Hacking to prove a point?

I was reading through some news this morning and I stumbled across this article:

http://www.internetnews.com/dev-news...013341,00.html

It's about a defacement that occurred on the US Space and Naval Ware Systems Command web site. The Midwest Express airline customer database was compromised and some of the material was made public on the US Navy site.

The article got me to think about something - the defacers that were responsible for the attack claimed that they had warned the admins in the past several times but with no respone, so they took drastic measures. I wanted to get all of your opinions - do you feel that is okay or appropriate to take drastic measures such as defacements or other attacks in order to get the attention of admins, the public, etc? Is it okay to committ a crime in order to get someone's attention to a potentially large problem?

Thanks for your time guys...

i think it all counts on the case at hand... as for this one i think it was okay because the problem should been fixed the first time they were notifyed. as for crimes in general... thats like someone whos anti-gun takeing a gun and shooting someone to prove that they are a bad thing..... get my point?

-NetSyN

This question has been discussed before, and I agree with someone who enters a system warning the admin to take precautions, i also understand when someone doesn't warns the admin (as long is no damage done), due to some stupid admins that call the feds for someone who is just trying to help out.

But for defacing to call the attention when something is not right, I do not agree with it at all...

Maybe try to reach the admins boss, or something, but not defacing it. ( agree with what NetSyn said about crimes in general...)

that's just my 2 cents, thou.

I think they were wrong on all counts. They shouldn't have been on someone else's system without permission. Second, they were wrong for doing the defacement. If the Admins don't want their help, they should've let it go.

I'm with the preacherman on this one, you don't break into someones house just to make them lock thier doors.

I must say I agree totally with thor and preacherman.

Defacements are stupid. Plain and simple. I agree that the site should have been secured, but defacing is just stupid. There are other ways to prove to an admin that his box is weak. If you have to, tell them at xxx time you are going to enter their system, and want them to see this, so they believe you. If they still don't secure it, forget about it. That is their fault if some script kiddie or other lamer wants to try and make a name for themself by defacing the site.

the guyz had reported the prob right?... Thats the best thing theye can do.. Its up to the admins to fix it or not.

I think that it is wrong for someone to deface a website just to make a point. If you brake a law the judge doesn't care way you did it, on if you did or not. I am an admin at my company and "IF" i was to get a e-mail or phone call from someone unknown to me about our network I would look into it. that's it for now.

I look at it like this. And I am shocked at how many people feel differently.

If someone noticed that I left my window wide open, I would want them to tell me. I would not call the cops on the person, and complain like a little bitch that he looked in my window. How can I hold someone at fault for walking up the street and noticed my window was open? I was the idiot that left my window open in the first place. He was nice enough to let me know before someone decided to break into my house, and possibly pull a gun out and kill me. That person did nothing wrong, they were being a good simaritan by informing me about my window. No harm was done. And that was nice of them.

Now I can be a jerk. And start accusing the person of looking in my window. I can call the cops and press charges saying the guy must be a peeping tom. The only reason I would do that is because I am trying to shift the embarrassment of me leaving my window wide open like an idiot, on to someone else. Which is bullshit. There is nothing wrong with that guy warning me that I left my window open. And if I try to get the guy in trouble with the law, that says a lot about me as a person.

Now if the guy goes in my window and steals something, it is another story. But there is that line that shouldn't be crossed. If you see that someone has an open server then by all means I think it is 100% OK to notify the admin about it. If you exploit the vulnerability, then you crossed the line. You are warning the person for a reason, and if you become that reason, then you suffer the consiquences for it.

If you warn an admin and they don't lock down their box, then oh well. Now if someone breaks in, it's their problem. You don't have it on your conscience. You tried to help. The important thing is not to become the criminal that you are supposedly trying to prevent.

As for the admin who receives the warning from someone. Be a man. Don't try and shift your embarrassment of having an insecure box, onto the person that tried to help you by letting you know. Suck it up. Lock down your box. And thank the guy for notifying you. Think about what would of happened if someone exploited the vulnerability, stole all your customers info, and your boss found out it was your fault for not doing what you get paid to do. Things could be a real mess.

The only thing that people don't like about being told their box is vulnerable, is the blow to their ego. Suck it up, and thank the guy. You ego would have been hurt a lot more if someone actually broke into your box.

i fully agree with jared_c. I could find word to put it so good.

No. To put it simply, no. It's juvenile.

All someone has to do to see my window open is look at it. They can then ring my doorbell and tell me in person, or they can give me a phone call. But to see flaws in my computer security usually the person has to been somewhere they shouldn't be in the first place. I have portscanned IP numbers that have subseven scanned me previously. I have spotted what looked like a trojan on their box and notified the ISP or the Network. But I didn't take the opportunity to see if I could access the trojaned port and find out if anything else is wrong. That would be the equivalent of saying, "Hmmm, I see this guy's window open. If he's that lax about security, I think I'll go into this house and do a full security audit and give him an itemized list of the security problems with his house." If you were the owner of a house and someone did that, would you be happy?

All someone has to do to see my window open is look at it. They can then ring my doorbell and tell me in person, or they can give me a phone call. But to see flaws in my computer security usually the person has to been somewhere they shouldn't be in the first place. I have portscanned IP numbers that have subseven scanned me previously. I have spotted what looked like a trojan on their box and notified the ISP or the Network. But I didn't take the opportunity to see if I could access the trojaned port and find out if anything else is wrong. That would be the equivalent of saying, "Hmmm, I see this guy's window open. If he's that lax about security, I think I'll go into this house and do a full security audit and give him an itemized list of the security problems with his house." If you were the owner of a house and someone did that, would you be happy?

Quote:

---

If someone noticed that I left my window wide open, I would want them to tell me. I would not call the cops on the person, and complain like a little bitch that he looked in my window. How can I hold someone at fault for walking up the street and noticed my window was open? I was the idiot that left my window open in the first place. He was nice enough to let me know before someone decided to break into my house, and possibly pull a gun out and kill me. That person did nothing wrong, they were being a good simaritan by informing me about my window. No harm was done. And that was nice of them.

---

Yeah, when stated like that I think we all can agree. But in this case the window was climbed through.
To tell the admin the security sucks if you happen to run into it is ok. To systematically try security to see if you can find something to tell them about is wrong and to deface a site just because they didn't do anything about it is criminal.

All someone has to do to see my window open is look at it. They can then ring my doorbell and tell me in person, or they can give me a phone call. But to see flaws in my computer security usually the person has to been somewhere they shouldn't be in the first place. I have portscanned IP numbers that have subseven scanned me previously. I have spotted what looked like a trojan on their box and notified the ISP or the Network. But I didn't take the opportunity to see if I could access the trojaned port and find out if anything else is wrong. That would be the equivalent of saying, "Hmmm, I see this guy's window open. If he's that lax about security, I think I'll go into this house and do a full security audit and give him an itemized list of the security problems with his house." If you were the owner of a house and someone did that, would you be happy?

Quote:

---

If he's that lax about security, I think I'll go into this house and do a full security audit and give him an itemized list of the security problems with his house.

---

Like I said.. there is a line that shouldn't be crossed. And that is when the person becomes a criminal.

Quote:

---

But to see flaws in my computer security usually the person has to been somewhere they shouldn't be in the first place.

---

Which brings up a whole new topic which is: What exactly is "where they shouldn't be"? If I click on a link in a search engine, and it takes me to a directory listing that shouldn't be enabled, am I now violating your system? If someone trys to access my system, and I port scan their whole subnet block, your server happens to be on that block am I now violating your system? Should port scanning be illegal even though it does absolutely no damage what so ever? If it was, would that even stop the people that are going to hack your box anyway. No, it would just stop the people who would warn you. If I access the robots.txt file, that is accessed on a daily basis by all search engines, and you have a list of secret directories there, am I crossing the line by letting you know that the world has access to this? If you have web based log files available to the world and google has it cached for anyone on the face of this planet to view, did I violate your system by looking at google's cache or is google now responsible? Or is any of this even worth getting your panties in a bunch over, because now you know about the problem, and now you can fix it before any damage is done.

The bottom line is by stopping me from warning you, and by calling the cops on me, that WILL NOT stop the people that are going to exploit your system. If anything it is only going to catch you by more surprise and hurt you even more when someone does violate your system. If you see someone messing with your box, take action. But if someone stumbles across a vulnerability on your system, thank them for being nice and letting you know. Your box is on the WORLD WIDE WEB. Expect for it to be looked at. When you are driving down the highway you don't expect everyone to follow the rules. And you don't call the cops on everyone that cuts you off. If no damage is done, you have to just deal with it. Otherwise you are just going to waste your time, and their time, while the real cracker breaks in and destroys your system.

I agree that it was wrong to deface the web site. But why do we always have to compare hacking to someone’s house? Me having to reinstall winblows because I got hacked in no way compares to someone breaking into my house and stealing all my stuff.

Quote:

---

Originally posted here by cwk9
I agree that it was wrong to deface the web site. But why do we always have to compare hacking to someone’s house? Me having to reinstall winblows because I got hacked in no way compares to someone breaking into my house and stealing all my stuff.

---

I hate the house comparison too. It always comes back up though. So I gave in, and I use the house comparison to back up my own views. :)

It's a contraversial topic.....

Some will see it as a act in the right while some will say there were no rights in the act.


Defacing is wrong in a sense, because you are vandalising something someone created.
However, just continously sending e-mails and so is not going to get anywhere...

What a topic like this needs in a lot of thought. Instead of defacing the site, renaming the index.html to whatever.html and placing a before page with a link to the site and a small message like "told you your system is weak" would be better, but yet still debatable.

Actions do speak louder than words, but there has to be thought behind the actions.

Truly, in the end, it all depends in the perception of the "victim".

BTW, I'm sick of house comparisons as well..... what about pie :D

Defacement can easily be compared to vandalism... painting over someone else's property. It's clearly crossing over the line as far as notification goes. However, I sort of feel "at-odds" with myself on the simple demonstration of a problem is "wrong."

For example (sorry, impending house reference): if you left your window open, is it wrong for me to point you at it and say "Hey look stupid, I really /can/ open it." To me, that's probably in the grey area. Now, if I don't know you're home, is it wrong for me to open that same window and leave you a note where you can see it (and presumeably only you) telling you that it was left open (and, of course, call/mail you and tell you the note is there)? Again, serious grey area in a way...

Some people might say this is more black and white and that as soon as my hand goes in that window, I'm trespassing... and, well, I'm not sure I can adequately disagree with that idea - though I might question exactly where that line is...

Hacking to prove a point. Is like a game of truth and dare. It's like i dare you to hack so and so.

Would I do it, no. Cause, it's not worth it.

My skill of hacking, or the way i :hack: is like this. My friend, gets hacked.. say he' gets infected with sub7 or a trojan.. I simply connect to his computer, then i remove it. Then i call him, and tell him how to finish removing it. Then, i tell him to download a trojan scanner & remover.

bam, hacking to my point!!

I happen to agree with what most of you guys are saying. I feel that entrance to any system, unless given explicit permission, is wrong. A concerned user should only go so far, that being to warn the admins of the problem. If they don't fix the problem, then it seems that it is their fault from there - I personally would not want someone to enter my networks, leave an indication that they were there simply to warn me that I didn't have a system patched or that I had a configuration error - even though their intentions were good. I know that I would appreciate a simple email message warning me of the potential problem so that I can investigate it, patch and fix if needed.

One reason why web page defacements aren’t taken that seriously is because it’s only temporary and most of the time easy to fix. But I think the main reason is because most of the time the web page being defaced is some large multinational corporation homepage that no one really cares about. I bet if the main google or hotmail page was replaced with some creepy offensive dungeon porn people would start to think about web page defacement as a real crime instead of just mischief.

The reality is that the "Deceptive Duo" was actually doing them a favour in pointing out the security flaw. But the law was still broken. The "Deceptive Duo" acted wrongly. They are no two ways of looking at it. It's just a shame that the cracker(s) had to go to such lengths before the matter was taken seriously. If I was trying to secure a site like that, I would take all the help I could get.

Taking the law into your hands is still breaking the law....

Why do you think protestors get peppersprayed? Because sometimes they go to far... (however sometimes the police go to far too....)

The sysadmins ignored the e-mails and paid for it....
It's like they say Ignorance Is Bliss

If the admin doesn't choose to fix the problems even though he knows its there, its plain ignorance. Honestly i'd say its his problem, but on the other hand if that problem tends to affect something important like national security then "Unfortunately, it takes action to get a reaction,". But there are other ways to get them to fix there problem besides defacing there site.