It's not similar at all.
The key (connection string) was already given to him via the app and he was entering the house (database) on a regular basis.
This would be like mistaking a door for the bathroom but find a closet full of gold instead.
The key (connection string) was already given to him via the app and he was entering the house (database) on a regular basis.
This would be like mistaking a door for the bathroom but find a closet full of gold instead.
He literally opened the application binary in a text editor to look for clues (despite the fact that there are common tools like `strings` for this) and saw the credentials, and since he'd been specifically hired to fix a problem with the database, he used those credentials to connect to the database. `SHOW DATABASES` would be a perfectly normal thing to type at this point, and apparently once he saw that these credentials granted access to everything he immediately stopped and logged out.
If his lawyers had been better this would have never made it to court. Liability should have fallen on the contract customer, but for certain the design of Modern Solution's software and application were nothing short of wildy irresponsible. If they really face no risk for this, it's time for all German companies to start contracting firms in other countries where idiots aren't allowed to leave thousands of customers data exposed to the first schlub who happens to notice them.
I don't think we can otherwise know for sure the company's intentions. If I leave the front door to my house open (or if I tape the key to the outside of the door, to further strain the physical key analogy), is it my intention that people just come on in? We have no idea.
Oh, but this is a food truck that he’s been visiting on a regular basis so obviously he’s allowed to go in the back door, with full access to all the ingredients and poking around inside the cash register?
Also, if you take someone else’s gold behind a door you unlocked with a key that isn't yours, it is called stealing.
Nothing was "under the mat" since he was already using his PC to connect to the database with those same credentials.
> if you take someone else’s gold behind a door you unlocked with a key that isn't yours, it is called stealing.
Nothing was stolen, he informed the vendor of the issue immediately.
Wouldn't that account as reverse-engineering, which is often also illegal?
It may not be totally akin to a security card opening more doors than it should, but it is entirely reasonable to assume that "the key in your copy of the app" is "your personal access key".
I've never been in a situation where I was given an app binary as a user but where the author intended for me to go find a key in the decompilation so that I could manually access information that wasn't visible in the app.
This seems like it is an unreasonable thing to assume. And courts seem to agree.
Illegal vs legal and reasonable vs unreasonable are not entirely analogous.
There are lots of laws that I think are unreasonable and a lot of legal things that I think are unreasonable.
That you favor one argument over another as your lens with which to side when it comes to really stupid analogies, including mine, is entirely in bad faith.
What is you plan if you disaggre?
He was charged for connecting to a database with credentials that he was already connecting to before with the application. I could argue that he already had access to the other data because the connection allowed it.
So, that begs the question: what did he actually "break" into and how is it different than connecting to the database via the app on the same PC? Would you even be able to tell the difference as a sysadmin looking at logs?