Re: [security] Re: Major hack attack on the U.S. Senate

[rsh@idirect.com]

On Thu, 29 Jan 2004 17:09:27 +0100 (CET), you wrote:

>On Fri, 23 Jan 2004 Daniel.Capo@tco.net.br wrote:
>
>> > Which means the Democrats screwed up setting up their own share point and
>> > allowed public access to it. There was no "computer glitch" which was
>> > "exploited". This was completely a human screw-up. And there was no
>> > hacking ("exploitation of a computer glitch") done by the Republicans.
>> > Unless you wish to call clicking on a share point configured with public
>> > access and opening it up "hacking".
>>
>> AFAIK, "hacking" is legally defined in the USA as being unauthorized
>> access to computer resources. It doesn't matter if the resource was
>> adequately protected (or protected at all) in first place or not. If you
>> were not given permission to make use of that resource, you are
>> criminally liable.
>>
>Do you have an explicit permission to read the content of a www.cnn.com?
>What is the difference between opening a web URL and a network share?

In a word, Intent. If a CNN intends you to read the news on their web
site and gets advertising revenue when you do, you are not hacking when
you go there. If the Senate does NOT intend you to read their files and
leaves open a network share in error or through ignorance, you are
hacking when you go there. As silly as it seems, that is the way the
laws were designed to work.

We have a similar silly law in Canada re digital scanners. Before they
existed the government was afraid someone could listen in on their
digital cell phones so they set up a regulation that you need a license
to buy a digital scanner. This was in 1994, before these scanners even
existed. Now they exist and the cell phones use encryption that the
scanners cannot decrypt, but the 'regulation' is enforced because it is
on the books. Does it mean anything? No, we simply buy the scanners in
the US! It is not illegal to own a digital scanner without a license,
after all... just to BUY it without one. Incidently, they have not yet
set up any routine to issue a license, and I doubt they ever will!

rsh
================================================== ===
R.S.H. Toronto, ON, Canada

Copyright retained.
My opinions - no one elses...
If this is illegal where you are, do not read it!

[Ron DuFresne]

[SNIP]

>
> i think "technical" people often think of the law-system as something
> as C-code, as it's written there is only one way for a standard
> compliant compiler to interpret it. I think the judges are more flexible
> than gcc in this regard, they can also assume that one perfectly knows
> that one is supposed to read http://www.cnn.com but not to read
> http://qz25srv.competitor.com/internal/memos/strategy.doc (made up
> example) even if -- from a technical standpoint -- there is no
> difference.
>
> They will most likely assume that it was very negligent for the
> competitor to leave his business plan in the open and value this in
> their decision, but nevertheless you should have known better than to
> state "I thought it was meant to be published".
>
> And yes, I'm normally also in favour of the technical viewpoint... :-)
>
>

And of course all know that banners implicitly stating access policies can
help support the legal standing when there may be doubts.


Thanks,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity. It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D. Just don't touch anything.

[Daniel.Capo@tco.net.br]

Christian Vogel wrote:

>
> i think "technical" people often think of the law-system as something
> as C-code, as it's written there is only one way for a standard
> compliant compiler to interpret it. I think the judges are more flexible
> than gcc in this regard, they can also assume that one perfectly knows
> that one is supposed to read http://www.cnn.com but not to read
> http://qz25srv.competitor.com/internal/memos/strategy.doc (made up
> example) even if -- from a technical standpoint -- there is no
> difference.

What concerns me most is that not one objection I received addressed the
point I made. I spoke of the _legal_ definition of "hacking", and all
people came up with was disagreement based on their own personal
feelings on the matter.

Excuse me, but personal feelings in this matter is irrelevant. People
objected to the press applying the term "hacking" to what happened, and
I pointed out that their usage was correct according to the law,
assuming their portrayal of the events was accurate.

And every single person who objected did so on the grounds that they
don't like this definition. Sheesh. Who cares? This is bugtraq, not
slashdot. Prove me wrong by quoting legislation, point out that the
facts of the case do not lead to this conclusion, but, please, more
signal, less noise.

On a side not, I'm a technical person myself, and I much dislike this
fuzzyness in the law. This case seems pretty clear, but I can conjure up
dozens of real life scenarios where it's ambiguous or the actual ruling
would be "just wrong", IMHO. And that's all that this is: mho.

[Christian Vogel]

Hi Mariusz,

On Thu, Jan 29, 2004 at 05:09:27PM +0100, Mariusz Woloszyn wrote:
> Do you have an explicit permission to read the content of a www.cnn.com?
> What is the difference between opening a web URL and a network share?

i think "technical" people often think of the law-system as something
as C-code, as it's written there is only one way for a standard
compliant compiler to interpret it. I think the judges are more flexible
than gcc in this regard, they can also assume that one perfectly knows
that one is supposed to read http://www.cnn.com but not to read
http://qz25srv.competitor.com/internal/memos/strategy.doc (made up
example) even if -- from a technical standpoint -- there is no
difference.

They will most likely assume that it was very negligent for the
competitor to leave his business plan in the open and value this in
their decision, but nevertheless you should have known better than to
state "I thought it was meant to be published".

And yes, I'm normally also in favour of the technical viewpoint... :-)

Chris

[David Schwartz]

> On Fri, 23 Jan 2004 Daniel.Capo@tco.net.br wrote:

> > > Which means the Democrats screwed up setting up their own
> > > share point and
> > > allowed public access to it. There was no "computer glitch" which was
> > > "exploited". This was completely a human screw-up. And there was no
> > > hacking ("exploitation of a computer glitch") done by the Republicans.
> > > Unless you wish to call clicking on a share point configured
> > > with public
> > > access and opening it up "hacking".

> > AFAIK, "hacking" is legally defined in the USA as being unauthorized
> > access to computer resources. It doesn't matter if the resource was
> > adequately protected (or protected at all) in first place or not. If you
> > were not given permission to make use of that resource, you are
> > criminally liable.

> Do you have an explicit permission to read the content of a www.cnn.com?
> What is the difference between opening a web URL and a network share?

Laws are not like computer programs. They don't have to precisely describe
a process that can be mindlessly applied to determine whether the law was
violated or not. Common sense is permitted.

You may not have "explicit permission" to read the content of www.cnn.com,
any more than you have explicit permission to eat at Burger King. This
doesn't make it impossible to tell the difference between eating at Burger
King and entering Burger King after they've closed through a door that was
left unlocked by mistake.

The fallacy in your argument is to equate lack of "explicit permission"
with "unauthorized access". They are not at all the same thing. Explicit
permission is not the only form of authorization. One can try to argue to
that publication of a share without a password could easily be mistaken for
authorization, but the instant one sees the content, it is clear that no
such authorization was intended. One cannot be "accidentally authorized" to
do something. One could mistakenly think one was authorized, but that
argument would be laughed at in this case. Nobody could make it with a
straight face.

DS

[Bernie, CTA]

On 2 Feb 2004 at 23:02, rsh@idirect.com wrote:

> >On Fri, 23 Jan 2004 Daniel.Capo@tco.net.br wrote:
> >
> >> > Which means the Democrats screwed up setting up their own
> >> > share point and allowed public access to it. There was no
> >> > "computer glitch" which was "exploited". This was
> >> > completely a human screw-up. And there was no hacking
> >> > ("exploitation of a computer glitch") done by the
> >> > Republicans. Unless you wish to call clicking on a share
> >> > point configured with public access and opening it up
> >> > "hacking".
> >>
> >> AFAIK, "hacking" is legally defined in the USA as being
> >> unauthorized access to computer resources. It doesn't matter
> >> if the resource was adequately protected (or protected at all)
> >> in first place or not. If you were not given permission to
> >> make use of that resource, you are criminally liable.
> >>
> >Do you have an explicit permission to read the content of a
> >www.cnn.com? What is the difference between opening a web URL
> >and a network share?
>
> In a word, Intent. If a CNN intends you to read the news on
> their web site and gets advertising revenue when you do, you are
> not hacking when you go there. If the Senate does NOT intend you
> to read their files and leaves open a network share in error or
> through ignorance, you are hacking when you go there. As silly
> as it seems, that is the way the laws were designed to work.
>
<<<
I believe the US Courts would find that the "Intent" of the
Democrats to assert that their files were not for public access,
alone not persuasive. It's my experience that the Court would
perhaps look at the facts associated with the following primary
questions

1. Was there a Security or Computer / Network User Policy in
force which all users (Parties) were aware of, or better yet
signed, specifically identifying how public and private realms
are delineated, and how access to private files is administered?
I would wager that there was no such Policy in place, and
therefore no way to establish a Chinese wall.

2. Where there any safeguards in place to restrict access to
authorized users, and if so were these circumvented and by who?
In this case, safeguards could have been implemented, and it may
have been the Intent of the Democrats to do so, but the fact
remains that they were not. Therefore, no hack or willful
breech of the systems security occurred.

3. Were there any notices (i.e. the word Confidential,
Restricted, etc, placed in the Header, Footer or Watermark of
the Document Files) or file/directory naming convention e.g.
Confidential - Republicans Keep Out, indicating that the files
were confidential or more specifically not for public access? If
there were such notices or naming convention an argument could
be made that parties did receive notice that the files were to
be considered private or not for public access.

4. If there were notices or marks indicating that the files and
their content were private, then, did the person who accessed
and disclosed content of these files do so with the "Intent" to
cause harm to the Author? Well, that is a tough one. Obviously
both sides are involved in the game of political tactics,
(information warfare), against their opponents "Party". However,
the law looks at harm to an individual, so was any individual
hurt by the disclosure? Was that the intent of the disclosing
party?

I would analyze the transaction and occurrences in this case by
drawing an analogy to that of a Public Library. In such a
Library, there are books and records, which are made available
to the Public, although notice of this is typically not placed
on each book or record (file). However, there are also areas
(rooms) within the premises, which may contain other books and
records (such as operational and administrative records) that
the Library considers private for access by authorized personal.
Typically, the Library would take measures to secure these areas
and ensure that access to these rooms is controlled, doors
locked, or notice is displayed indicating that the area is
Private, i.e., General Public Keep Out.

Likewise, the Democrats may have had the Intent to establish
that certain areas and its contents were private, but failed to
mark these areas (Directories) or ensure that safeguards were
properly implemented to control access. The bottom line is that
basic security policies, procedures and safeguards were not in
effect in the Senate's Network to prevent unauthorized access,
or more importantly alert the casual user that the files are
private and not public domain.

-
-
************************************************** **
Bernie
Chief Technology Architect
Chief Security Officer
cta@hcsin.net
Euclidean Systems, Inc.
************************************************** *****
// "There is no expedient to which a man will not go
// to avoid the pure labor of honest thinking."
// Honest thought, the real business capital.
// Observe> Think> Plan> Think> Do> Think>
************************************************** *****

[Thomas M. Payerle]

On Tue, 3 Feb 2004 Daniel.Capo@tco.net.br wrote:

> Christian Vogel wrote:
> What concerns me most is that not one objection I received addressed the
> point I made. I spoke of the _legal_ definition of "hacking", and all
> people came up with was disagreement based on their own personal
> feelings on the matter.
While you are probably somewhat justified in the lack of discussion on
your "legal definition" of "hacking", you must bear in mind that in the US
legal system interpretation by the courts is as (more?) important than
what is written. I certainly appreciated your bringing this definition
into the discussion, as it was quite eye-opening. But as you comment, this
is not a field you specialize in, and so it is unclear how correct your
interpretation is (and I suspect that very few bugtraq readers are any better
qualified).

As was once commented in a seminar for IT techs about copyrights, there are
only nine people in the country that know what the copyright law means in
any particular case, referring to the justices of the Supreme Court. (And
actually, there are probably only five, as it needn't be an unanimous decision:)

I certainly dislike the phrasing of the legal definition that you provided
(I did not verify your statement, nor check for other possible legal
definitions, but am trusting your research). However, I suspect even with
that definition the interpretation has quite a bit of play. I doubt it would
be considered hacking on my part if I visited www.whitehouse.gov, clicked a
seemingly innocuous link, and received top secret information, even though
by an extremely strict reading of your definition it would be. If we change
that to I randomly try www.whitehouse.gov/topSecret.html, which is not linked
to another page anywhere, the matter becomes slightly gray (after all, the
name topSecret in the URL suggests that they do not want it universally
distributed. I suspect the fact that it is on a web server without any
protection would more strongly suggest that it was for universally distributed).

An unprotected SMB share is a very gray area, and personal opinions become
quite relevant even from a legal standpoint (again, perhaps only the personal
opinions of the nine Supreme Court justices, but personal opinions nonetheless).
The fact that the Rep sysadmin informed the Dem counterpart of the "security
hole" suggests that the Republicans were aware that the material was not meant
for public display. The fact that the hole was not patched in a timely manner
afterwards, however, might suggest that it was (or at least that was not
considered sensitive).
>
> Excuse me, but personal feelings in this matter is irrelevant. People
> objected to the press applying the term "hacking" to what happened, and
> I pointed out that their usage was correct according to the law,
> assuming their portrayal of the events was accurate.
The press is not constrained to using the legal definition, and indeed I would
expect the usage was meant to be the more everyday usage. If the case went
to court, and the Republicans were found not guilty of the hacking charge and
launched a suit against the press for libel/slander (I think there is a slight
legal distinction between the two, but I do not recall which is appropriate
for this case), I suspect the press will quite quickly state they were using
the more vernacular definition of "hacking" and not a legal definition.

I feel that the use of the term "hacking" was a bit sensationalist on the part
of the press, and my reading of the quotes given of the headlines, etc. did
not make it sound like they were intending a legally precise usage. That, of
course, is merely an opinion. I would even venture to say that it is an
opinion which may be dismissed simply because I follow bugtraq; after all,
it can reasonably be claimed that bugtraq readers have jargonized the term
"hacking" to the point where it is different from the general public usage.
There was once (still is?) a group of IT folk who would have vehemently
objected to the use of "hacking" in reference to any unethical behavior,
insisting that the proper term is "cracking" (a "hacker" simply being a
computer enthusiast who does elegant/tricky things).
.. And indeed,


Tom Payerle
Dept of Physics payerle@physics.umd.edu
University of Maryland (301) 405-6973
College Park, MD 20742-4111 Fax: (301) 314-9525

[Larry Seltzer]

On topic, but off the discussion: The Republicans have fired the staffer who read the
Democrat memos and leaked them. See http://www.hillnews.com/news/020504/leak.aspx.

From the article: "Miranda admitted to the sergeant at arms that he had read Democratic
memos that a Republican staffer on the Judiciary Committee accessed through a glitch on
the panel server. But it is unclear what rules if any Miranda broke. His defenders say
that the files were openly available to Republicans through their desktop computers and
that there is no such thing as a property right to a federal document."

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
larryseltzer@ziffdavis.com