Printable View
I have a question for all of those AO members who are system admins. If a hacker were to find your system open and [list=1][*]acess it[*]find all the security holes[*]notify you[*]do no damage[/list=1] would you still be angry or want to contact the athourities about it?
Frankly, I would be grateful if a hacker were to do these things- provided he/she told me the security holes and how to fix them. I would almost pay for a good hacker to do something like that.
However, I can see how a large corporate admin would be less than happy with such a thing. Security is his job and if a hacker finds a vurnerabilty- many admins see it as a hint that they arent doing their job well.
I have a question for you,
If a burgular were to find your front door open, and
1) Come inside your house
2) Find all the open windows, your lack of a safe, money in drawers etc..
3) Notify you
4) but not take anything
Would you be upset?
(just playing a little devils advocate)
be careful of so-called white hat hackers…
these guys/gals notify you of the exploits they used (but did not develop), you think- great, this really nice white-hat told me what was wrong- so you don’t get angry or press charges, low and behold: he stole all of your sensitive corp. data and sold it for whatever he could scrounge… I’ve heard of it before.
So in conclusion, I’m not quite sure how I feel on the subject. Although- I doubt any skilled white-hat’s going to hack your net-work just to be nice, prolly just some script kiddie trying not to get in trouble?
Now this is a guy I gotta meet....... He's way ahead of the game....... :DQuote:
Actually I would thank him for the valuable information he provided and ask him how to close these holes.And regarding the thief example,if he doesn't do anything then he cannot be regared as a thief.
Yes this is a tough Question...It would really depend on the webmaster I'd say. If it happened to me personally, I would be greatful! But thats just me...
He MR Devils Advocate... this is what the cops in holland do sometimes... look around the house for weak spots and leave a note ....Quote:
Originally posted here by R0n1n
I have a question for you,
If a burgular were to find your front door open, and
1) Come inside your house
2) Find all the open windows, your lack of a safe, money in drawers etc..
3) Notify you
4) but not take anything
Would you be upset?
(just playing a little devils advocate)
they won't look in Drawers en for a safe but they do check the house from the outside.
I believe lot's of admins would be happy with such a advise but it keeps beeing illegal! so even white hat hackers should look the're backs!
XychiX-
| I think that's neat about the Holland Police- you say "from the outside" , right?
| I'm not too sure how happy i'd be if the cops broke into my house, just to tell me how it can be done. but as long as the intruder doenst log in... i'm fine with it :-)
| so, i guess (these white-hats) they just runa vuln scanner on your network and tell you what it found...
Trespassing is still not right. It is no worse that coping copyrighted software. If i were just to walk into peoples homes and buisnesses whenever i wanted I would be arrested here in the states. The rules may be diffrent elsewhere. but the problem occurs when you bring the international scene into it. if you hack a US site or anywhere else from a country that does not have hackin rules. it is hard to police the world. with out a global goverment. I do not want one governing body so i am really torn.
I don't care if the hacker is doing it to "show" me my weakness. I don't like other people poking through my stuff. What I say to do is to find out who he is and poke through his stuff...
(then lock down my server, etc)
hehe
First, lets change thief to intruder then.
And second, in the real world, if you scan any mid to large size corporate network, and probably small ones as well, the Administrators are not going to be happy (assuming that they find out what you are doing), for a start how do you convince the Admin that you did nothing wrong?
There could aslo be IDS which you will trigger which creates Alerts and wake Admins up at 2am and make them unhappy as well.
Also, many companies will have a corporate security policy drawn up by management which will likely state that any scanning conducted against their network must be authorised by them, so you are therefore in breach of that and get in trouble that way.
So, I would tread carefully when thinking about any kind of white hat scanning, its good in theory but you could well upset people and get yourself into trouble. Especially with everyone being as paranoid as they are right now about cyber terrorism and the like..
Someone who finds a weakness in your homes security and uses that to enter your house, but does not steal anything, is STILL GUILTY of breaking and entering. Same goes with computer systems, if they gain unauthorized access to my systems by utilizing a security hole, they are breaking and entering.
Scanning is a bit of a different matter. If you just port scan my network, it will annoy me, but you really have not done anything wrong. Although why would you be portscanning me, if not to find out what services I am running that you may be able to exploit.
however, the vulnerability scanners, like those used to determine wether a webserver is vulnerable to a directory traversal exploit, actually attempt to break into the system, if only minimally.
Bottom line is this, certain people and organizations have been given certain rights to data/services on my systems. Everyone has been given access to read a website for example, but only certain other people have access to do other things. If someone not on that list is attempting to access some service they have not been given permission to access, such as by trying to use a vulnerability in a webserver to execute commands on the server, they are without question guilty attempting to break into my systems.
Preventing these people access is what firewalls and security etc are all about, if I have done a good job, these people are kept out. If I have not done a good job or someone else does something really really stupid without my knowledge, they get in. In either case, they are breaking the law by attempting to break into my systems(IMHO).
If I wanted your (white hat) help securing my system, I would ask for it, and pay you appropriately. I would also sign a contract stating that I had given you permission to conduct these activities. If anyone attempts to get in without that permission, with whatever intentions, they are going to get into a mess of trouble.
Better Be Careful on that....
It cost me 50 grand in lost sales and legal fees
when I did someting similiar.....
http://www10.brinkster.com/cecomet/
Not all Admins are receptive to being told they
do not have a secure system.
Well, it might be quite hard to be sure that the intruder didn't do anything. Ok, he/she said so, but would you believe? To be sure, you will need to do an extensive check (and costly), and very often, restore things from backup. Not destroying any data doesn't mean they didn't have access to it, and it may be quite sensible. Having CC numbers stolen is way worse than having a webpage defaced..
Like it has been said, the person is already guilty for breaking into the computer. One could pay for a penetration test, but in this case, every part agree withe the terms. I think it would cost some thousands of dollars..
Resuming: even if nothing has been changed, checking for it and being annoyed because of the incident is already enough to upset the admin or even cause damagemoney loss. I wouldnt have a good time if I were the sysadmin..
<sarcasm @ kiddiots>Wait! Defacers do it for free! (j/k). And if you notice the defaced pages, they alway put their emails there, so that the administrator can get in touch with them... explain this to me: do they actually want a job? Lol.. (it's not intended to be taken seriously...)
</sarcasm>
Er Frank...... I don't think what you did can be classed as hacking..... I believe that you need to have passed through some form of warning or security into an area that you would not normally be allowed into to have it considered hacking..... specifically you must have "broken into"......
You were an authorized user of their system and had been given a username and password to authenticate yourself to their system. They, in turn, granted you access rights to portions of their system. It was they, not you, who granted you rights to areas that they did not wish you to see and therefore they granted you the right to see that data. They are the ones that control the ACL's and determine your access. You simply went where they had granted you rights on their system. It was their problem all along...... and their problem was incompetence, (the rights were improperly granted), negligence, (their system was clearly not tested by an independent security audit), which in turn led to the potential, (probable), disclosure of confidential client information, (which has a detrimental effect on thier share prices when the info goes public).
Question: Why did you not go on the offensive?
although this sounds benign I am always skeptical of an intrusion whether or not the intruder claims his/her intent was not malicious. Why would they want into my system in the first place is the question I would have to ask myself and for the life of me I cannot come up with a benign answer....
I went home and really thought this all over. I think what this comes down to is that i personaly would not mind knowing the flaws on my system. I understand that company policy may mean that I would have to prosocute and that is unfortunante. After really putting my mind to it, I think that the breaking in is where the line is crossed. i was just curious as to how real system admins feel. I am not good enough to be called a white hat and am not quite old enough to be a system admin but the world of computers is a world all its own.
No I did not HACK or CRACK into the server
I had at the time, every right to access
the server via my FTP access to my website
at the time.
There system at the time was completely open..
You could browse any part of the server via your
personal FTP access and at the time were the only
game in town.
Please read what happen real carefully.
Like I said also some ISP's may not be very bright
when it comes to their own security
I could not find a Lawer who would go after that ISP.
I feel the lawer who went after them would have cleaned house.
Frank: I didn't accuse you of either...... In fact, quite to the contrary, I thought I laid out the fact that by definition you only went where an, (albeit numbskull), sysadmin said quite clearly in his ACL's where he wanted to let you go as an authorized user of his public resource.
What was it with the lawyers?????? Unlike them not to smell blood in the water...... ;)
I just watched a TV show on TCL (I forget the title of it), it talked about a lot of white hackers who were hired by a company to find all the wholes in a network, who would give out passwords, etc. And also about white hats who did like had happeded to you methdeath, so honestly shoudl you be surprised about it... I would say not.
Here's the tricky part, because I agree with tampabay420 though. I mean if this person called you on the phone, told you about it, said this is my name and number and all checked out... then I wouldn't worry so much. But if someone just sends you an email and tells you about it trying to throw you off, hoping that all the IP logs would be deleted before you thought maybe they actually stole something from your company, who knows.
I agree with your logic methdeath, that if they don't cross the line then they are safe. But sometimes how do you know if they crossed it or not, because they told you that you have problems with your security?
Personally I'm a security nut, if someone like that just emailed me and I couldn't trace it back, or couldn't contact them again, then I might think about getting the police involved... JUST to make sure that nothing was stolen.
It's kind of a hard call to make, because you don't want to be an ass for having someone point out mistakes, but you don't want to think that they are being totally up front either. :confused:
This is Western NY, They all wanted a fee before
they proceded.... This neck of the woods is so
full of "The Good Old Boys Networks" I almost
got convicted because of who the local Telco
was... Local Owned for Generations by 1 family.
And I know the family, some were real nice but
others acted like "Gods Gift to the World" and the
one who was after my "Butt" was one who thought
he was Gods Gifts.
I will say if it was not for another local bunch of
friends, who intervened in my behalf I would be
in JAIL!!!! as a Felon!!!
The world is not always fair! I wish I could have
re-cooped, but that page I posted has basically
cost them many customers. My ISP who I support
has increased from 2200 customers and no
ADSL circuits has increased to 7000+ dial ups
and 400 ADSL customers. In my area he
just started up with only 24 lines, when I was
kicked off of CE Comet, now has
or will have 192 dial up lines and has ADSL.
I figure I am responsible for either directly or
indirectly 2000 dial up customers plus a bunch
of ADSL customers.
A white hat hacker wont only portscan (to see where the doors are) but he also opens them!Quote:
Originally posted here by tampabay420
XychiX-
| I think that's neat about the Holland Police- you say "from the outside" , right?
| I'm not too sure how happy i'd be if the cops broke into my house, just to tell me how it can be done. but as long as the intruder doenst log in... i'm fine with it :-)
| so, i guess (these white-hats) they just runa vuln scanner on your network and tell you what it found...
Like the police they will feel if the door is open, if it is they drop a note on the doormat and then leave again!
a White hat hacker finds a vulnarable service he'll try to exploit it and as soon as he gets a root shell he "SHOULD" logout and notify the admin.
There are whitehat's who will repair the system themselves. That's wrong in my opinion. Its a case of the admin whether he chooses for the risk of a vulnerable system or for the risk of a update (wich aren't 100% riskless most time, thats why only the admin can decide).
By The Way, try this:
Walk op to the police station en tell them you're laptop has been stolen from you're car. when they ask you is there's any damage tell them "No because i left the windows and the doors open of my car!".
I Bet they'll (almost) laugh at you...
In my opinion one should to the same to a lazy admin that is stuck with a default install of windows 2000.
I think I would be happy AND angry.
1. Happy because the web site will be secure.
2. Angry because I do not do my job. It's my responsability to find holes and to stay aware of vulnerability.
i figure if you can access the system then you must know what you're doing.
if you COULD cause damage, then why on earth would you come out and say "HERE IS WHAT THE PROBLMES IS AND THIS IS HOW TO FIX IT".
my advice, (it’s just my opinion).... if you do wish do let admin know what their security holes are do so anonymously at first, for you own safety.
yes but as was said before, wouldn't that be the perfect coverup? I mean if I hack the FBI, and just tell them the security flaws... I'd be in jail in like two seconds anyway. Why, because the fact remains that the person who let you know about those flaws might still have stole something... Payroll, banking information, etc. So you can't be all thankful that someone showed you the holes in your security and think it's no problem, beause unless they are already on payroll and working for you, it's still something to be scared of.
Plus it could even be a hacker bragging, "Hey you've got this problem, this problem, and this problem in your security structure" as he's thinking "wow, I just got myself a free trip around the world thanks to the payroll of this company, stupid f**kers".
I've seen it done before. Heck I've even helped someone I know hwo works for a bank try to find how tight his security is, and I was the guy trying ot hack in and find all the holes. I got people to believe I was a tech working for the bank, so they gave me security codes and stuff. But if I wasn't actually doing all that to help a friend, I could have gotten into some really nice stuff. That's what I'm talking about...