Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Student expelled from Montreal college after finding vulnerability that compromised security of 250, 000
From: Jeffrey Walton <noloader () gmail com>
Date: Mon, 21 Jan 2013 21:34:29 -0500

On Mon, Jan 21, 2013 at 8:06 PM, Nick FitzGerald
<nick () virus-l demon co uk> wrote:
Jeffrey Walton wrote:

On Mon, Jan 21, 2013 at 5:42 PM, Philip Whitehouse <philip () whiuk com> wrote:
Moreover, he ran it again after reporting it to see if it was still there.
Essentially he's doing an unauthorised pen test having alerted them that
he'd done one already.
If his personal information is in the proprietary system, I believe he
has every right to very the security of the system.

BUT how can he "verify" (I assume that was the word you meant?") proper
security of _his_ personal details?  He would have to test using
someone _else's_ access credentials.  That is "unauthorized access" by
most relevant legislation in most jurisdictions.
Yes, my bad. Autocorrect has turned my bad spelling into bad grammar.

Alternately, he could try accessing someone else's data from his login,
and that is equally clearly unauthorized access.

He and his colleague who originally discovered the flaw may have used
each other's access credentials to access their own data, or used their
own credentials to access the other's data _in agreement between
themselves_ BUT in so doing most likely broke the terms of service of
the system/their school/etc, _equally_ putting them afoul of most
unauthorized access legislation.

Is he allowed to "opt-out" of the system (probably not)? If not, he
has a responsibility to check.

BUT he has no responsibility to check on anyone _else's_ data and no
_authority_ to use anyone else's credentials to check on his own.
I would argue that's part of testing the system. If I log in and get a
token back, I'm going to try a simple increment (and other
transformations on the token) to see if its predictable. If I happen
to get another's record, that demonstrates the flaw in the system and
not 'testing on behalf of another'.

What did he do with the other records he retireived? I suspect he used
them as proof of concept; and did not use them for a work visa or
credit card. But I could be wrong.

So, what "responsibility" does he really have?
We have the responsibility to protect our own data, because class-A
fuckups like Omnivox don't do it. Once the data is lost, you can't get
it back - the genie is out of the bottle.

That's coming from a guy who was part of a breach in the 1990s. It
cost me about $10,000 to fix it back then. It started again in the
mid-2000's. I'm not fixing it this time.

It sounds like he should have left well alone once he had reported this
to the university and the vendors.  That he did not have the sense or
moral compass to recognize that tells us something important about him.
Does that sword cut both ways? How about Nokia/Opera and their
destrucion of the secure channel? How about Trustwave and their
fraudulent certifcates that destroyed the secure channel?

Or do these things (law and moral compasses) only apply to individuals?


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]