Hacker News Reader

Hacker News

Comment by neilwillgettoit | Hacker News Reader

Parent Full thread

neilwillgettoit

This is how you get sued and/or arrested.

View on HN

Yeah, this crosses the line from "PoC" to "active exploit tool". Folks have gone to prison for less.

I am literally just parsing the output of the original PoC.

I get that, but the purpose of the script is now explicitly "steal user sessions" rather than "proof-of-concept".

I wouldn't convict you, but if someone used this tool in a breach that was embarrassing enough to the right person, I don't think a prosecutor would have a very hard time convincing a judge that you were an evil hacker writing evil hacker tools.

Do you have the same feelings about the Rapid7 team? What about the guys at Tenable? Heck, the Offensive Security guys are making an entire Linux distro that is nothing more than "evil hacker tools". Surely there are countless crimes committed with their software. Do you believe that all of them are in the wrong.

I am not an exceptionally gifted programmer. This is a trivial change to the original PoC to point out an additional attack vector. Pointing out that there is more to this attack than leaked private keys is very important.

The line between whitehat pentester and blackhat cracker is very thin, of course. They use the same tools and the same techniques; the differentiating component is intent and target.

The title of your post is "Using Heartbleed PoC for Hijacking User Sessions En Masse". Not "Your users' sessions are at risk", or "Heartbleed affects more than private keys". The express intent of the published code is the theft of user sessions. I know that you probably don't have any intent to do Bad Things with it, but if I was a prosecutor looking for someone to slap around with the CFAA, you just threw up a giant neon "SUP BITCHES" sign.

The folks you mentioned all produce tools which are intended and marketed for use by white-hat security professionals in the pre-emptive exploitation of their own networks for the purposes of security. Yes, we all know that the Bad Guys use Metasploit extensively to find and exploit machines, but if Rapid7 were positioning their tool as the premiere solution for pwnz3ring b0x3n, you don't think they'd be in a legally different situation?

I never said you were wrong. In fact, my exact words were "I wouldn't convict you" - I really do get why you published this, and I don't think you're some bad guy cackling to yourself from deep within your evil lair or anything. However, we know from recent history that things less gray have (unjustly, IMO) in fact landed people in prison. It's not illegal to own a crowbar or lockpicking set, but it's illegal to own one with the intent to commit burglary. Intent matters, and they way you positioned your PoC is problematic in that its stated intent is "mass hijacking", rather than "demonstration of an additional security problem". I am not trying to say that there's anything wrong with the code you've published - there isn't - but that the way you've presented it is potentially problematic if it were to attract the wrong kind of attention. That's all.

You did the right thing. I know very little about exploitation- I have to pay someone else to learn about things like this and fix it for me. This makes the time taken to do that much shorter for me and others like me. So thank you thank you thank you! Do you have a "donate" button somewhere?

Collecting the session IDs is not illegal, but yes, using them would be.

(but of course courts have sent people to jail for much less...)

Collecting session IDs through an OpenSSL exploit certainly sounds like unauthorized access† to me, so I wouldn't be so quick to say it isn't illegal.

† http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

Which only applies if you were to do it to systems that you aren't authorized to use it against. Simply creating and testing the code on your own servers is far from unauthorized access. If it were anyone who had posted any PoC code would have been liable for anything that happened with their code.

You seem to be talking about something different from what sullivanmatt and I were talking about. He said that collecting session IDs is not illegal, but posting them would be. That is the statement with which I was taking issue.

At any rate, it certainly doesn't seem correct to say "it isn't illegal" as a blanket statement.

I was referring to calling it unauthorized access. If I do this to my own machines, which is how I wrote and tested this code, then it is entirely authorized.

I would agree that collecting session ids on systems that you do not own or have legitimate access to is almost certainly illegal.

I think his statement strongly implied that he was speaking about session ids of site he doesn't own. If you own the site, saying that "using the session ids would be illegal" is a stretch, at least without qualifiers. So, pretty sure he was talking about other people's sites.

Reply on news.ycombinator.com