17

So I've begun learning to penetration test and I want to try it on a real system, (apart from my own), and so I have asked a friend if I can hack their computer. He is as interested as I am on the subject of computing and has agreed. I'm just wondering if it is strictly legal, and if it is likely for anyone else to be checking his system (doubtful, I know). As a point of reference, I live in Australia..

3
  • 2
    Is this just your friend's personal computer, or is it a server used for some public business or service? Also, does your friend live in Australia? Oct 25, 2011 at 12:21
  • Just a personal computer and we both live fairly close to each other.
    – Shadow
    Oct 25, 2011 at 12:28
  • 1
    Take care of doing that from a freshly installed OS, you don't want the credentials of your friend to be snatched by a trojan when you browse/decrypt them.
    – Shadok
    Oct 25, 2011 at 14:44

3 Answers 3

22

If the system is private and you don't use any other infrastructure or services to carry out your testing, then you probably don't violate any statutes.

However:

  • If you are attacking through an ISP - get their agreement first, as they could see what you are doing as an attack and pass the info to law enforcement
  • If there is data on the server which could come under data protection regulation then you want to look into implications of having that data end up on your computer as part of the attack.
  • and as @espengra says - get approval in writing, in case you break something and your friend decides to take you to court!
4
  • In regards to the ISP issue, what if I took my laptop to his house and used his wifi?
    – Shadow
    Oct 25, 2011 at 20:55
  • @Shadow - if you aren't using an ISP, you can ignore that point :-)
    – Rory Alsop
    Oct 25, 2011 at 21:11
  • 5
    I would second getting it in writing. I once got verbal approval from the Managing Director of a company I worked for to demonstrate a vulnerability to the Finance Director. The FD subsequently recorded the incident on my staff record as a technical breach of my employment contract.
    – Mark Booth
    Oct 26, 2011 at 10:59
  • @Mark - that's frightening!
    – Rory Alsop
    Oct 26, 2011 at 11:00
9

This constitutes as a fairly regular pentest and is indeed legal if the victim system's legal owner (your friend) allows you to perform this test. Make sure to have the entire scope of the test declared in a written contract between the two of you just to be sure if he should change his mind later on.

The scope would include the physical equipment involved, as well as the targeted software.

5

Why don't you just knock up some virtual servers to play with .. or get some vulnerable iso's to play with (metasploitable comes to mind for one)

You could always do a p2v of a physical system so you have it as a virtual machine. That way you can take backups and restore points etc.

Otherwise, as the posts above state, get a written agreement, and ensuer that your ISP allows it (I'm pretty sure Telstra don't like it)

PS - im from Australia too :)

You should check out http://www.pentest-standard.org/index.php/Pre-engagement for all your scope and agreement stuff

1
  • upvote for pentest-standard.
    – lew
    Oct 26, 2011 at 6:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.