bugtraq - RE: Major hack attack on the U.S. Senate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 3 Feb 2004 08:17:33 -0800
From: "David Schwartz" <davids@...master.com>
To: <Daniel.Capo@....net.br>
Cc: <computerguy@....rr.com>, <BUGTRAQ@...urityfocus.com>
Subject: RE: Major hack attack on the U.S. Senate



> On Fri, 23 Jan 2004 Daniel.Capo@....net.br wrote:

> > > Which means the Democrats screwed up setting up their own
> > > share point and
> > > allowed public access to it.  There was no "computer glitch" which was
> > > "exploited".  This was completely a human screw-up.  And there was no
> > > hacking ("exploitation of a computer glitch") done by the Republicans.
> > > Unless you wish to call clicking on a share point configured
> > > with public
> > > access and opening it up "hacking".

> > AFAIK, "hacking" is legally defined in the USA as being unauthorized
> > access to computer resources. It doesn't matter if the resource was
> > adequately protected (or protected at all) in first place or not. If you
> > were not given permission to make use of that resource, you are
> > criminally liable.

> Do you have an explicit permission to read the content of a www.cnn.com?
> What is the difference between opening a web URL and a network share?

	Laws are not like computer programs. They don't have to precisely describe
a process that can be mindlessly applied to determine whether the law was
violated or not. Common sense is permitted.

	You may not have "explicit permission" to read the content of www.cnn.com,
any more than you have explicit permission to eat at Burger King. This
doesn't make it impossible to tell the difference between eating at Burger
King and entering Burger King after they've closed through a door that was
left unlocked by mistake.

	The fallacy in your argument is to equate lack of "explicit permission"
with "unauthorized access". They are not at all the same thing. Explicit
permission is not the only form of authorization. One can try to argue to
that publication of a share without a password could easily be mistaken for
authorization, but the instant one sees the content, it is clear that no
such authorization was intended. One cannot be "accidentally authorized" to
do something. One could mistakenly think one was authorized, but that
argument would be laughed at in this case. Nobody could make it with a
straight face.

	DS