Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Shrecknet
Jan 2, 2005


uninterrupted posted:

It’s pretty scary stuff, which is why rule number zero of pentesting is get permission, in writing, clearly stating what is and isn’t allowed.

Pretty timely, some pentesters hired to audit a courthouse just got their charges dropped. The court system hired them, but apparently there was some friction with the sheriffs department who arrested them, and after the fact brought up some bogus charges say they exceeded the scope of their audit. The paperwork released later clearly said “limited physical bypass”, which the sheriff said they overstepped.

https://www.secureworldexpo.com/industry-news/pentesters-jailed-arrested
I listened to the Darknet Diaries episode with these guys on it from last year, but it left off with the thread of their fate still in the air. Glad to hear they're OK.

Regarding hacking, it seems like there should be a mens rea defense available in cases where they are operating in situations like weev's case. It is stealing to walk into an open bank vault and take a stack of money, but is it hacking to walk into an open bank vault and write down the names on the safe deposit boxes?

Adbot
ADBOT LOVES YOU

Shrecknet
Jan 2, 2005


Aramis posted:

Do you mean mens rea in the sense of "I intend to do something nefarious", or "I know that I'm not supposed to be accessing this"?
I mean in the sense that it satisfies none of the four levels of mens rea required to establish a crime has occurred.

If Colonel Sanders ran down the street yelling what the seven herbs and spices are, and I write down what he is yelling, that is not a corporate espionage invasion into KFC HQ.

If a person could access a piece of data without bypassing any encryption or indeed even a No Trespassing sign, that cannot be considered hacking.

The public has no duty to avert its eyes, in other words

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply