Message-ID: <CAH8yC8=Rn-W8YAP75_ksaeHe6o9v0duQxX5YZoLYgR3GLgoPsg@mail.gmail.com>
Date: Mon, 21 Jan 2013 21:34:29 -0500
From: Jeffrey Walton <noloader@...il.com>
To: Nick FitzGerald <nick@...us-l.demon.co.uk>
Cc: Full-Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Student expelled from Montreal college after
 finding vulnerability that compromised security of 250, 000

On Mon, Jan 21, 2013 at 8:06 PM, Nick FitzGerald
<nick@...us-l.demon.co.uk> wrote:
> Jeffrey Walton wrote:
>
>> On Mon, Jan 21, 2013 at 5:42 PM, Philip Whitehouse <philip@...uk.com> wrote:
>> > Moreover, he ran it again after reporting it to see if it was still there.
>> > Essentially he's doing an unauthorised pen test having alerted them that
>> > he'd done one already.
>> If his personal information is in the proprietary system, I believe he
>> has every right to very the security of the system.
>
> BUT how can he "verify" (I assume that was the word you meant?") proper
> security of _his_ personal details?  He would have to test using
> someone _else's_ access credentials.  That is "unauthorized access" by
> most relevant legislation in most jurisdictions.
Yes, my bad. Autocorrect has turned my bad spelling into bad grammar.

> Alternately, he could try accessing someone else's data from his login,
> and that is equally clearly unauthorized access.
>
> He and his colleague who originally discovered the flaw may have used
> each other's access credentials to access their own data, or used their
> own credentials to access the other's data _in agreement between
> themselves_ BUT in so doing most likely broke the terms of service of
> the system/their school/etc, _equally_ putting them afoul of most
> unauthorized access legislation.
>
>> Is he allowed to "opt-out" of the system (probably not)? If not, he
>> has a responsibility to check.
>
> BUT he has no responsibility to check on anyone _else's_ data and no
> _authority_ to use anyone else's credentials to check on his own.
I would argue that's part of testing the system. If I log in and get a
token back, I'm going to try a simple increment (and other
transformations on the token) to see if its predictable. If I happen
to get another's record, that demonstrates the flaw in the system and
not 'testing on behalf of another'.

What did he do with the other records he retireived? I suspect he used
them as proof of concept; and did not use them for a work visa or
credit card. But I could be wrong.

> So, what "responsibility" does he really have?
We have the responsibility to protect our own data, because class-A
fuckups like Omnivox don't do it. Once the data is lost, you can't get
it back - the genie is out of the bottle.

That's coming from a guy who was part of a breach in the 1990s. It
cost me about $10,000 to fix it back then. It started again in the
mid-2000's. I'm not fixing it this time.

> It sounds like he should have left well alone once he had reported this
> to the university and the vendors.  That he did not have the sense or
> moral compass to recognize that tells us something important about him.
Does that sword cut both ways? How about Nokia/Opera and their
destrucion of the secure channel? How about Trustwave and their
fraudulent certifcates that destroyed the secure channel?

Or do these things (law and moral compasses) only apply to individuals?

Jeff

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists