Full Disclosure mailing list archives
Re: Vulnerabilities in *McAfee.com
From: "Thor (Hammer of God)" <thor () hammerofgod com>
Date: Thu, 31 Mar 2011 22:42:13 +0000
I should clarify my use of "intent" in previous replies - The "intent" part of the process would be from the judges point of view even in the absence of "concrete" evidence. As you know, actual court cases are not what we see on TV, and the judge has far more power than one may think. Even if the defense argues that the actions by the defendant were acceptable, if the judge thinks that the intent of the individual was to exceed access, then they are hosed. It wasn't meant to imply that saying "I didn't intend to bring their network down" would be of any benefit to a defendant. t -----Original Message----- From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Valdis.Kletnieks () vt edu Sent: Thursday, March 31, 2011 3:30 PM To: Cal Leeming Cc: full-disclosure () lists grok org uk Subject: Re: [Full-disclosure] Vulnerabilities in *McAfee.com On Wed, 30 Mar 2011 20:33:56 BST, Cal Leeming said:
Like with most laws, the key point is "intent". If your intention was clearly not malicious, then you are safe.
Ask Randall Schwartz how that worked out for him. "intent" doesn't enter into it as much as a defendant may like. http://www.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00001030----000-.html Intent is not mentioned at all. You exceed the authorized access, you're guilty under 18 USC 1030. 1030 (a)(2)(C) is the really expansive one, as "protected computer" is defined down in (e)(2)(B) to include anything used in interstate commerce (and yes, DA's *HAVE* argued "The computer has a web browser and thus could get to amazon.com, so it's interstate commerce time"). Doesn't matter if you were trying to save the world at the time (as Gary McKinnon found out). A better approach is to argue the definition of "authorized access" as it applies to an Internet-facing server... _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Vulnerabilities in *McAfee.com, (continued)
- Re: Vulnerabilities in *McAfee.com nix (Mar 27)
- Re: Vulnerabilities in *McAfee.com Cal Leeming (Mar 27)
- Re: Vulnerabilities in *McAfee.com Ryan Sears (Mar 30)
- Re: Vulnerabilities in *McAfee.com Thor (Hammer of God) (Mar 30)
- Re: Vulnerabilities in *McAfee.com Jeffrey Walton (Mar 30)
- Re: Vulnerabilities in *McAfee.com Cal Leeming (Mar 31)
- Re: Vulnerabilities in *McAfee.com BlackHawk (Mar 31)
- Re: Vulnerabilities in *McAfee.com Jacqui Caren-home (Mar 31)
- Re: Vulnerabilities in *McAfee.com Valdis . Kletnieks (Mar 31)
- Re: Vulnerabilities in *McAfee.com Thor (Hammer of God) (Mar 30)
- Re: Vulnerabilities in *McAfee.com Valdis . Kletnieks (Mar 31)
- Re: Vulnerabilities in *McAfee.com Thor (Hammer of God) (Mar 31)
- Re: Vulnerabilities in *McAfee.com coderman (Mar 31)
- Re: Vulnerabilities in *McAfee.com nix (Mar 27)
- Re: Vulnerabilities in *McAfee.com YGN Ethical Hacker Group (Mar 30)