Post #2032867

2024-01-18 12:25 UTC

German law is making security research a risky business. Current news: A court found a developer guilty of “hacking.” His crime: he was tasked with looking into a software that produced way too many log messages. And he discovered that this software was making a MySQL connection to the vendor’s database server. When he checked that MySQL connection, he realized that the database contained data belonging to not merely his client but all of the vendor’s customers. So he immediately informed the vendor – and while they fixed this vulnerability they also pressed charges. There was apparently considerable discussion as to whether hardcoding database credentials in the application (visible as plain text, not even decompiling required) is sufficient protection to justify hacking charges. But the court ruling says: yes, there was a password, so there is a protection mechanism which was circumvented, and that’s hacking. I very much hope that there will be a next instance ruling overturning this decision again. But it’s exactly as people feared: no matter how flawed the supposed “protection,” its mere existence turns security research into criminal hacking under the German law. This has a chilling effect on legitimate research, allowing companies to get away with inadequate security and in the end endangering users. Source: https://www.heise.de/news/Warum-ein-Sicherheitsforscher-im-Fall-Modern-Solution-verurteilt-wurde-9601392.html

Replies (21)

@thisismissem@hachyderm.io 2024-01-18 12:50

@WPalant@infosec.exchange that's like saying it's breaking & entering if I give you a key to my house. I gave you the key, ergo you had permission to be there.

Open ##3134772
@cifvts@mastodon.uno 2024-01-18 12:56

@WPalant@infosec.exchange Hmmm... I guess I will answer with this next time I get an incredible job opportunity from Germany...

Open ##3134792
@darren@c.im 2024-01-18 13:16

@WPalant@infosec.exchange The developer should have been judged by a jury of his peers.

Open ##3134796
@jesterchen@social.tchncs.de 2024-01-18 13:44

@WPalant@infosec.exchange And we've had this discussion ad nauseam in the past: if you circumvent any protection mechanism, no matter how stupid, it's bad for you. So deCSS is basically illegal in Germany, even though this wouldn't count as any security "best" practice. Also, programs that can be used to take part in computer crimes, may not be produced, distributed, downloaded or possessed in Germany - if it's the only purpose of that tool. So either forbid notepad or add a funny feature to such tools. 🙄

Open ##3134801
@sleepybisexual@fearness.org 2024-01-18 13:48

@WPalant@infosec.exchange for every country that makes a law like this, blackhats work getsveasier and easier

Open ##3134803
@anthropy@mastodon.derg.nz 2024-01-18 13:51

@WPalant@infosec.exchange I think we should actually ban judges and lawyers that don't know how computers and software works, from making judgements about these areas. This is absolutely ridiculous, it's like accusing a customer that walked into a store full of illegal wares and gently told the store owner that this might not be a good idea, that they were stealing these wares and breaking into the store. it literally couldn't be more backwards

Open ##3134804
@phurd@infosec.exchange 2024-01-18 13:52

@WPalant@infosec.exchange A protection mechanism isn't circumvented when used as intended. The vendor supplied credentials to their customers with the specific intent for them to be used. German judges are morons

Open ##3134805
@jabgoe2089@hub.netzgemeinde.eu 2024-01-18 14:01

the enterprise that initiated this lawsuit is called Modern Solution GmbH & Co. KG. it resides in gladbach in germany.

Open ##3134806
@hamato@mastodon.social 2024-01-18 14:16

@WPalant@infosec.exchange I remember when they introduced the "hackerparagraph" and it basically criminalized "owning hacker tools" like nmap or Wireshark. Is that still the way it is? I haven't paid attention to that special palace of German lawmaking incompetence in a while.

Open ##3134807
@techtraveler@mstdn.social 2024-01-18 14:25

@WPalant@infosec.exchange I mean the learning for the guy who discovered this vulnerability is that he should not have revealed it. Which is quite sad to say the least.

Open ##3134810
@robinsyl@meow.social 2024-01-18 14:31

@WPalant@infosec.exchange guy gets sued for doing his job????

Open ##3134813
@varbin@infosec.exchange 2024-01-18 14:45

@WPalant@infosec.exchange From the article I read that the judge is actually on the side on the defendant, but does have no other option - the law currently states this. Possibly the judge hoped that a higher court can make a precedence. This would not be the first case where the judge and the defendant agreed on a (very) mild sentence to allow a revision/appeal to create ruling by a higher court.

Open ##3134814
@felix@dom.ke 2024-01-18 14:49

@WPalant@infosec.exchange "Auch wir fanden bei einer Untersuchung entsprechender, frei im Internet zugänglicher Binärdateien der Firma Modern Solution, Passwörter im Klartext." Let's just hope nobody else does something illegal here. That would be very bad. Please don't break the law, and please don't post anonymously about the result for the lulz, and especially, please do not use TOR or something similar when not doing so.

Open ##3134815
@ar1@mastodon.social 2024-01-18 14:57

@WPalant@infosec.exchange Deutschland macht wieder Dummheiten.

Open ##3134816
@zebibyte@mas.to 2024-01-18 15:03

@WPalant@infosec.exchange that’s f-ed up!

Open ##3134817
@StineD@kind.social 2024-01-18 15:10

@WPalant@infosec.exchange Something similar happened in Denmark. Dad noticed that he could access information private information about other students at his kid's school's website. He reports it to the devs and gets sued for hacking. He was initially found guilty, but that was luckily reversed by a higher court.

Open ##3134818
@SiteRelEnby@tech.lgbt 2024-01-18 16:21

@WPalant@infosec.exchange Honestly, completely unsurprised it's germany, the country that ripped out all its clean energy and replaced it with coal...

Open ##3134819
@ErickaSimone@mastodon.social 2024-01-18 16:31

@WPalant@infosec.exchange ayoooooo @hko@mastodon.social take a look and holler at me please.

Open ##3134824
@gooba42@mastodon.social 2024-01-18 16:40

@WPalant@infosec.exchange So in Germany at least, we explicitly prefer the black hats find and trade on the vulnerabilities first?

Open ##3134827
@pivot@infosec.exchange 2024-01-18 17:20

@WPalant@infosec.exchange If I understand right, the developer found hard coded credentials being used to connect from his instance to the vendor. I think at that point, he has no reason to believe that using those credentials will give him access to anything other than his own data. As soon as he saw otherwise, he backed out and did responsible disclosure. Two thoughts: This will have chilling effects on responsible disclosure (perhaps the goal).If you give me the credentials needed to access a dataset, I don't think you should be able to claim the existence of those credentials as an access control meant to keep me out.

Open ##3134829
@WPalant@infosec.exchange 2024-11-09 08:51

And the second instance confirms the ruling. 🙄 There will be more instances but this is disappointing. Apparently, the matter of the publicly available password wasn’t discussed at all. It was all about illegitimate access to data, regardless of inadequate data protection. Guilty in the sense of the law. This law was about to be adjusted, defusing it for security researchers. Unfortunately, with the German government breaking up it’s unclear whether that change can still happen. It’s pretty much a given that the next government won’t be interested in fixing this issue. Source: https://www.heise.de/news/Modern-Solution-Berufungsgericht-bestaetigt-Schuld-des-Sicherheitsforschers-10007090.html

Open ##4369752