[NTLUG:Discuss] OT: What constitutes unauthorized access?

[Steve Baker]

Richard Geoffrion wrote:

> OK..what about the case where spam is sent to an email server.  An ARIN
> lookup shows it to be from a dialup segment...  A quick services-nmap scan
> is made of that IP revealing that 5900 and 5800 (amongst other things) is
> open.   A just for grins VNC connection is initiated to 5900 and
> lo-and-behold...some bed and breakfast has their reservation system open for
> all the world to see, hypothetically speaking of course.
> 
> So what does a good net'citizen do??  Leave them to their problems???  or
> pop open a NOTEPAD in Windows and type in a friendly message stating that
> spam is being sent from the IP address associated with their IP address,
> that their computer is wide-open for use on the internet without any
> passwords and they need to have a security review done on their system.

NO! Certainly not!  Suppose that PC's screen happens to be connected to a
50' tall animated video billboard in downtown LasVegas?  You just told
tens of thousands of people how to hack into the billboard system...some of
them have laptops...Oh the horror!

Now you made matters MUCH worse!

I think you could attempt to track down the owner and email them - maybe phone
them if you can find the number - but entering their system in order to send
them a message seems highly dubious.

> So...would connecting to the open/unpassworded VNC port constitute terrorism
> and hacking?  Would notifying the clueless operator of that computer that
> they are vulnerable constitue terrorism and hacking?? Just what *would* be a
> felony?  Where does good and harmless INTENT come into play?  Is it illegal
> these days to HELP someone??

You can't tell whether you are helping or hindering and other people can't
tell if (halfway through your 'helping' process) you are the helper or the
perpetrator.

> It sort of sounds like someone walking into an unlocked business after-hours
> to use their phone to call the owner to tell him that his business door is
> unlocked.

I think that's legally pretty dubious too.  You don't know WHY they left the
door open.  From the moment you step through the door (setting of a silent
burgler alarm) - and all the time you are on their video camera's. You are
in DEEP trouble. Just try arguing your way out of it if the cops show up before
you figure out the phone number of the owner and get their undying gratitude.

> Damn the bad people in the world that spoil things!

Well, yes - but 60's soap operas are full of "The Law of Unintended Consequences",
horrible things can go wrong when you dabble in places where you have not been
invited.

---------------------------- Steve Baker -------------------------
HomeEmail: <sjbaker1 at airmail.net>    WorkEmail: <sjbaker at link.com>
HomePage : http://www.sjbaker.org
Projects : http://plib.sf.net    http://tuxaqfh.sf.net
            http://tuxkart.sf.net http://prettypoly.sf.net
-----BEGIN GEEK CODE BLOCK-----
GCS d-- s:+ a+ C++++$ UL+++$ P--- L++++$ E--- W+++ N o+ K? w--- !O M- V-- PS++ PE- Y-- PGP-- t+ 5 X R+++ tv b++ DI++ D G+ e++ h--(-) r+++ y++++
-----END GEEK CODE BLOCK-----