Questions tagged [legal]

Related to the laws and regulations imposed by governments, the enforcement of those laws, and legal and judicial process including investigation and trial. Note that if your question matches this description chances are high that it is off-topic at this site and you'll better try law.stackexchange.com.

Filter by
Sorted by
Tagged with
0
votes
0answers
97 views

Is “Advanced Matching” of Facebook against GDPR? [migrated]

I am wondering if sharing a hashed email or phone number with facebook with the purpose of matching that hashed value on Facebook's side is against GDPR? https://www.facebook.com/business/help/...
0
votes
0answers
13 views

Institution can access my email (inbox/sent items/etc) and edit it? [migrated]

First of all, I have thoroughly read the answers to the following questions and none of them answer my queries: Can Google Chrome read/scan my ProtonMail inbox page? Can my IT department read my ...
0
votes
2answers
125 views

Would a difficult to access “Key” be an option to securely solve the Apple vs. FBI problem?

In recent times, there has been an escalating demand by legislators in the US and the world around to be able to decrypt phones that come pre-configured with strong encryption. Key escrow is commonly ...
1
vote
0answers
45 views

How to get on a list of sites that handle financial information? [closed]

Until about a year ago, I was working for one of the big tech giants. During my time there, I noticed that the IT department would do a MITM attack on any website that employees access. i.e. if you ...
1
vote
0answers
40 views

saving entire Windows event log for auditing & preserve digital evidence

As an admin one gets tasked with configuring [Microsoft Windows 10] computers so that auditing is enabled and captures all events as required by some list that's already defined and handed down. ...
-2
votes
1answer
71 views

Can employees' personal properties be part of the scope? [closed]

Let's assume the customer (target) wants to have a full physical pentest done. (I'm a student and have 0 exp in actual Pentesting and Red Teaming Properties of topic: Cars (in the car park) ...
37
votes
2answers
12k views

Should I present forged documents in a Penetration Test/Red team engagement?

A previous question of mine lead to this discussion which mentioned the subject of Document forgery. I've seen many people (in videos) forge IDs and employee badges for such engagements so that seems ...
1
vote
0answers
62 views

Why does Samsung access my contacts and storage if I use their store? [closed]

If I want to access the Galaxy Store on a Samsung Galaxy phone I have to agree to a set of terms (Legal information). These terms are excerpted below: All content made available to you by the ...
1
vote
1answer
63 views

Does data inside a VPC needs to be encrypted in trasit too? [closed]

I know there are laws which require all data to be encrypted in transit and at rest. It makes sense for browser to server connections but, Does data flow within a VPC, lets say a kubernetes cluster ...
1
vote
4answers
165 views

How can Facial Recognition surveilance be misused by police? [closed]

There has been a lot of news lately about facial recognition use by police forces being banned or that it should be banned. The obvious example is that a police officer who is motivated by personal ...
0
votes
1answer
87 views

Is there a danger to client port scanning?

Are there any security risks associated with client-side port scanning? Or, more specifically, a "trusted" site (e.g., banking website) loading javascript trying to connect to various localhost ports? ...
1
vote
2answers
143 views

Protecting against planted evidence

This question was motivated by this 2018 article by the Electronic Frontier Foundation that discusses the findings from the Mark Rettenmaier case. For a bit of background on that case, this article ...
105
votes
8answers
11k views

Ex-contractor published company source code and secrets online

Just found my current company code on the plain internet. We are talking hundreds of thousands of lines of scripts and configurations, including database schemas and a fair amount of internal ...
1
vote
0answers
141 views

For pen testing why would the client need to sign a NDA?

I'm starting the process of doing some pen testing and other security related things as a contractor. Specifically regarding pen testing. I have been Googling around to put together some docs for the ...
0
votes
3answers
385 views

Will pentesting my own LAN violate ISP rules? [closed]

I want to learn and practice penetration testing on my own network, and I want to be sure I'm making it legal. Is there a system that reports to my ISP that I'm making suspicious activities, even if ...
1
vote
2answers
95 views

Is it legal to store users searches [closed]

Im developing a webshop and i got a task asking for storing users searches. Is it legal? It will be stored in a db with the fields Date, Search text, userId
0
votes
2answers
174 views

Australia's Legal Do's and Don'ts of Hacking [closed]

Just wondering what methods used in Pen-testing (Denial of service, dropping a shell, phishing, etc.) would land you in legal trouble in Australia?
1
vote
1answer
74 views

Could a cloud provider access your data?

Would it be possible that an Amazon (for example) sysadmin get into your VM (physically by going in the rack where the server hosts your VM, and virtually) and get your precious source code? and more. ...
-2
votes
1answer
138 views

Paid Android apps for free? [closed]

One of my friends recently made a website where one could download paid apps on the Play store for free. I also saw many other websites that do the same. How did he do it? Is it legal? If yes, then ...
-2
votes
2answers
555 views

Is PCI compliance required by law?

Is PCI compliance required by law? We are creating a website where we will accept customer card data and pass it to merchant API. Everywhere on the internet you will find PCI is required. But what ...
1
vote
2answers
141 views

Can employers log internet traffic of employees personal computers? [closed]

I have a suspicion that my employer is misusing their work monitoring and remote access software to check my online activity outside of work. I have the software installed on my personal machine as I ...
0
votes
1answer
63 views

HIPAA non-business associate for contract work

I have been asked by the sole owner/employee of a blood testing business to make her a web site. This web site would simply be used to schedule appointments for her patients. For this reason ...
6
votes
1answer
162 views

How can companies verify that a national security letter is real? [closed]

It looks like that US national security letters are a prefect way of social engineering: they request confidential data from you and includes a gag order forcing you no to tell anyone about it. There ...
2
votes
1answer
136 views

Can I get in trouble for legitimate mistakes in bug bounty testing? [closed]

During some recent bug bounty testing, I needed to record a pcap using Wireshark, then replay it repeatedly in order to stress test a locally hosted server (which is in-scope of the bounty program). ...
-3
votes
1answer
117 views

Legal advise concerning copyright infringement (BitTorrent) and Wi-Fi hacking [closed]

Someone has hacked into my Wi-Fi and downloaded a film, TV shows and other content over a 2 year period using BitTorrent, I am now being sued by a copyright infringement company. The TV programs as ...
-5
votes
1answer
450 views

IP Logs at LinkedIn [closed]

To make a long story short, the CEO in my firm was fired but she did not change her status at LinkedIn about being employed at my firm. I sent her several mail that remained unanswered. So after 9 ...
2
votes
2answers
99 views

Is there an easy way to detect clients that ignore certificate validation errors (in production)?

I see this happening allot: developers need to test stuff, have a self-signed certificate that causes an error, and they just switch verification off globally (like in this example). The hack gets ...
1
vote
2answers
176 views

Has anyone used a file hash to prove authenticity of a file during legal proceedings?

I've had a client come to me with a request for a feature to prove that a file uploaded to a cloud service we run is the same as the one that they subsequently stored in their document management ...
-1
votes
1answer
149 views

Audio steganography and DRM

I recently made a post about an audio steganography program and had another concern I thought I might ask. I understand that most music has DRM in them. If I hide secret files in audio files with DRM ...
0
votes
1answer
450 views

Is PGP illegal? [closed]

Forword. The following question I have asked at first at Law Stackexchange, because it has to do mainly with legal aspects of encryption and my assumption was, that there is the right place, https://...
3
votes
1answer
5k views

How can police get someone's search history?

Sometimes I see news articles saying that someone was suspected of a crime so the police got their search history and found various google search terms etc. What are the possible ways they can do ...
0
votes
2answers
151 views

Auditing user emails (illegal?) [closed]

I'm the systems administrator for a company that does a lot of outbound emails and a lot of inbound emailing to potential clients. We've had a email auditing tool running for a couple weeks that ...
1
vote
0answers
33 views

How can I establish origin/ authenticity of a electronic document

Scenario: PartyA had put up an online offer on PartyB's certain product, if I bought the product through PartyA's channel then I shall be entitled to an specific gift/reward if PartyB approves my ...
19
votes
4answers
6k views

The non-compliance of the EU cookie law as a finding in a penetration test report?

I recently noticed a penetration test report wherein the non-compliance of the European Union (EU) cookie law was stated as a finding under an "other" category. I consider this more of a legal, ...
-1
votes
1answer
818 views

Is obtaining Mac Address illegal? [closed]

Just wondering, in the US, if a retailer or restaurant wants to collect user's data through obtaining mac address, is it illegal?
1
vote
0answers
246 views

Why aren't foreign VPN companies forced to keep logs? [closed]

This link explains the inconsistency with what VPN services consider 'logging'. Certainly, there is no way for us to verify their claims without an extremely rigorous independent audit. But even that ...
1
vote
0answers
64 views

Where can I find legal acts (USA) for storing or processing social security number, tax id, driver license?

There is a PCI DSS for credit card processing. Does somewhere exist similar requirements for personal data processing, especially in US?
2
votes
0answers
52 views

Are there laws to fine certificate authorities who issue false certificates deliberately? [closed]

As we all know, server-side digital certificates are key to server authentication. Now consider the following situation (I know it may be an absurd situation, but let's imagine it's true): A hacker ...
1
vote
1answer
341 views

Required security for storing bank transactions, but not credentials

If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
-1
votes
2answers
870 views

Legal Issues around simulated phishing attacks [closed]

We are putting together a service for use both internally and for our clients using GoPhish to test users' awareness of phishing. Basically, the users will receive a phishing email and we will measure ...
0
votes
1answer
73 views

Unencrypted login page for EU (utility) company handling PII [closed]

Suppose a EU company provides me access to my personal information over HTTP, without even an option for HTTPS. Does that violate EU privacy laws? Can the company be compelled to fix its website, and ...
3
votes
3answers
243 views

How do VPNs protect identity without assuming legal blame?

I understand that a VPN is basically a computer (or a collection of computers) that encrypts and proxies your internet traffic. One popular use of a VPN is to pirate software or movies. The VPN keeps ...
0
votes
2answers
1k views

Multiple instances with the same SSL certificate legalities? [closed]

In here it said some CA's wouldn't permit using the same SSL certificate on multiple servers: Can I use a single SSL cert on two different servers?. But what about two instances from the same server. ...
1
vote
2answers
60 views

Can a website's privacy policy be made more effective by incorporating it into company bylaws?

I'm concerned primarily about the US, but also UK and Germany. Is there any way to give a privacy policy greater trust, and more effectiveness, by somehow binding it to a company's bylaws with the ...
0
votes
2answers
198 views

Legality of sniffing own traffic between mobile app and server

Recently I found a bug on a mobile app which claims to protect their users' privacy, however after connecting my phone with burp and installing a certificate I noticed that this app was sending a ...
0
votes
1answer
63 views

Two-Factor Authentication on downloadable client but not website

A friend of mine plays RuneScape, and mentioned to me that her account was recently compromised. She told me she has two step authentication on her RuneScape account, and on the email address ...
1
vote
0answers
148 views

Cybercrime jurisdiction in China [closed]

Context I had a call today from a customer, who asked me details about a cyber attack that occurred yesterday on one of his web servers, it was a common OS injection attack encapsulated in a http ...
1
vote
1answer
525 views

Can I access my own account logs at Godaddy without a subpoena? [closed]

I have some evidence that our Godaddy domain account has been tampered with, by a former administrator with access to the account credentials. To prove that the account was accessed, I need, at the ...
4
votes
3answers
741 views

What are the penal consequences for a passive or active scan on a WebApp with no damage? [closed]

Let's say I only trust web applications that I tested myself with some penetration tests. What penal consequences exist for doing a passive scan (eg. building a map of a website site) or an active ...
7
votes
2answers
337 views

Is there a way to perform data acquisition on CPU's registers?

In Digital Forensics, as a best practice, an investigator should collect data from the most volatile source to the least volatile source. Usually, when talking about live/Dynamic Acquisition, most ...

1 2 3 4 5 7