Re: Vulnerabilites in new laws on computer hacking

[Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>]

Paul,

On 2006-02-15 Paul Schmehl wrote:
> --On Saturday, February 11, 2006 16:35:20 +0000 self-destruction () itsbest com wrote:
> > New generations of teenagers will be scared of doing online
> > exploration. I'm not talking about damaging other companies' computer
> > systems. I'm talking about accessing them illegally *without*
> > revealing private information to the public or harming any data that
> > has been accessed. To me, there is a big difference between these two
> > types of attacks but I don't think that judges feel the same way.
> > Furthermore, I don't even think that judges understand the
> > difference.
>
> To me there is not.  They're my systems.  Stay out, thank you very
> much.
>
> If you want to learn how to hack, set up your own network, install
> some OSes, with various patch levels, and hack away.  You can learn
> everything you need to know without ever touching a system you do not
> own.  Get your buddies involved.  Hack each other's boxes.  But do not
> hack into systems that do not belong to you.  That *should* be illegal
> and you *should* be prosecuted.

while I agree with you that for learning and practicing it would suffice
to build your own systems to tamper with, I have to disagree on the part
that hacking into other people's systems *without* doing any damage
should be illegal.

Why is that? Well, first of all because the definition of what is and
what isn't hacking is very blurry. Is a portscan hacking? Is directory
traversal as in the case of Daniel Cuthbert [1] hacking?

In addition to that some vulnerabilities can be discovered only ITW,
simply because you cannot rebuild that environment in your lab. Two
years ago we had a case like that over here in Germany [2] (the article
is in german, but maybe an online translator will help). The OBSOC
(Online Business Solution Operation Center) system of the Deutsche
Telekom AG did not do proper authentication, so by manipulating the URL
you could access other customers' data. How would you detect such a
vulnerability without actually hacking the system? Is one supposed to
not notice these things? Will that really make them go away?

[1] http://taint.org/2005/10/12/205836a.html
[2] http://www.ccc.de/t-hack/stn/inhlt/drartkl.htm

Regards
Ansgar Wiechers
-- 
"All vulnerabilities deserve a public fear period prior to patches
becoming available."
--Jason Coombs on Bugtraq