lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 3 Feb 2004 08:17:33 -0800
From: "David Schwartz" <davids@...master.com>
To: <Daniel.Capo@....net.br>
Cc: <computerguy@....rr.com>, <BUGTRAQ@...urityfocus.com>
Subject: RE: Major hack attack on the U.S. Senate



> On Fri, 23 Jan 2004 Daniel.Capo@....net.br wrote:

> > > Which means the Democrats screwed up setting up their own
> > > share point and
> > > allowed public access to it.  There was no "computer glitch" which was
> > > "exploited".  This was completely a human screw-up.  And there was no
> > > hacking ("exploitation of a computer glitch") done by the Republicans.
> > > Unless you wish to call clicking on a share point configured
> > > with public
> > > access and opening it up "hacking".

> > AFAIK, "hacking" is legally defined in the USA as being unauthorized
> > access to computer resources. It doesn't matter if the resource was
> > adequately protected (or protected at all) in first place or not. If you
> > were not given permission to make use of that resource, you are
> > criminally liable.

> Do you have an explicit permission to read the content of a www.cnn.com?
> What is the difference between opening a web URL and a network share?

	Laws are not like computer programs. They don't have to precisely describe
a process that can be mindlessly applied to determine whether the law was
violated or not. Common sense is permitted.

	You may not have "explicit permission" to read the content of www.cnn.com,
any more than you have explicit permission to eat at Burger King. This
doesn't make it impossible to tell the difference between eating at Burger
King and entering Burger King after they've closed through a door that was
left unlocked by mistake.

	The fallacy in your argument is to equate lack of "explicit permission"
with "unauthorized access". They are not at all the same thing. Explicit
permission is not the only form of authorization. One can try to argue to
that publication of a share without a password could easily be mistaken for
authorization, but the instant one sees the content, it is clear that no
such authorization was intended. One cannot be "accidentally authorized" to
do something. One could mistakenly think one was authorized, but that
argument would be laughed at in this case. Nobody could make it with a
straight face.

	DS




Powered by blists - more mailing lists