Is It Illegal To Test A Website For Exploits Regarding My Personal Info? American here. I'm not a hacker or anything, just a normal computer science student. Anyways, I believe that my university has left an exploit open through their hub where anyone can use the modular apps to gain access to your: Last 4 digits Of SSN, University ID, and possibly your password. If I were to test the exploit by only using the public interface they provide, on myself, would this be considered illegal? I would need to use a selenium script to automate attempts on finding the last 4 digits of the SSN - because it appears the database doesn't have a limit on how many attempts you can make. Of course I would be trying to gain access to my own data, not anyone elses. Oh and of course I would tell the Uni that this was a problem. I just didn't want to message them for nonsense.
In a narrow sense, since you are a student at the U, you are bound by a contract you signed when you registered for classes. Read it, and you'll probably find a clause or two that states that you are not allowed to abuse, script, attempt logins or otherwise use the computer systems in any way other than typical, day to day use. The U's recourse is to kick you out and possibly take you to civil court to recover damages, and possibly refer you to the local county attorney for criminal charges, depending on the existence of criminal statutes for computer access in your jurisdiction. In a broad sense, pentesting can be either a civil infraction or a crime, depending on the terms of service for the system you are trying to exploit, what exactly you do, the jurisdiction, etc. See State Computer Crime Statutes and Federal Computer Fraud and Abuse Act - Wikipedia. See also LE answer When is a permission required to attack a system?
You can't own a database; you might, however, own (have) the copyright to a database if you created it or the creator transferred that right to you. You can also possess a copy of a database: the question is whether it is legal. "Leaked" implies that it is taken without permission, so you might be in violation of copyright law by possessing a copy. The only databases that would escape copyright protection would be those US government works, things put in the public domain, and things publically licensed to allow copying. Plus, any database whose content fails to exhibit a modicum of creativity (Feist). A database might be inherently illegal (at least in your hands), so it would depend on what the content is. The first thing that comes to mind is a database from a child-porn website, which contains numerous illegal images: see section 110 of Title 18. "Leaked" information might involve violation of 18 USC 1030 (Computer Fraud and Abuse Act), which prohibits unauthorized hacking. It does not directly prohibit being in possession of a hacked database: but you might still be prosecuted as an accessory after the fact. (That is one of those ad libitum areas of the law where there's no way to know for sure what is and is not "okay"). If they do prosecute you, you might rely on Bartnicki v. Vopper, 532 U.S. 514, where because it was a matter of "public interest", propagation of illegally obtained material was held to be protected by the First Amendment. Also there is the case of the Pentagon Papers. At the federal level, there are no controls over storing credit card information so if you get a copy of the Target or Home Depot hacked database, there's no federal law against that (if we discount "accessory after the fact"), but there are circumstances in Minnesota where retaining such information could be illegal.
It seems like some law must have been breached during the sharing of this information? Possibly, even probably. The scrutiny of your personal account in order to glean personal data (your IP address) and then using that personal data to match accounts may contravene Recital 50 of the GDPR: The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. If the website terms which you agreed to don't include this data matching, then that processing is not lawful. The rest of Recital 50 is relevant and worth quoting in full: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations. It seems to me that an anonymous account could reasonably expect that the &quot;further processing&quot; of data matching is not in the public interest, an exercise of official authority, scientific or historical research or statistical. There is no link between the data matching exercise and the purpose for which IP addresses are normally collected: the operation and physical security of the website. Now, it may well be that the website terms do allow this data matching to discover links between accounts, or in any case prohibit having two accounts and allow reasonable methods to discover such links. It's also possible that a court has ordered the processing (as Iñaki Viggers has mentioned. We don't have that information; but ostensibly one wouldn't normally expect a personal account to be examined in this way, and certainly wouldn't expect any link discovered to be relayed to a third party.
TL;DR In theory there's nothing wrong with your method, it's just a way to authenticate the user, and without authentication a user has no right to request anything anyway. But in practice it looks like your method doesn't have a way to deal with situations where users lose or forget their authentication data and want to be able to recover their account. Failing to deal with that in a modern system might be considered an unacceptable bad practice and so be against the GDPR principles of security and privacy by design. EXTENDED VERSION I might be wrong or not understand the question correctly, but I don't see how this is different from many other common cases where encryption is not involved. Think about it, you aren't able to give the user their own personal data unless they provide the ID and encryption keys. How is this significantly different from the fact you aren't able to (or rather you should not) show a user their own data unless they provide their own username and password, or they convincingly authenticate themselves in any way? Just like you can't ask Facebook to show you all the data collected about Donald Trump only by claiming you are Donald Trump, you can't be required to give a user their own data unless they provide the encryption key. It can be seen as your way to authenticate users (among other things). Edited: multiple IDs/keys I didn't understand your method involved multiple IDs and keys. In theory, the situation is still the same, only with multiple pieces of data for authentication, like the user had to remember multiple usernames and passwords. Failing to provide all IDs and all keys will result in a partial authentication. But with such an approach a potential problem becomes more evident: your authentication scheme might be against the GDPR principles of "security and privacy by design and by default". Basically, your methods might be considered bad practice because they fail to deal with the common issue of lost or forgotten passwords. If a user tells you they have lost a USB drive containing all their IDs and keys and they don't have them anymore, what do you do? You can't delete their data because you aren't able to know what their data is, without another way of authenticating. And their data is now at risk, because somebody else might have their IDs and keys. If you had an email address associated with all the user's IDs and data, then you might be able to confirm their identity (for example sending an email with a link) and delete all their data. As you see, things can get pretty complicated, it all depends on the details of your implementation, and just adding or removing one detail might change the whole scenario.
You haven't suffered a legally cognizable harm because you got your money back, before you even had a chance to complain, so you have no basis for a lawsuit. For what it is worth, pretty much every adult in the United States was affected by the Equifax breach. Also, usually Equifax wouldn't have had access to full bank account numbers in the first place, so that is an unlikely source of the problem. You could open a new account and close the old one (as suggested by @mkennedy in the comments) because then if anyone had access to your bank account number and was abusing it, they could no longer do so. The fact that it only happened once rather than involving many transactions, which is what you commonly see when there is a true identity theft, however, suggests a more benign possibility. There is a pretty good chance that this errant transaction which was reversed was simply a clerical error involving an inaccurate typing in of an account number that got your number instead of the intended one and was reversed when the money didn't leave the intended account (in contrast, identity theft incidents are almost never reversed without a complaint from the account holder). In other words, this may have simply been the banking equivalent of dialing the wrong number by mistake. If this happens again, you should definitely shut down the account, but so far, it seems more likely that this was a one off clerical error. Humans are just not built to input scores of fifteen digit numbers on a daily basis in a 100% accurate fashion. As long as this job is in the hands of humans rather than computers or robots, the humans are going to make mistakes.
Yes (in most jurisdictions), but why should you? There might be some interests in publishing the 1,000 most common passwords, e.g. to support security awareness lectures (or to build rainbow tables for nefarious purposes), but anybody who wants to hash them with a specific algorithm can do so easily. It is probably easier to type the passwords from a printed book and to hash them on the computer than it is to type the hashed passwords -- bad passwords would tend to be easy to type. That being said, computer crime laws are generally lagging behind the state of the art, or they are overly broad, so it might be illegal in some places as a &quot;hacking tool&quot; ...
I can't find any law that would prevent an employer from requiring this. Under current Florida law, an employer can even demand passwords and access to an employee's social media accounts. A bill was proposed to prohibit this, but it hasn't passed. Generally, an employer can require anything they want as a condition of employment, as long as it is not illegal. Florida has at-will employment so the employer could certainly fire the employee if they don't comply.
There are two processes that go on all the time, and are generally considered legal: Encryption algorithms are attacked by cryptographers and weaknesses identified. In most cases this results in a gradual reduction of the work required to break the algorithm by a few orders of magnitude at a time. The history of SHA-1 is a good example of this. People identify security holes in software and follow responsible disclosure rules. This means that they notify the vendor and give them an opportunity to fix the bug before going public. Note that this is merely considered good practice; immediate publication would be legal too. Your scenario sits at the intersection of these two processes: an attack (process 1) which completely destroys the security of many systems (process 2). Responsible disclosure occupies a legal grey area: someone who finds a bug might have had to exploit it to at least some degree to demonstrate it, and there have been cases where vendors have used police or courts to retaliate. However this wouldn't apply to your scenario. In America the First Amendment makes it unconstitutional to use the legal system to stop people saying true things (copyright excepted, and untrue things are often legal too). If your Wunderkind lives in America then a widely published factual description of their solution would therefore be legal. Legal problems only start if they provide the details in secret to people they should reasonably suspect of intending to use them for crime.