Hot answers tagged

152

You don't punish the hacker. The law does. Just report whatever pieces of information you have to the police and let them handle it. However, it is very unlikely that the attacker will be caught. The IP address you posses most likely belongs to another system that the attacker has compromised and is using as a proxy. Just treat it as a lesson learnt and ...


145

There's no way that a pentester can 100% assure that data will not be modified or deleted, in the same way as they can't assure that system availability won't be affected (I've knocked systems over with a port scan or a single ' character). as you say a web crawler can delete data from a system if it's been set-up badly. I'd say that what should be said is ...


93

A pentester who claims that he will never alter production data is either a filthy liar, or thinks himself to be a lot more competent than he really is, or strongly intends to do nothing at all (that's the only surefire way of never breaking anything). In any case, you don't want to work with that guy. A prospective customer who believes that skilled ...


78

So you have identified the IP address involved in the process of hacking your website. Congratulations! What makes you believe that this IP is indeed a hacker's IP address, and not simply another hacked into computer running in zombie mode? And who is to say, that your own web server didn't run in exactly the same zombie mode until you removed the shells ...


78

The fundamental question here is authorization, not access. If you break into your neighbor's house, clearly you are in violation of the law. But if he lets you in, then you are not. So what if you have a key? If he gave you the key along with permission to enter (to feed his dog while he's away), then you have authorization to enter. No trespass there. ...


77

If there is a teacher or counselor you can trust completely, that you know will keep your name secret even if the school administration starts making threats about firing people, I'd go to them first and talk to them in private. They don't need to understand computers or security (and you don't need to go into detail about the issue), they just need to be ...


65

To the best of my knowledge, yes, it's legal. Every anti-hacking law I'm aware of refers to unauthorized access, and if you've got permission to hack it, it's not unauthorized, is it? Note that there are some things you'll need to watch out for. Some jurisdictions prohibit the possession of "hacking tools" (akin to prohibiting possession of lockpicks, but ...


58

Another thought struck me as I re-read your question (emphasis mine): How should I tell school that they are vulnerable when I wasn't given permission to check? Could you get permission? Once you have permission, you could "discover" the issue (without telling anyone you'd found it before) and report it without worrying about being blamed for hacking ...


57

Cardholder name, 4 last digits of CC number and its expiration date are all NOT sensitive data. The cardholder name and expiration date only require protection if you are storing them with the full primary account number, not the truncated 4 digit number. If you are storing, processing, or transmitting cardholder data then you must meet all of the other PCI ...


52

The law is unclear. Anything you do, no matter how innocent, could be considered a crime. All the website owner has to do is say "I didn't want that to happen", and you could be convicted of a crime. Before donating to a tsunami relief website, Daniel Cuthbert typed in ../../../ in the URL. He was convicted of "intent to hack" (in the UK). Lori Drew was ...


51

Despite the media hype, the key thing here is not that the FBI/NSA/US Government was intercepting all phone calls, but that it was collecting all phone 'metadata' records which includes: Originating Phone Number Terminating Phone NUmber IMSI Number IMEI Number Trunk Identifier (which relates to the location) Telephone Calling Card numbers Time of the call ...


48

The term most often used to describe what you're talking about is Hacking Back. It's part of the Offensive Countermeasures movement that's gaining traction lately. Some really smart people are putting their heart and soul into figuring out how we, as an industry, should be doing this. There are lots of things you can do, but unless you're a nation-state, or ...


42

Don't do it! Don't do it! If you are in the US, the law is very broad. You don't want to even tiptoe up to the line. The relevant law is the Computer Fraud and Abuse Act (18 U.S.C. 1030). In a nutshell (and simplifying slightly), under the CFAA, it is a federal crime to "intentionally access a computer without authorization or exceed authorized access". ...


36

As pointed out by begueradj, any government agencies can access your cloud-stored files through a subpoena to Google. But your question was what they can do when they have your laptop alone and nothing else. This is not an unlikely scenario. It is the situation you have, for example, when you get arrested by law enforcement and they do not have sufficient ...


35

Don't play their game, you'll lose I've learned not to play that game, hackers by nature have more spare time than you and will ultimately win. Even if you get him back, your website will be unavailable to your customers for a solid week afterwards. Remember, you're the one with public facing servers, you have an IP of a random server that he probably used ...


35

It is an information leak on the Silk Road server. It appears somebody located a debug or info screen on the Silk Road server that dumped configuration and environment variables. Some possibilities: The output of Apache's mod_status (example) Output of phpinfo() (example) A custom debug page that is part of the Silk Road application It could have been ...


35

I don't know of any technical security impact relating to not adhering to EU cookie laws. Ultimately I think this is mostly down to the discretion of the assessor and the context of the assessment. Privacy issues are security-adjacent and come with similar PR impacts, and may even be judged to infringe upon the rights of the individual, so I think in some ...


34

http://www.economist.com/node/18529895 "Spare us the e-mail yada-yada Automatic e-mail footers are not just annoying. They are legally useless" At least in the EU. And no case has ever succeeded in the US either.


34

To add to the answer from @RoryAlsop I'd agree that you probably don't, as an average person, have a lot to worry about in terms of the PRISM/phone tapping by the NSA being used for it's intended purprose (anti-terrorism operations by the US gov.) as people's concept of security/privacy most of the time isn't too great. There are other good reasons to be ...


34

It is legal to tell them about the bug, giving them a detailed description of the bug and how you came across it. What is unpredictable is the company's reaction. It could vary to something such as them sending you a reward/small gift (has happened to me), to them trying to prosecute you as a criminal (tipping them off anonymously could help with this ...


31

There is a classic phrase: "If you are not paying for it, you're not the customer; you're the product being sold" In case of companies' liquidation, they openly sell their user databases on the internet as one of the liquidated assets. Well, think this way. If Microsoft bought , say, Skype, had Skype sold its user database and what is the sense/...


28

In Canada it appears as though that you're safe ... for now. Anywhere else, it depends on whether by "search bugs" you mean to find exploits on someone's site that might violate their Terms and Conditions of usage for the website (Eg. Penetration Testing). There are a couple of different ways this could go, depending on the reaction of the person who ...


28

[Update #2] According to the Washington Post, sources familiar with the matter, have stated that the initially suspected collaboration with Cellebrite is not how the data from the encrypted iPhone was recovered. Instead an unknown security vulnerability was used (purchased) from "professional hackers" to prevent the phone from erasing its data and slowing ...


26

This is an excellent and important question. There are several important techniques to know about: Remote logging. Rather than store the log entries on the webserver, the webserver should be configured to send each log entry over the network to a log server. The log server should be a custom machine, configured for a single use (log recording only), and ...


26

First, this question has to be answered in a country-specific context, because each country has its own laws and regulation regarding computer crimes, intrusions, data manipulation etc. One important thing to consider also is that the persons who will judge those cases are not technical aware people. They usually have no clear idea of what a database is, ...


24

I don’t think that “legal” is the right term to use. It’s not wise, a lot of times “right” password is only one letter different from the “wrong” password (typo/capital letters/…). So if somebody evil will get this log he may easily guess the correct password. Other problem is that people re-use passwords, so they use same password for your site/gmail/...


24

There's always an "Abuse" email address on the whois of a netblock for reporting misuse of an IP address. You can use http://whois.domaintools.com/ to do a whois lookup to get the address. Is it worth your time? That's your call. Will it lead to anything? Nothing you'll ever see. But many of the sites I fix come from people who were first alerted of the ...


Only top voted, non community-wiki answers of a minimum length are eligible