Feeds

Breach case could curtail web flaw finders

Being a good guy gets you prosecuted

Top 5 reasons to deploy VMware with Tegile

To other security researchers, the case underscores the asymmetric legal power of websites in confronting flaw finders: Because finding any vulnerability in a server online necessarily means that the researcher had exceeded authorisation, the flaw finder has to rely on the mercy of the site when reporting, said HD Moore, a noted researcher and co-founder of the Metasploit Project.

"It is just a crappy situation in general right now," Moore said. "You have to count on the goodwill of the people running the site. There are cases when there are vulnerable websites out there, but unless you have an anonymous web browser and a way to hide your logs, there is no way to report a vulnerability safely."

Moore points to McCarty's case and the case of Daniel Cuthbert - who fell afoul of British law when he checked out the security of a charity website by attempting to access top-level directories on the web server - as warnings to researchers to leave websites alone. In October, Cuthbert was convicted of breaking the Computer Misuse Act, fined £400, and ordered to pay £600 in restitution.

Other researchers should be ready to pay as well, Moore said. Anyone who affects the performance of a server on the internet could find themselves in court, he said.

"Even if you look at the port scanning stuff - which is not technically illegal - if you knock down the server in the process of port scanning it, then you are liable for all the damages of it being down," Moore said.

Such legal issues are one reason for not testing websites at all, said security researcher David Aitel, chief technology officer of security services firm Immunity.

"We don't do research on websites," Aitel said, adding that the increasing reliance of programs on communicating with other programs has made avoiding web applications more difficult. "The more your applications are interconnected the more difficult it is to get permission to do vulnerability research."

Moreover, such a legal landscape does not benefit the internet companies, Aitel stressed. While companies may prefer to not know about a vulnerability rather than have it publicly reported, just because a vulnerability is not disclosed does not mean that the website is not threatened.

"If this is an SQL injection flaw that Eric McCarty can find by typing something into his web browser then it is retarded to think that no one else could do that," Aitel said.

The US Attorney's Office alleges that McCarty's actions caused the university to shutter its system for 10 days, resulting in $140,000 in damages. The university had provided investigators with an internet address which had suspiciously accessed the application system multiple times in a single hour, according to the affidavit provided by the FBI in the case. The information allowed the FBI to execute a search warrant against McCarty, discover the names of his accounts on Google's Gmail and subpoena those records from the internet giant, the court document stated. Among the emails were messages sent from an account - "ihackedusc@gmail.com" - -to SecurityFocus detailing the vulnerability, according to the affidavit.

The US Attorney's Office declined to comment for this article. A representative of the University of Southern California also declined to comment except to say that the school is cooperating with the investigation.

"It wasn't that he could access the database and showed that it could be bypassed," Michael Zweiback, an assistant US Attorney for the US Department of Justice's cybercrime and intellectual property crimes section, said last week after his office announced the charge. "He went beyond that and gained additional information regarding the personal records of the applicant. If you do that, you are going to face - like he does - prosecution."

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.