It may be ILLEGAL to run Heartbleed health checks – IT lawyer

Re: Authorised

It's authorised if it's GCHQ doing the scanning. That's all you need to know ;-)

Re: Authorised

I believe this is covered by 3.1 (b) "at the time when he does the act he knows that it is unauthorised."

So I believe the correct answer is 'any of the above'.

Re: Authorised

I've always wondered that. e.g. If someone called me asking for a penetration test to be performed on their network, signed all the normal contracts etc. Then turned out to be either someone without the proper authorization, or someone completely unrelated to the company .. Who would be liable! IS there a precedent for this sort of thing?

Re: Authorised

The person doing the scanning needs to get the permission of a legal representative of the company - that means somebody who is authorized to speak on behalf of the company, in legal terms, not just any old employee.

Most companies have such things defined - I'm not sure how it is in the UK, but probably they have to be registered at Companies House as the speaker? Certainly only one of our directors (here in Germany) is allowed to speak "on behalf of the company."

There is a definition of "authorised" scanning.

This is in the case of third party penetration-testers, so they can go about their business without being misidentified as some 'l33t haxxxor' and put in the slammer for it.

Re: Authorised

Would the NSA be authorized to scan? Perhaps we can convert it into something useful... scan the whole world for SSL bugs.

Re: Politicians....

"the next thing there'll be a law making Reality illegal"

The next thing? They already do this, all the time, based on their ideas of which particular junta is currently governing our green and pleasant land.

Re: Thats the problem

They aren't overpaid the are just evil and on the take

Re: Thats the problem

>>"They tell you what you can't do, not what you should do"

Actually I'm fine with laws being based around forbidding certain things, rather than forcing new behaviour. All else being equal, the latter has far more potential for abuse and is a lot of coercive.

Re: Thats the problem

Any law that does not protect the people, is tyranny.

Re: Thats the problem

> With laws

In England, the set up is that everything not forbidden is allowed, though I understand its often the other way around in foreign parts.

Actually the UK is getting much worse with overly broad laws apparently specifically designed to ensure that everyone breaks the law and then the powers that be can just pick and chose whom to prosecute.

I guess it goes back to "is it a feature or a bug?" It looks like a deliberate breach of privacy policy to me! ;)

Couldn't you go short a byte too? I'll admit, I'm going based on the XKCD explanation here... but if you were requesting lets say 10 bytes, but set the length to 5 bytes, you'd know the bug works, right?

Re: What is the purpose of checking another site ?

Disclaimer: I did not read the relevant acts before writing this.

Ignorance of the law is no excuse, especially when there are targets to be met.

Re: Dodgy website admins

"Surely the website admins are running dodgy vehicles on the super highway and should be treated the same?"

An interesting analogy, but how far do you take it and where does it end? With you, because your home PC is an unwitting member of a Botnet after you neglected to install those updates after the last patch Tuesday? Extraordinary rendition for Windows XP users, maybe?

Re: Dodgy website admins

Certainly under German law, if your serverhas poor security and somebody uses it to cause damage on other servers / PCs, then the server owner is responsible for reimbursing for the damage caused. You can only hope that you can prove you aren't the end of the chain...

Re: Dodgy website admins

If I'm driving ... a dodgy car...I'm ... liable...Surely the website admins are running dodgy vehicles on the super highway and should be treated the same?

If I kill a person, I could be guilty of murder. If I kill, a process...

What's the tarriff for flogging an analogy?

Re: Dodgy website admins

IANAL but.....

To answer this in terms of your analogy. If your brakes fail because you have mistreated them or not maintained them then that is your fault. However if your brakes fail due to a design flaw from manufacture then really it is the manufacturers fault.

Server operators were using OpenSSL in good faith, they had no reason to expect this vulnerability.

Of course now they are aware of it, it becomes their responsibility.

Also, liability prior to the fault being known will likely vary by jurisdiction and by whether the claim is criminal or civil. In some cases particularly civil ones the owner of the faulty equipment would be liable, and then in turn have to sue to the provider of the faulty component, in other cases the owner may be able to pass liability directly off to the supplier.

Also in another quirk of law, if for instance you killed someone in your car due for example the brakes failing and the throttle locking full open due to an unannounced manufacturing fault, you would in most jurisdictions I believe be open to a criminal prosecution for murder/manslaughter/causing death by dangerous driving (depending on particular local statutes). However if it was known to be caused by a manufacturing fault the authorities would likely not pursue a prosecution or if it went to trial you might find a judge would give a directed verdict of not guilty.

Re: Dodgy website admins

If it turns out that your car, along with others of the same model, have a hidden design fault that causes brake failure then you're probably OK provided you don't know about it until after the event. Once you know it might be a problem, liability is yours if you don't get it fixed pronto.

Trusting trust

> I don't necessarily trust them to come clean

Yet you trust the results of some website's online scanner - that checks a third party's website and tells you it's clean (or not)?

The basic problem is that you can never tell what someone else's scanner will actually do. If it does find a vulnerability, will it truthfully notify you, or will it say "yup, that's fine" and as soon as you log in, run the hack and snarf your login details - or add that site to a list of known vulnerable sites and then sell it on?

The only people who have a genuine interest in securing a site is the site owners. So provided they can supply the requisite credentials to demonstrate they are "clean", there should be no reason to run your own tests. Especially when you cannot be sure the tests are valid, or legitimate.

as Alan Parsons once wrote:

If we call for the proof and then question the answers, only the doubt will grow

Re: Would it contravene the Computer Misuse Act?

Unfortunately that case law predates RIPA.

Re: We'll be needing more prisons, then

It will just be used when the police cock up. If they arrest somebody because they believe they have pirated software or child pornography and it turns out they don't a quick internet history search will give them something to prosecute for so they don't look bad.

As I understand it that's why laws are left nice and loose and open to interpretation -- so that everyone is guilty of something if needs be.

Re: Section 3?

Do they actually need to run the exploit? Is the information not in the SSL headers? Just look at the Calomel plugin, that pulls all sorts of information back about the server's SSL behaviour. Whether the SSL library version is returned, I don't know.

Although some checkers are lazy / not checking properly, LastPass reports Microsoft's servers as unkown SSL library, could have been affected.

Edit: Thinking about it, if they get that it is 1.01 to 1.01f, they might have to test to see if the heartbeat is switch on.

It is possible to scan for Heartbleed without accessing anyone else's data:

https://twitter.com/ivanristic/status/454515948553129984

re: Amazon

Almost certainly there is something in the contract along the lines of "we are not liable for anything ever, even if we haven't though of it yet, and any laws don't apply to us, so there".

Probably like renting property, the landlord reserves the right to check the building from time to time, to ensure it isn't being used for illegal activity or that you aren't lighting bonfires in the middle of the lounge (yes, I have seen that in some rented properties!).

Re: software should be updated to use the new version, 1.0.1g.

Why couldn't they have bumped it to 1.0.2 to make it clearly a new version?

Re: Maybe?

I was due to make an online payment so I diligently checked that the website I need to use for said online payment was secure before making payment.

No?

As any fule kno you have to append #innocent face to the packet headers for that defence to work

Re: they are after all exploiting a flaw to return 64KB of unauthorized data

There's no need to access more than a few bytes of data to check if the vulnerability is present.

Re: Anyone heard from a server admin anywhere yet?

Yes, several. Colour me pleasantly surprised.

The first I actually heard of this was from a charity book store run by the Brotherhood of St Lawrence*. Over 24 hours I got a warning that the server was going down for patching, an explanation of what was patched and finally a suggestion that I change my password ASAP.

My bank had a notice at log in with 24 hours of the announcement explaining why it wasn't an issue for them - and in surprisingly technical terms, clearly not written by the PR department (no crayon or drool in sight).

A couple of "community" type forums. I suspect they all run the same version of vBulletin.

But notably missing in action are any of the household names.

* I was going to make a joke about molesting little boys but removed it as I think they are to be commended on this one.