Date: Tue, 22 Jan 2013 16:46:58 +1300
From: "Nick FitzGerald" <nick@...us-l.demon.co.uk>
To: Full-Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Student expelled from Montreal college after
	finding vulnerability that compromised security of 250, 000

Hi all,

Jeffrey Walton to me:

> > [...]
> > BUT he has no responsibility to check on anyone _else's_ data and no
> > _authority_ to use anyone else's credentials to check on his own.
> I would argue that's part of testing the system. If I log in and get a
> token back, I'm going to try a simple increment (and other
> transformations on the token) to see if its predictable. If I happen
> to get another's record, that demonstrates the flaw in the system and
> not 'testing on behalf of another'.

Which may well put you on very thin legal ice.

According to at least one legal ruling in Germany, it is "hacking" (as 
in the negative, illegal kind) to deliberately try to access upper-
level directories of _published_ URLs _if_ the specific URLs to those 
resources have not also been made publicly available, _despite_ that 
they are necessarily discernible from the published URL.  Silly as that 
may seem, I'm pretty sure that tweaking tokens in cookie values and the 
like would be equally, if not more, egregious "hacking" in front of 
that court.

> What did he do with the other records he retireived? I suspect he used
> them as proof of concept; and did not use them for a work visa or
> credit card. But I could be wrong.

Indeed, we do not know, but as there is no suggestion that anything 
further was done with whatever records were "illicitly" accessed, I 
suspect that nothing is what was done with that data (and it seems 
likely the heavy-handed legalistic mouthings of the vendor spokespeople 
would have touched on this if they had any inkling or evidence that 
such had happened).

> > So, what "responsibility" does he really have?
> We have the responsibility to protect our own data, because class-A
> fuckups like Omnivox don't do it. Once the data is lost, you can't get
> it back - the genie is out of the bottle.

Sadly, you cannot protect it when it is already in other's hands...

It seems that, in general, once you've _en_trusted such data to others 
our (current) legal system is of the opinion that you have accepted 
that you _trust_ their ability to maintain its confidentiality, etc.

This is not good, but it's also very difficult to see how an individual 
can really do much _useful_ about that either.

A lot of our "technological advances" have come at the cost of a loss 
of lot of control of confidentiality of information.  This is a trade-
off that many have probably made without even realizing it, and 
certainly without realizing the _scale_ of it.

> That's coming from a guy who was part of a breach in the 1990s. It
> cost me about $10,000 to fix it back then. It started again in the
> mid-2000's. I'm not fixing it this time.

I'm sorry, for you, to hear this.

> > It sounds like he should have left well alone once he had reported this
> > to the university and the vendors.  That he did not have the sense or
> > moral compass to recognize that tells us something important about him.
> Does that sword cut both ways? How about Nokia/Opera and their
> destrucion of the secure channel? How about Trustwave and their
> fraudulent certifcates that destroyed the secure channel?
> 
> Or do these things (law and moral compasses) only apply to individuals?

In my previous message I did not address the responsibilities -- nor 
their common, commonly egregious and often entirely predictable failing 
of such -- of those holding personal, confidential, etc data.

I think my opinion of that part of the industry, in general, is pretty 
obvious though, from this and many other messages I have posted to 
public lists like this...

Sadly, as I said above, our legal (and perhaps societal) mechanisms 
have not yet caught up with the implications of our recent (last ~70 
years) technological progress in the areas of data processing, 
retention, sharing and mining.  I suspect though, that on balance, it 
is probably better that such legalistic and societal changes lag such 
technological advances, but I also suspect we are getting to the point 
where that gap may be too large and too much power (or too little real 
responsibility) will end up in the hands of those who clearly should 
not only be doing more, but should be expected and required to do more.



Regards,

Nick FitzGerald


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists