Yellow FlagJan 18, 2024

German law is making security research a risky business.

Current news: A court found a developer guilty of “hacking.” His crime: he was tasked with looking into a software that produced way too many log messages. And he discovered that this software was making a MySQL connection to the vendor’s database server.

When he checked that MySQL connection, he realized that the database contained data belonging to not merely his client but all of the vendor’s customers. So he immediately informed the vendor – and while they fixed this vulnerability they also pressed charges.

There was apparently considerable discussion as to whether hardcoding database credentials in the application (visible as plain text, not even decompiling required) is sufficient protection to justify hacking charges. But the court ruling says: yes, there was a password, so there is a protection mechanism which was circumvented, and that’s hacking.

I very much hope that there will be a next instance ruling overturning this decision again. But it’s exactly as people feared: no matter how flawed the supposed “protection,” its mere existence turns security research into criminal hacking under the German law. This has a chilling effect on legitimate research, allowing companies to get away with inadequate security and in the end endangering users.

Source: https://www.heise.de/news/Warum-ein-Sicherheitsforscher-im-Fall-Modern-Solution-verurteilt-wurde-9601392.html

Gericht sieht Nutzung von Klartext-Passwörtern als Hacken an

Der Programmierer, der eine gravierende Lücke in der Software der Firma Modern Solution aufgedeckt hat, fällt unter den Hackerparagrafen, meint das Gericht.

heise online
Show threadEmelia 👸🏻
@WPalant that's like saying it's breaking & entering if I give you a key to my house. I gave you the key, ergo you had permission to be there.
Jan 18, 2024 at 12:50pmWeb
Show threadhusjon.devJan 18, 2024
@thisismissem @WPalant you could also twist it a bit more and say you left your key under your door mat, not even explicitly giving them the key.
Show threadww 🩶Jan 18, 2024
@husjon @thisismissem @WPalant if you really want a metaphor, here's a more accurate one. there's a fulfillment center, and each customer is issued a delivery robot that will drive there and retrieve their deliveries. one customer followed the robot to see where it goes and saw that the door opens for any robot and stays open long enough for another person to enter, allowing access to everyone's deliveries. reported that to the company and got sued.
Show threadcognitively accessible mathJan 18, 2024
@husjon @thisismissem @WPalant Yes, that's the better analysis. "Attractive nuisance" idea works well, too. If you make it too easy/tempting then it's your responsibility.
Show threadYellow FlagJan 18, 2024

@thisismissem Difficult. If we spin this analogy further: you gave me your key for a specific purpose (e.g. pizza delivery while you were out), after which I returned it to you. You didn’t allow me to make a copy of this key and use it later to rearrange the furniture for example.

Abusing hardcoded credentials can definitely constitute hacking and cause perfectly justified criminal charges. But intention and damage caused definitely need to go into the equation, not merely “circumvention of protection mechanisms.”

Show threadEmelia 👸🏻Jan 18, 2024
@WPalant in this case it just sounds like he used the key to open the front door, saw an absolute mess & notified the company of the issue
Show threadBartoszJan 18, 2024
@thisismissem @WPalant this seems to omit the other side of the story. If I understand this correctly, vendor software was making undocumented calls to outside infrastructure and sharing potentially sensitive data. It should be in company's right to check the level of exposure to properly protect their and their customers' rights.
Show threadThomas TempelmannJan 18, 2024
@RakowskiBartosz @thisismissem @WPalant Well, no. You can't demand the right to look into the internals of your partners - they have a right to privacy as well. You are instead "protected" by the law that requires the partner to protect your privacy interests, or by contracts. What that law is missing, however, is a way to universally verify that they do it correctly, e.g. by independent auditors. Which isn't often feasible, though. It's all a compromise, and it sucks.
Show threadRiley S. FaelanJan 18, 2024

@RakowskiBartosz

Surely you forgot to add a sarcasm tag.

The vendor is almost certainly out of GDPR compliance.

@thisismissem @WPalant

Show threadTamas K LengyelJan 18, 2024
@WPalant @thisismissem Intent and damages should absolutely matter. But it's also common sense not to use the hardcoded credentials to login and dump the database. Or if you do, why report that you did? Perfectly sufficient to just say you found the hardcoded credentials and stop there.. Bad practice on both sides.
Show threadYellow FlagJan 18, 2024
@tklengyel @thisismissem Where did you read that he dumped the database? My understanding is that he connected to the database in the assumption that it was specific to his client, then disconnected and reported the issue immediately after realizing that it contained data on other customers as well.
Show threadTamas K LengyelJan 18, 2024
@WPalant @thisismissem Just connecting to the db won't show you what data is in it to determine it's not just your data. So he must have dumped it or at the least queried it sufficiently deeply to make that call.
Show threadBeady Belle FanchannelJan 19, 2024
@tklengyel @WPalant @thisismissem Just connect to it with a GUI tool like dbeaver (like devs are likely to do), it will show you the schema of tables.
There will be columns like “clientName” or similar, and then doing a few very simple selects will tell you whether you have access to other people’s data.
Show threadBeady Belle FanchannelJan 19, 2024
@tklengyel @WPalant @thisismissem Mixing customer data like that and giving full access to the database with the given user credentials is criminal neglect and should cost the company dearly. Not the person who figured it out.
Show threadYellow FlagJan 19, 2024
@Profpatsch @tklengyel @thisismissem According to https://nitter.net/der_sofc/status/1747644600469127386 he connected with phpMyAdmin. While I haven’t used that tool in decades, that would presumably also expose the database schema immediately.
Show threadAlex RockJan 18, 2024

@WPalant @thisismissem

Many judges in court don't know jack shit about programming, and "compiling" is the same as "encrypting" for them.

As many analogies said: if you give someone the key to your house, whether it's wrapped in tons of cardboard and tape, they still have the key.

The software provider must be condemned as a security flaw, endangering all users.

Show threadcrazyeddieJan 18, 2024
@thisismissem @WPalant More like you put a lock on your door that has no tumbers because you didn't know this because it's a "secret"--and someone comes along and says, "Hey, those locks have no tumblers and can just be turned with a flathead," and that person is arrested and imprisoned. No actual entry is required and its been this way for almost 3 decades. Can also be used to imprison someone for the act of selling you a screwdriver or just telling you how to forge one.
Show threadJR FreemanJan 18, 2024

@thisismissem @WPalant It's more like someone found a key hidden in a very obvious place.

Like, if you call the plumber because of a leak in your yard, he can't find it, so he let's himself in with a key under the mat and finds the problem in your house. He was doing the job you hired him to do, but you might be a little uncomfortable learning he's taken liberties with your locks in order to do so.

Now, whether that discomfort means a crime has occurred is another matter.