Penitration Testing

Hello, I have been reluctant to post this question due to the nature of it but have decided to ask it.

I have a friend who uses the same ISP as I do. He has asked me to "hack" into his computer for the purpose of finding security holes. I do not want to get into any legal trubles or loose my internet conection.

Since I was granted permision I don't see anything wrong with it. My question is, can my ISP cut my Internet service or posibly could I end up in leagal trubles as a result of atempting to gain access to my friends computer?

I abide by law and have never done this before. I am woryed about the law, but I have truble understanding the terms used in the Terms of Service. Basicaly I am woryed about how legal it is for penitration testing once given permision. Keeping in mind that I live in Canada.

I just want to be safe then sorry.

Can I leagaly enter his computer with permision from him.

If I were you, I'd consult with both your ISP and his, before you start. Let him write some emails to both ISPs as well, and tell them what is going to happen. Make sure you mention that only your two computers are going to be used, include all specifics, and there should be no trouble.

Most ISPs won't act on hacking activity if it's:
- not interfereing with their work (as in, consuming lot's of bandwith, damaging systems, ... )
- not being reported by the 'victim.'

Then again, consult with them before, and you're safe regardless. Why take the risk?

Ok I just sent a email to my ISP, explaining what is going to hapen and i told them if they need more information I can provide it. I will wait for them to respond.

Should I posibly get my friend to sign a paper saying he gave me permision. I trust he will not go back on his word as he told me several times that he is giveing me permsion.

This is a foursome. Let all parties talk to eachother, one way or another.

Actually it is a threesome since they belong to the same ISP. However, yes I would have your friend send the same info to the ISP to back you up and get a signed document from him that he cannot hold you liable for any accidental damage you may do to his system. Then I would recommend that he back up his data.

I don't think there is any harm that you will cause but why not be safe rather than sorry.