• NateNate60@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      9
      ·
      4 months ago

      They did not do it by manipulating code. This wasn’t the result of a code vulnerability. If you leave the door wide open with all your stuff out for the entire neighbourhood to see, you can’t claim you were “broken into”. Similarly, if you don’t secure your endpoints, you can’t claim you were “hacked”.

      • sudneo@lemm.ee
        link
        fedilink
        English
        arrow-up
        9
        ·
        4 months ago

        Lack of rate limiting is a code vulnerability if we are talking about an API endpoint.

        Not that discussion makes any sense at all…

        Also, “not securing” doesn’t mean much. Security is not a boolean. They probably have some controls, but they still have a gap in the lack of rate limiting.

        • NateNate60@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          2
          ·
          4 months ago

          It is a vulnerability, but exploiting that vulnerability is not generally considered by security experts to be “hacking” in the usual meaning of that term in academic settings. Using an open or exposed API, even one with a sign that says “don’t abuse me”, is generally not considered hacking.

          • sudneo@lemm.ee
            link
            fedilink
            English
            arrow-up
            5
            ·
            4 months ago

            I am a security professional. I would personally not care less to make the distinction, as both are very generic terms that are used very liberally in the industry.

            So I don’t see any reason not to call this hacking. This was not an intended feature. It was a gap, which has been used to perform things that the application writer did not intended (not in this form). If fits with the definition of hacking as far as I can tell. In any case, this is not an academic discussion, it is a security advisory or an article that talks about it.

            • Freefall@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              4 months ago

              I was gonna say, we use hacking as a term for a lot of things, even is something like cracking is more accurate. It is like Clip vs Mag in firearms…when you say clip EVERYONE knows what you are talking about.

            • NateNate60@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              1
              ·
              4 months ago

              I’m not someone who works on the practical side of security, but as a computer scientist, I do not agree that it is “hacking”. That contradicts my understanding of “hack” versus other types of exploits, but you are correct that the distinction is generally not that important. A security problem is a security problem regardless what it’s called

            • NateNate60@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              4 months ago

              I’m not talking out of my arse here either. I don’t work in security specifically but I’ve got a CS degree as well and it contradicts my understanding of how those terms are generally used. This is an open API endpoint, equivalent to leaving the garage door open.

              But the distinction is usually unimportant. A security hole is a security hole regardless of what you call it.

              • lando55@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                4 months ago

                To build on you analogy: if you left your garage door open and people came in and started taking your things, is that not stealing?

                • NateNate60@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  4 months ago

                  Of course it’s stealing. But they didn’t break in.

                  Hacking = breaking in

                  Data breach = stealing stuff

                  • lando55@lemmy.world
                    link
                    fedilink
                    English
                    arrow-up
                    1
                    ·
                    4 months ago

                    What about this scenario:

                    • you keep your main garage door, side doors, and windows locked
                    • provide a key to anyone who wants to borrow your lawnmower or whatever
                    • someone discovers a window you mistakenly left unlocked and starts using it to take stuff without using a key

                    Would this be considered breaking in? Probably. Here is where the analogy breaks down; if I were to leave the front door of my house unlocked, even if there’s a welcome mat outside, anyone who enters without my knowledge or consent can be charged with breaking and entering (yes, even though no actual breaking is involved).

                    The interesting thing with public APIs is that there are generally terms and conditions associated with creating an account and acquiring a key, though if you are hitting an unauthenticated endpoint you technically never agreed to them. In this particular case with Authy, it would probably be argued that the intent was to acquire data by exploiting a vulnerability in the custodian’s system and use it for nefarious purposes or profit. I’d call it a hack.

        • NateNate60@lemmy.world
          link
          fedilink
          English
          arrow-up
          9
          arrow-down
          3
          ·
          4 months ago

          Please provide a link to whatever source claims this.

          I hold a computer science degree and this contradicts the definition of “hack” versus “exploit” used in academic settings.