The exploit could be published in one's blog or places like exploit-DB. It seems that in countries like Germany and France such activities are not allowed.

  • Before or after responsible disclosure to the vendor? – schroeder Jun 12 '14 at 2:36
  • @schroeder After. Assuming that the vulnerability is even included in CVE. – ZillGate Jun 12 '14 at 2:43
  • @schroeder Is "responsible disclosure" a well defined concept? – curiousguy Jun 13 '14 at 22:01
  • @curiousguy Google and Wiki have a definition of it, so, yes? It's a defined concept but the specifics are not codified, if that's what you meant. – schroeder Jun 13 '14 at 22:40
  • 1
    That's a good question - is it legal to publish. I have not seen the question answered (yet). I know its legal in the US to perform Security Testing and Evaluation (ST&E), Reverse Engineering (RE), Encryption Research, and Protection of Personally Identifiable Information. You can do it even without a company's consent. See Jon Callas' comments at US rules jailbreaking tablets is illegal. He (and others CompSci heavyweights) provided input on the legislation. And its DMCA - PUBLIC LAW 105–304 (exemptions in Section 1201). – jww Jun 14 '14 at 2:05
5

Consult a lawyer for legal questions. Answers here won't help you if you get into trouble.

That being said, obviously there are a lot of researchers in the US publishing proof-of-concept code, and even the code that goes into tools like the metasploit framework. Also, there are some pages you can find from sources like the EFF's Coders' Rights Project.

1

Unless being explicitly asked to discover vulnerabilities in a specific system (e.g analyzing system vulnerability for a specific company), disclosing detailed information about a vulnerability and exploit methods which can then be used by and adversary to attack that specific system will allow the owning company to file a lawsuit against you. However, unless they file for a lawsuit, claiming you have put the company at some kind of risk, simply disclosing information about vulnerabilities and providing an exploit will not get you into trouble. Keep in mind that exploits are sometimes meant to prove that a specific vulnerability is dangerous and should be addressed.

As for the lawsuit, the charges you face will vary depending on the damage, but that doesn't mean for certain that you will face legal punishment. It can be argued that (as a consumer) disclosing vulnerabilities (or proof that the vulnerabilities are dangerous e.g exploits) about a product you consume is your legal right. As you have paid for the product/service, and you expect the highest quality of service, and certain vulnerabilities in that product can harm you and other customers.

However, if your exploit is used for any illegal activity (e.g causing the company financial damage) you will be legally responsible regardless of the company filing a lawsuit against you or not.

  • In short, this comes down to the line between civil liability and criminal liability. – Iszi Jun 13 '14 at 18:32
  • That's one way of looking at it but for the most part there are clear cut laws about what is legal and what is not – Abbas Javan Jafari Jun 13 '14 at 20:51
  • Thanks a lot for the explanation. What about open source software? – ZillGate Jun 13 '14 at 23:30
  • Could you describe the applicable doctrine or law? – curiousguy Jun 14 '14 at 1:39
  • 1
    Dropping 0-days and selling companies short to profit from the drop in stock price is apparently legal from the financial side (according to the Washington Legal Foundation). See this talk about Weev's TRO LLC (a company he is trying to set up to do it). – jww Jun 14 '14 at 1:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.