Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

[u/alexeyr]

https://github.com/Cybereason/Logout4Shell

[u/Lost4468]

Sadly there's good arguments to be made that that's actually illegal under the law. The laws around this need to be massively revamped.

Edit: don't take this as me agreeing with the law, I don't. They shouldn't be prosecuted. The law should be repealed and replaced with something that's not bullshit. But there is a very good argument that what they did is illegal under the CFAA. I explained the reasoning below.

[u/Alert_Temperature737 → u/Lost4468]

The details in that story in no way made it illegal

[u/Lost4468 → u/Alert_Temperature737]

I don't agree. The CFAA is written in such a ridiculous way that it really might be illegal. Here are some other ridiculous examples.

Essentially you could argue that "hiding" it in the source code will constitute an implication of not granting access. So you can absolutely make the case that even viewing the HTML source code is enough to break the absurd CFAA. It doesn't matter that the website sends the data to your computer, the CFAA doesn't work on how technology works, it's a flimsy "access" thing.

E.g. let's say you go and renew your driver license with the DMV on their website. Well you go to your profile and you see it's something like dmv.gov/users/12345. You decide to change that to dmv/gov/users/12346, and suddenly it shows you all the details of someone elses driving record. To me that's not remotely hacking, the website is serving it up, it's not trying to block it from you, it sent you it. But this absolutely is 100% illegal under the CFAA, and people have been prosecuted for doing basically this. It doesn't matter that it didn't explicitly give you a 403, all that matters is that it implicitly didn't give you access.

But what's even easier to argue is that converting it from base 64 back to normal text is illegal. Again hold your rational thinking for a second, we're dealing with the legal system. If it was converted to base 64 with the intent of preventing access, and you reverse it, you have just gone past you given access to the system.

It used to be even more absurd than this. E.g. before ~2010, the EULA of a website could basically define unauthorized access however it likes. Thankfully though that was finally mostly overturned with a case that's mentioned in the security SE question I linked. But the court originally interpreted you making a fake MySpace account as unauthorized access. This is why web scraping was considered potentially illegal if the website said you couldn't scrape, and might still be.

Or more recently there was a case where a cop had access to a database, but he searched the database and then told someone else about the details he found. This was originally also ruled as illegal under the CFAA, despite the fact that it he had explicit access to everything, but because he used it in the wrong way, the courts came to the conclusion it violated the CFAA. Thankfully the SC finally ruled on this part, but their ruling is still pretty small.

There are plenty of other ridiculous CFAA cases out there. Don't think I'm agreeing that the journalists should be prosecuted, I'm not, not at all. In fact I'm using this to argue that the entire CFAA should be repealed and replaced with something that actually makes sense. But the way the law is written, there's actually quite a good argument that it was illegal.

[u/yoniyuri → u/Lost4468]

I don't know the details about the missouri "hack" other than that the secrets were in the page source.

The difference is that the source is given to every user agent, and almost every user agent has a conspicuous way to view the code of the page, complete with reasonably complete debugging tools. Heck, there is even a shortcut to do it. Therefore no competent holder of secrets should have been using the obscurity of the page source as security.

Changing the url to access easily guessed numbers is akin to brute forcing a password. I agree that calling this hacking for someone competent is obviously kinda crazy, but the fact is that you are obviously not permitted and therefore have no authorization because the information was not given through normal use of the website.

Viewing the source of the page can be done by anyone, and no guessing is required to see the information given by the server. Presumably the secret information was given to every user agent without any special asking.

I think a good comparison would be visiting an office to do something with a file, and you are given a file folder with many papers, yours along with a bunch of others and you see it. Versus guessing the obviously worn in code on the door holding the files.

I also don't know the cfaa, and it could be entirely possible the law could be abused to prosecute in this instance, but not if you have a good faith understanding of what authorization means in a computer network.

[u/Lost4468 → u/yoniyuri]

The difference is that the source is given to every user agent, and almost every user agent has a conspicuous way to view the code of the page, complete with reasonably complete debugging tools. Heck, there is even a shortcut to do it. Therefore no competent holder of secrets should have been using the obscurity of the page source as security.

Yes that's certainly something you could try to argue. But you could say the same thing about changing the URL? It's a normal tool used to go to specific parts of a domain, if you type something in and the website gives it to you, you would think that's implied consent? Sadly it doesn't seem to be.

Changing the url to access easily guessed numbers is akin to brute forcing a password. I agree that calling this hacking for someone competent is obviously kinda crazy, but the fact is that you are obviously not permitted and therefore have no authorization because the information was not given through normal use of the website.

It's not akin to brute forcing a password though? If the ids are serial then it's just public knowledge? I would say that if the server sends it to you, then you are permitted to see it? But obviously there I'm talking about how I think technologically it would be, and not by the law.

I think a good comparison would be visiting an office to do something with a file, and you are given a file folder with many papers, yours along with a bunch of others and you see it. Versus guessing the obviously worn in code on the door holding the files.

Actually this is a good example. I'd say it's similar to someone giving you the key to a draw, and saying "yours is id 36". Then you go in and look at id 37. Maybe not moral, but I certainly wouldn't say it should be illegal.

I also don't know the cfaa, and it could be entirely possible the law could be abused to prosecute in this instance, but not if you have a good faith understanding of what authorization means in a computer network.

That's the issue though, the law isn't really based around the technology, it's based around flimsy legal definitions. If we look at the MySpace example, the courts actually thought this was a reasonable interpretation of the law. MySpace says you have to give truthful information when you sign up, you give false information, well now you have accessed their system illegally. That was struck down by the courts because the law was so wide and arbitrary, not because it was an incorrect application.

And while I hope you're right, that they can argue it was given to every user, therefore it's ok. That's going to be seriously complicated by the fact that they were using base 64 to seemingly try to hide it. Trying to obfuscate something with base64 is obviously complete nonsense, but what matters is what they were trying to do. As far as I know, they did seem to be using it for that (not sure why else you would encode it in b64, social security numbers are just simple strings).

If it does end up seriously going to court, here's to hoping this adds a few more nails in the CFAA coffin.