Hack has at least two definitions in a computing context.
A nifty trick or shortcut that is useful. “Check out this hack to increase your productivity.”
Accessing something you shouldn’t. “They hacked into the database.”
A lot of times they sort of get used in conjunction to describe interesting ways to gain access to secure systems, but using it to describe accessing insecure things you shouldn’t is still a valid usage of the phrase.
That said I definitely wanna see the company face charges for this, this is insane.
Terrible analogy. A webserver is not at all like a door. It doesn’t block or allow traffic to and from your file system.
A web server is more like a receptionist. It handles requests. “Can I have your basic catalog?” “Certainly, here you go.”
“Can I get this item from your basic catalog?” “Certainly.”
“I don’t see it in your catalog, but my buddy said he got this other item from you. Can I have this other item too?” “Absolutely.”
“Can I borrow your stapler?” Sure. “How about a pad of paper?” “Of Course”. “Can I just have the contents of your supply closet?” “Here you go.” “How about your accounting files, can I get those?” “No problem!” “How about your entire customer list?” “Consider it done!”
When you hire a receptionist and specifically tell them to give customers anything they request, that’s entirely on you. You have to at least make a token effort to restrict access to only authorized users before you can even claim that a particular user was unauthorized.
This wasn’t burglary. This was putting up signs that say “come in” and labeling everything in your house with “free” stickers.
In a legal context there’s also the concept of a “reasonable expectation of privacy”. The computer abuse and fraud act defines hacking as accessing data or systems you are not authorized to access.
A better analogy is putting your journal in a public library and getting mad when somone reads it.
I’m not saying what these ass holes did was right, I’m saying that the company weakened their legal position by not protecting the data.
Terrible analogy. You have permission to read books in a library.
Forgetting to lock your door isn’t granting permission to people enter your house, and it doesn’t grant people permission to take your valuables. It may be neglectful to leave your door unlocked, but it doesn’t imply granting permission to enter your house.
Same goes with computer security. Leaving your computer insecure may be neglectful, but it does not imply someone has permission to take your data.
If I’m clicking around on a website and find a gallery of images, that’s something I’m supposed to have access to. If I start typing in URLs that aren’t linked anywhere on the site, then I’m accessing stuff the site hasn’t explicitly indicated I have access to. If I’m doing this with the intent of getting data and distributing to others, then yeah that would be illegal.
The law allows for someone to exercise judgement. The people who do this are not so coincidentally called Judges. If the 4chan guys had have been white hat and reported the issue to the site owners, then they’d be fine. But it’s obvious to anyone their intent was to get private information, they poked around to find some private information, and then distributed that private information to others causing a privacy violation. Yes, it was easier to do than it should have been, but it’s obvious they had malicious intent and it’s obvious they were accessing information they weren’t supposed to access.
A crime being really easy to commit doesn’t make it no longer a crime. Many times I’ve seen things that I could easily steal, but I don’t steal things when I have an opportunity to do so because a) stealing is wrong and b) saying “they just left this thing out there in a place anyone could steal it” would not be any kind of legal defense. Simply because you’re presented an opportunity to do a crime doesn’t mean it’s acceptable to do a crime, both legally and morally speaking.
I start typing in URLs that aren’t linked anywhere on the site, then I’m accessing stuff the site hasn’t explicitly indicated I have access to.
Doesn’t work like that. With the policy you describe, anyone who ever sees a “404” error is a criminal.
I don’t have to publish everything I am willing to offer. You are free to ask for something I may or may not have. I get to decide how to respond to your request.
To use your analogy, I can walk up to your door and request a glass of water. You’ve never explicitly offered a glass of water to anyone; I’m still allowed to ask. If you dont want me to have your water, you can say “No” or you can ignore me.
When you go ahead and give me a glass of water, you don’t get to claim I stole it from you. It is not theft to ask.
You have to make some sort of effort to have your web server limit my access, and I have to make some sort of effort to convince your webserver to bypass those restrictions before you can claim I am exceeding my authorization.
A better analogy is putting your journal in a public library and getting mad when someone reads it.
Good analogy indeed. I’d go one step further and add: it’s like promising others you’ll keep their diary safe, then putting it in a public library, to then get mad when someone reads it.
Thank you! I feel like I’m taking crazy pills reading people’s reactions to this. And if it was a business instead of your house and it was customer data you weren’t protecting you should still be in trouble too. It’s like people think only one side can be in the wrong in this or that because the data wasn’t secured and in the public that gives them free reign to post it everywhere. I wonder how those people would feel if their addresses were leaked. Afterall, if you’re a homeowner your name is attached to the property and is publicly accessible.
No, this was a data leak. The word “hack” has legal implications and shifts the blame away from the company and onto the individual who discovered the leak.
It can be both. The company can be at fault for not keeping something secure while the people who steal the data are at fault for stealing data. Data leaks and hacks are not mutually exclusive.
I don’t disagree with your main point, but I’m not sure it’s really even “stealing”, as that means to take without permission. In this case, the storage permissions were configured so that the files were publicly available to everyone, so everyone had permission to access them.
Semantics though. It’s still unethical to access that data, even if it’s not technically stealing.
Hack has at least two definitions in a computing context.
A lot of times they sort of get used in conjunction to describe interesting ways to gain access to secure systems, but using it to describe accessing insecure things you shouldn’t is still a valid usage of the phrase.
That said I definitely wanna see the company face charges for this, this is insane.
Yeah, if I leave my house door wide open for a few weeks and I get robbed, it’s still burglary.
Terrible analogy. A webserver is not at all like a door. It doesn’t block or allow traffic to and from your file system.
A web server is more like a receptionist. It handles requests. “Can I have your basic catalog?” “Certainly, here you go.”
“Can I get this item from your basic catalog?” “Certainly.”
“I don’t see it in your catalog, but my buddy said he got this other item from you. Can I have this other item too?” “Absolutely.”
“Can I borrow your stapler?” Sure. “How about a pad of paper?” “Of Course”. “Can I just have the contents of your supply closet?” “Here you go.” “How about your accounting files, can I get those?” “No problem!” “How about your entire customer list?” “Consider it done!”
When you hire a receptionist and specifically tell them to give customers anything they request, that’s entirely on you. You have to at least make a token effort to restrict access to only authorized users before you can even claim that a particular user was unauthorized.
This wasn’t burglary. This was putting up signs that say “come in” and labeling everything in your house with “free” stickers.
@SpaceCowboy @JackbyDev
In a legal context there’s also the concept of a “reasonable expectation of privacy”. The computer abuse and fraud act defines hacking as accessing data or systems you are not authorized to access.
A better analogy is putting your journal in a public library and getting mad when somone reads it.
I’m not saying what these ass holes did was right, I’m saying that the company weakened their legal position by not protecting the data.
Terrible analogy. You have permission to read books in a library.
Forgetting to lock your door isn’t granting permission to people enter your house, and it doesn’t grant people permission to take your valuables. It may be neglectful to leave your door unlocked, but it doesn’t imply granting permission to enter your house.
Same goes with computer security. Leaving your computer insecure may be neglectful, but it does not imply someone has permission to take your data.
@SpaceCowboy
Then how do I know what I am not allowed to access?
In this specific case there was no (formal) indication that the data was out of bounds.
I can’t put 10 pdf files in a web dir and claim 5 are public and 5 are private, then charge you with a crime for viewing them.
You can’t have “unauthorized access” when there’s no authorization at all
If I’m clicking around on a website and find a gallery of images, that’s something I’m supposed to have access to. If I start typing in URLs that aren’t linked anywhere on the site, then I’m accessing stuff the site hasn’t explicitly indicated I have access to. If I’m doing this with the intent of getting data and distributing to others, then yeah that would be illegal.
The law allows for someone to exercise judgement. The people who do this are not so coincidentally called Judges. If the 4chan guys had have been white hat and reported the issue to the site owners, then they’d be fine. But it’s obvious to anyone their intent was to get private information, they poked around to find some private information, and then distributed that private information to others causing a privacy violation. Yes, it was easier to do than it should have been, but it’s obvious they had malicious intent and it’s obvious they were accessing information they weren’t supposed to access.
A crime being really easy to commit doesn’t make it no longer a crime. Many times I’ve seen things that I could easily steal, but I don’t steal things when I have an opportunity to do so because a) stealing is wrong and b) saying “they just left this thing out there in a place anyone could steal it” would not be any kind of legal defense. Simply because you’re presented an opportunity to do a crime doesn’t mean it’s acceptable to do a crime, both legally and morally speaking.
Doesn’t work like that. With the policy you describe, anyone who ever sees a “404” error is a criminal.
I don’t have to publish everything I am willing to offer. You are free to ask for something I may or may not have. I get to decide how to respond to your request.
To use your analogy, I can walk up to your door and request a glass of water. You’ve never explicitly offered a glass of water to anyone; I’m still allowed to ask. If you dont want me to have your water, you can say “No” or you can ignore me.
When you go ahead and give me a glass of water, you don’t get to claim I stole it from you. It is not theft to ask.
You have to make some sort of effort to have your web server limit my access, and I have to make some sort of effort to convince your webserver to bypass those restrictions before you can claim I am exceeding my authorization.
Good analogy indeed. I’d go one step further and add: it’s like promising others you’ll keep their diary safe, then putting it in a public library, to then get mad when someone reads it.
@iii
Yeah the internet by design is a public space, and we must be responsible and treat it as such when handling sensative data.
Again, it was very wrong for people to take that data and especially to post like that.
The company also has to do their part and produce at least some kind of barrier to the data.
Even using UUIDs and making sure the data wasn’t query-able would have been something.
The web is a public space by design. The internet? I don’t think you can make that case well. Https and all that. Private infra abounds.
The data was on the public web in this case
Thank you! I feel like I’m taking crazy pills reading people’s reactions to this. And if it was a business instead of your house and it was customer data you weren’t protecting you should still be in trouble too. It’s like people think only one side can be in the wrong in this or that because the data wasn’t secured and in the public that gives them free reign to post it everywhere. I wonder how those people would feel if their addresses were leaked. Afterall, if you’re a homeowner your name is attached to the property and is publicly accessible.
No, this was a data leak. The word “hack” has legal implications and shifts the blame away from the company and onto the individual who discovered the leak.
It can be both. The company can be at fault for not keeping something secure while the people who steal the data are at fault for stealing data. Data leaks and hacks are not mutually exclusive.
I don’t disagree with your main point, but I’m not sure it’s really even “stealing”, as that means to take without permission. In this case, the storage permissions were configured so that the files were publicly available to everyone, so everyone had permission to access them.
Semantics though. It’s still unethical to access that data, even if it’s not technically stealing.
Based on this comment alone, I am 100% sure that you are not a lawyer.
I don’t claim to be, but you can’t deny the difference the wording would make to a jury.
😂