Can I have a cookie? A lesson in electronic law.

wbarnhill

Final Approach
Joined
Feb 26, 2005
Messages
7,901
Location
Greenwood, SC
Display Name
iEXTERMINATE
Home Airfield
KGYH
This is a long column, but I think it's a good one to present. Enjoy!

http://www.securityfocus.com/columnists/463/

"Mommy, can I have a cookie?"
"Sure, you can have a cookie, but you may not."
We all have had that discussion before -- either with our parents or our kids. A recent case from North Dakota reveals that the difference between those two concepts may lead not only to civil liability, but could land you in jail.
 
Stupid. Typical of lower courts. They had their DNS server setup to allow transfer. I see no problem in doing a transfer as they permitted it on a public facing service. I would not hesitate to do what they did.

Edit: Now that I read the article this guy went through way too much work to cover up his tracks. This makes it seem worse in my eyes--judge's too. It also appears that he probed the **** out of their network looking for things. This is a grey area--and isn't somewhere you should dance unless you have permission. He dug his own hole--and did it against someone that was willing to sue (very few people are for this sort of thing).
 
Last edited:
Stupid. Typical of lower courts. They had their DNS server setup to allow transfer. I see no problem in doing a transfer as they permitted it on a public facing service. I would not hesitate to do what they did.

And you could be in the same bad boat as Ritz. Just because it's there doesn't mean you have the rights to access it. If I leave my keys on a table it doesn't mean you're entitled to take them. If I leave my door open, it doesn't mean you're entitled to walk into my house. If you guessed my password on the first try (or otherwise knew the password), you're still not entitled to log into my account. It's pretty simple. Accessing something that was not meant to be accessed by you is wrong. Period.

A zone transfer was not intended to be used by David Ritz. He was not authorized to initiate such a command. If you want to try to be arrogant and test the courts on this issue, be my guest. :rolleyes:
 
And you could be in the same bad boat as Ritz. Just because it's there doesn't mean you have the rights to access it. If I leave my keys on a table it doesn't mean you're entitled to take them. If I leave my door open, it doesn't mean you're entitled to walk into my house. If you guessed my password on the first try (or otherwise knew the password), you're still not entitled to log into my account. It's pretty simple. Accessing something that was not meant to be accessed by you is wrong. Period.

A zone transfer was not intended to be used by David Ritz. He was not authorized to initiate such a command. If you want to try to be arrogant and test the courts on this issue, be my guest. :rolleyes:

Sigh... There is nothing illegal about doing a zone transfer. If the server is configured to permit it--you get it. If it is not--you don't.

If I plug a server in, give it a public ip address, and place up a website at http://www.jesseangell.com/mycreditcardnumber and you happen to click that link on Google. Should this be a crime? No. It's the same logic.

This guy crossed the line with the constant port scans, misuse of the whois database, and pathetic attempts at hiding his identity. This is where he went wrong...Not the zone transfer.

If I was stupid enough to setup a DNS server that allowed zone transfers to anyone and someone did a zone transfer would I sue them? No--I'd slap myself for doing something stupid. This is what I would expect my employer to do too--slap me for being stupid. Not sue the guy that did the transfer.
 
Sigh... There is nothing illegal about doing a zone transfer. If the server is configured to permit it--you get it. If it is not--you don't.

If I plug a server in, give it a public ip address, and place up a website at http://www.jesseangell.com/mycreditcardnumber and you happen to click that link on Google. Should this be a crime? No. It's the same logic.

This guy crossed the line with the constant port scans, misuse of the whois database, and pathetic attempts at hiding his identity. This is where he went wrong...Not the zone transfer.

If I was stupid enough to setup a DNS server that allowed zone transfers to anyone and someone did a zone transfer would I sue them? No--I'd slap myself for doing something stupid. This is what I would expect my employer to do too--slap me for being stupid. Not sue the guy that did the transfer.

Failing to prevent something does not mean you allow it. Failing to lock my door on my house does not mean you're allowed to enter.

You cannot simply create new rules for the internet that basically says whatever you can do is A-OK. Even if someone is stupid/ignorant/lazy/etc when setting up a computer system, that fact does not take away their rights.
 
Failing to prevent something does not mean you allow it. Failing to lock my door on my house does not mean you're allowed to enter.

You cannot simply create new rules for the internet that basically says whatever you can do is A-OK. Even if someone is stupid/ignorant/lazy/etc when setting up a computer system, that fact does not take away their rights.

So you've never hopped on somebody's open wireless network?
 
Failing to prevent something does not mean you allow it. Failing to lock my door on my house does not mean you're allowed to enter.
Everyone knows that the intent of homeowners--is not that you go walking into their house. Do this in the wrong state--and you die.

wbarnhill said:
You cannot simply create new rules for the internet that basically says whatever you can do is A-OK. Even if someone is stupid/ignorant/lazy/etc when setting up a computer system, that fact does not take away their rights.

Administrators need to at least put some effort towards preventing things from happening that they don't want to happen. If they do not do this--you do not know if you are doing right or wrong.

William, you are a smart guy, think about this. Do you feel like you are doing a crime by clicking some link you see on a website that loads a page without authentication? Do you think you should be sued for this? No you don't think you're doing wrong unless you see something that suggests they don't want you to do it.

Think about this some more. Should I be considered a criminal for doing an A record lookup on a DNS server? Just trying to resolve an ip for a host name? Hell no. A zone transfer is the same damn thing.

Now if the administrator configures the server to DENY a zone transfer and I find a vulnerability that lets me go AROUND this to do it anyways--THIS should be illegal.
 
So you've never hopped on somebody's open wireless network?

That's irrelevant.

Everyone knows that the intent of homeowners--is not that you go walking into their house. Do this in the wrong state--and you die.

Administrators need to at least put some effort towards preventing things from happening that they don't want to happen. If they do not do this--you do not know if you are doing right or wrong.

William, you are a smart guy, think about this. Do you feel like you are doing a crime by clicking some link you see on a website that loads a page without authentication? Do you think you should be sued for this? No you don't think you're doing wrong unless you see something that suggests they don't want you to do it.

Think about this some more. Should I be considered a criminal for doing an A record lookup on a DNS server? Just trying to resolve an ip for a host name? Hell no. A zone transfer is the same damn thing.

Now if the administrator configures the server to DENY a zone transfer and I find a vulnerability that lets me go AROUND this to do it anyways--THIS should be illegal.

Surely you're not claiming the intent of the administrator at Sierra was to knowingly give sensitive network information to David Ritz?

A zone transfer is NOT the same thing as a DNS request for a particular domain. That's like saying "What are the names of all of your family members?" is the same question as "What is your name?" You're technologically savvy Jesse, you know there are obvious differences.

Of course, if you read the last page, you'll see what Mr. Rasch was driving at:

Under other circumstances, a court could easily conclude that the use of a particular command was, in fact implicitly authorized. Security researchers use publicly available and widely used tools to probe Internet accessible computers all the time. Courts in the future are likely to look both at the motives of these researchers and the impact of what they do in deciding whether or not their actions give rise to civil or potential criminal liability.
In David Ritz' case, it's obvious he was attempting to get information that the administrators at Sierra did not mean to allow him to acquire. Just because their systems allowed the execution of a command they shouldn't have, DOES NOT MEAN HE WAS ENTITLED TO THAT INFORMATION.

If you cannot realize the flaw in your rationale, nothing more I say will get through to you. I just hope you're never in a situation like Mr. Ritz.
 
Last edited:
That's irrelevant.

You're serious? How is that irrelevant? You clearly said...

Failing to prevent something does not mean you allow it. Failing to lock my door on my house does not mean you're allowed to enter.

Just because they failed to encrypt their network does not mean that they are giving you permission to use their resources. It is exactly the same thing that you are saying there is no excuse for.

I'm not saying that this guy was in the right. I'm just saying that maybe you could take a moment to consider whether or not there are times that you may do similar things...whether intentional or not. In this case, the intent was obviously malicious...but using a service in an legitimate manner (even if it wasn't intended to be legitimate by the person configuring the service) isn't as clear cut as you make it out to be.
 
Last edited:
You're serious? How is that irrelevant? You clearly said...

Just because they failed to encrypt their network does not mean that they are giving you permission to use their resources. It is exactly the same thing that you are saying there is no excuse for.

I'm not saying that this guy was in the right. I'm just saying that maybe you could take a moment to consider what you're really saying in trying to prove your point.

It's irrelevant because regardless of what I may or may not have done, it does not diminish the point that someone having an open network does not entitle you or I to connect to it. I saw it as an attempted deflection by saying "Oh, but YOU have done something similar!" which is not an argument. Also, even if 90% of wireless users have hopped onto an open wireless access point, it doesn't make it any more acceptable.
 
Personally I think that if the actions of Mr Ritz were illegal, surely the spyware installations like the Sears "Join the Community" campaign ought to be criminal. I'll bet the vast majority of participants had no intention of giving Sears or their marketing consultant a copy of all their internet transactions.
 
Surely you're not claiming the intent of the administrator at Sierra was to knowingly give sensitive network information to David Ritz?
How do I know the intent? Their administrator was too stupid to take the DNS 101 class you must have taken. I have domains that I could careless if someone did a zone transfer against and I have domains that I would be not happy. Guess what? I disabled zone transfer except from my secondary DNS server.

There are legit uses for downloading a zone file. Perhaps I want to know what all the mirrors are so that I can select a different web server. Perhaps I am having DNS problems and want to know everything in your application that I need to resolve and can't risk it not working and don't have the time to look for every query that happens to do them one at a time. Transfer your zone file, drop it into /etc/hosts, and go back to doing other things.

A zone transfer is NOT the same thing as a DNS request for a particular domain.
It's pretty similar. Neither require authentication, both are part of RFC1034 (and some others). Neither one is a secret to the world unless you make it so.

wbarnhill said:
That's like saying "What are the names of all of your family members?" is the same question as "What is your name?" You're technologically savvy Jesse, you know there are obvious differences.
Exactly.

Scenario 1:
Me: "What are the names of all your family members?"
You: "Bob, John, and Timmy"

Scenario 2:
Me: "What are the names of all your family members?"
You: "I cannot tell you that."
Me: *points gun at you, shoots you in the knee* "tell me or the next one goes in your head!"
You: Bob, John, and Timmy"

#2 is criminal, #1 is not.

If you cannot realize the flaw in your rationale, nothing more I say will get through to you. I just hope you're never in a situation like Mr. Ritz.
This applies to you as well. I deal with DNS day in and out and configure many zone files for many domains.

I know what is in the white area, I know what is in the grey area, and I know what is in the black area. I tend to stay deep in the white area. I don't feel like getting sued. But I'm not about to unplug from the internet for fear of stupid companies suing me.

Look William, I agree that this guy did wrong. What I don't agree with is where he did it. The zone transfers were OK. All the other probing he did was not.

wbarhill said:
It's irrelevant because regardless of what I may or may not have done, it does not diminish the point that someone having an open network does not entitle you or I to connect to it. I saw it as an attempted deflection by saying "Oh, but YOU have done something similar!" which is not an argument. Also, even if 90% of wireless users have hopped onto an open wireless access point, it doesn't make it any more acceptable.
Let me try and understand you. You think that a DNS transfer is wrong. You think that connecting to an open wireless access point without permission is wrong BUT yet you do it anyways??

I don't think either are wrong and that is why I would do either. I don't know about you--but I don't do what I think is wrong.
 
Last edited:
You cannot simply create new rules for the internet that basically says whatever you can do is A-OK. Even if someone is stupid/ignorant/lazy/etc when setting up a computer system, that fact does not take away their rights.

Yes we can, and should.

What we should NOT be doing is holding onto dynastic and aged thinking in the legal world and constantly trying to apply physical-world thought/analogies to the electronic world.
 
It's irrelevant because regardless of what I may or may not have done, it does not diminish the point that someone having an open network does not entitle you or I to connect to it. I saw it as an attempted deflection by saying "Oh, but YOU have done something similar!" which is not an argument. Also, even if 90% of wireless users have hopped onto an open wireless access point, it doesn't make it any more acceptable.

Again...quit applying physical-world thought to the electronic world.

If you create an open network, say wireless, you had better expect people to come on in. Hell Windows AUTO-FINDS networks and connects to them!
 
Isn't this all sort of like thumbtacking a 15 page document to a bulletin board in a hallway, but complaining because someone read what was on page 9??
 
This is a tricky one... And while I agree with the court's decision in this specific instance, it really emphasizes how important competent administrators are not to just their own organization, but lots of people elsewhere.

The open wireless AP example is a fairly reasonably analogous one: It comes down to what a person can reasonably assume to be intended as public, and what a person can reasonably assume to be intended as private -- irrespective of whether the resource in question is accessible or not because at the end of the day, as any security pro will tell you, everything is accessible. If I see an open AP somewhere, I have zero qualms about hopping on it. Why? The administrator of that AP may very well be just like me, and may have it open on purpose. But what I do with that AP is where it becomes important: Surfing using it? Fine. Trying to snoop around on the AP's private network? Not fine. (Which, coincidentally, is why I have my publicly accessible wireless network in my home network's DMZ.) The AP is public, and it's reasonable to assume that using it for "public" purposes like surfing is acceptable. It's not reasonable to assume that using it for "private" purposes like reading somebody else's email -- or even figuring out the internal IP of their mail server -- is. It's a nebulous area, for sure. But misuse is just like indecency: It may be hard to define, but I know it when I see it, and though it pains me that a spammer won, it's my view that Ritz crossed that (somewhat fuzzy at times) line in this case.
 
Last edited:
There are no absolutes here, this is all about judgement.

In my mind, the conventional view of the purpose of a DNS server is much like a web server, it is a source of information to anonymous, public users. There is simply no "expectation" of privacy in this information. If the operator wishes to deploy a DNS or web server with restrictions to access, it is incumbent upon him to enact that, but there is no expectation from the user that this restriction is "implied".

In years past, the only sensitivity to pulling down a zone transfer had to do with incurring load on the server, if it was done frequently, which wasn't really a concern for any servers other than the root servers.

Some time around the mid 90s, people started building firewalls, and some got the notion into their head that DNS data should be kept secret. This is a mostly wrong-headed notion, but one of the lesser ones as regards security. Those who got this notion generally achieved it by maintaining separate external (to the firewall) and internal servers, limiting the information present in the external servers to information intended for access to the public, and putting the "private" stuff on the internal servers, and having the firewall prevent access to the internal servers from the outside world.

As time goes on, the community gets larger, and the average brain size of administrators decreased, which is how you find yourself in a world where you have DNS servers that will gladly offer up information considered "private" to anybody who asks, but only if they know what to ask for. We're quick to call them idiots for not restricting zone transfers, I'm not sure why properly restricting zone transfers would repeal this label.

Now, a wireless access point and the internet connection to which it provides access, certainly does _not_ have the expectation that it is there to provide a public service, not any more than an unlocked car with the keys in it is public transportation. Use of an unprotected access point is clearly being "naughty", we know this, we just rationalize the behavior because we'd rather think of ourselves as good people, instead of the opportunistic douches we really are.
-harry
 
Now, a wireless access point and the internet connection to which it provides access, certainly does _not_ have the expectation that it is there to provide a public service, not any more than an unlocked car with the keys in it is public transportation. Use of an unprotected access point is clearly being "naughty", we know this, we just rationalize the behavior because we'd rather think of ourselves as good people, instead of the opportunistic douches we really are.
-harry

I agree with everything else, right up until this point (thread creep alert).

The analogy doesn't work, for one thing... Everybody knows that a car with the keys in it belongs to someone; it's just common knowledge. With an open AP, there's no way of knowing whether the person on the other end of it is like I presume my neighbors are and just don't know any better than to leave it open, or whether the administrator is like me and several other folks I know who leave it open (in their DMZ or outside their firewall, of course) on purpose. Outside of giving it a name like "FREEWIFI" or some such (which I don't... "linksys" for mine), there's no hard and fast means -- other than it being closed up -- by which to distinguish public from private.

Do I wonder if the APs I connect to are meant to be open? A little. But I have no way of knowing for sure. Is that opportunistic? Maybe, maybe not. Say I live in an apartment above a coffee shop that offers free, open wifi for its customers. Is that opportunistic too? Maybe, maybe not. But even if either of those are, it's a far cry from taking somebody's car.

In any case, absent any form of malice or attempt to gain private information, I don't see how anybody could possibly consider using an open AP an actual crime; it's akin to walking on somebody's lawn, 2 inches adjacent to the sidewalk. No harm, no foul.
 
...Everybody knows that a car with the keys in it belongs to someone....
What percentage of open access points do you believe are intentionally open, as an invitation? While it's always a possibility that an open AP is intended as an invitation, I'd argue that this likelihood is quite small, and thus it is not the correct assumption to make.

It is no different from the car with the keys inside. Based on our understanding of our "societal norms", we understand that the probability that somebody has provided this car for public use is quite small, so while it is possible that the owner has this intent, we cannot use this possibility to justify an assumption, given the low probability of that assumption being correct.

Whether using somebody's access point without permission is a crime or not is a legal argument, and it doesn't seem like we're arguing specific laws in this conversation.

If, instead, what you mean is "it shouldn't be a crime", then I'd argue that it is easily justifiable as a crime. My internet access is a finite resource, I pay for that resource, and the cost to me is commensurate with the capacity. When you use that resource without permission, you're consuming some of that capacity, which can result in reduced availability of that resource for my usage. That sounds a lot like the premise of theft, to me.
-harry
 
What percentage of open access points do you believe are intentionally open, as an invitation? While it's always a possibility that an open AP is intended as an invitation, I'd argue that this likelihood is quite small, and thus it is not the correct assumption to make.

It is no different from the car with the keys inside. Based on our understanding of our "societal norms", we understand that the probability that somebody has provided this car for public use is quite small, so while it is possible that the owner has this intent, we cannot use this possibility to justify an assumption, given the low probability of that assumption being correct.

What percentage? You're right, it's probably significantly less than 50%. But it's also a heckuva lot more than the percentage of cars with their keys left in them for the purpose of being used. And as I say, there's no way of knowing for certain whether an AP is open on purpose or not, and the likelihood of it being free is much, much higher than the analogy of the car.

A better analogy: Say you're walking down the street, and you happen across a stack of brochures or coupons or the like sitting outside the door of a convenience store. There's no way of knowing if somebody left that stack there to be taken freely by people, or if maybe a delivery guy just left them there for a minute while inside. It's the inverse of the car example: Certainly most things like that are there for the purpose of being taken. But how can you be sure? Applying the same logic you apply to APs, lacking something specifically denoting them as free, one must assume they're not, despite the fact that they're not locked in any way.

Another analogy is the bowl of candy on somebody's desk. Most of the time, people leave it there to share. But how can you tell for sure? You'd have to ask, and with wifi, that's next to impossible: Of the half-dozen or so APs visible from my apartment, usually 2 or 3 of them are open... But I don't have anyway of figuring out who they belong to and subsequently asking for permission.

Whether using somebody's access point without permission is a crime or not is a legal argument, and it doesn't seem like we're arguing specific laws in this conversation.

If, instead, what you mean is "it shouldn't be a crime", then I'd argue that it is easily justifiable as a crime. My internet access is a finite resource, I pay for that resource, and the cost to me is commensurate with the capacity. When you use that resource without permission, you're consuming some of that capacity, which can result in reduced availability of that resource for my usage. That sounds a lot like the premise of theft, to me.
-harry

Again, it all comes down to using one's own judgment. But, just as with the coupons or candy above, I just don't believe that using someone's open wifi amounts to a real crime. For me to really commit theft, I have to have a reasonable belief that what I'm taking isn't being freely offered up for the taking. With open APs, that's virtually impossible.

And none of that is to even mention that a lot -- if not most -- people's PCs will automatically connect to an open AP if it sees one. Surely you can't call it theft if I open up my laptop somewhere and it hops on your network automatically. Can you? If so, who's at fault then? Me for not more responsibly configuring my laptop to keep it from "stealing" Internet service? Or you, the AP administrator, for not more responsibly configuring their AP to keep it from inviting laptops to connect to it, literally inducing a "theft"?

Edit: I am trying to be a bit of a polemic/devil's advocate here, for sure. I can see calling it a crime... just not a very serious one. Given the stuff I outlined above, and the fact that somebody can do it completely unwittingly, I just can't bring myself to consider it that egregious a transgression, even though I've rarely (if ever, that I recall... haven't every really had the need to) done it myself.
 
Last edited:
The courts findings were flawed. It used a composite of facts submitted by both parties and we all know there are three sides to each story. Ritz's story is he did nothing wrong. Reynolds story is that Ritz violated his computer systems. I suggest there is a third story, more closer to the truth, to all of this. Without knowing the evidence submitted, it would be hard to determine who is right (or more right).
Back in the 80's, whois, finger, host, ftp, etc, were THE ONLY WAY you used the internet. It was driven by line commands. Just because the tools have changed, doesn't mean the old ones do not work or are any less used. Intelligent users will continue to use the network as it was originally. Just because your only view is a webpage or an email, does not mean that is all there is. If you put your computer on the network, it is up to you to take adequate protection.
With respect to wireless access points, I think MOST are improperly set up by users who do not know the difference. Worse, we have ISP providers setting up customers wireless APs without appropriate security. In general, with the proliferation of personal computers and personal networks, the manufacturers have dumbed down the average intelligence of the internet. Most PCs and APs are shipped by default open systems. Users need to know how to employ basic protection (houses with door and window locks).
Again, if you put it on the world wide GLOBAL network, you need to take adequate protection. If you do not, it's your fault.
And a looksee using common system tools does not constitute theft of service, trespassing, or a breach of privacy.
 
The thing is--a DNS zone transfer is even more innocent than connecting to an open access point.
 
I believe there was a case or cases a number of years ago where the (successful, IIRC) argument "Welcome to ____ " fill in the blank of the o/s - at the time I believe it was VMS ... was in fact, permission to access and use the systems. I recall a lot of welcome screens got changed way back then ...
 
I'm curious. Is this David Ritz the man of the same name who owns the largest camera store chain in the United States(somewhere over 1100 stores coast to coast)?

HR
 
I'm curious. Is this David Ritz the man of the same name who owns the largest camera store chain in the United States(somewhere over 1100 stores coast to coast)?

HR

I thought so too, but no. Not the same guy.
 
Back
Top