3

Let's say I have a program that needs you to login with a paid account in order to use it, and it sends authorization data to a server (username and pass) using this example link (I show example credentials): http://foo.bar/checkUser?user=PKTINOS&pass=password

In this sample, the authorization link returns "Success" if the credentials are valid and "Failure" if they are not.

And let's say I have another 3rd-party program that redirects that link to my own URL, e.g., http://bar.foo/checkUser, that happens to always return "Success."

(This would allow you to use the program with false credentials.)

Would that violate any law?

Improve this question
  • 4
    COUNTRY ???????? – Cicero Jan 22 '17 at 21:32
  • 2
    Side note: A well designed web application would still give you unauthorized errors if the login was not performed by the web application itself. (E.g., it would reject the token from your fake login because it doesn't have a record of generating it or it would reject the cookie because it wasn't encrypted with the right key.) If you know of a web site that does this, you may want to look into informing them of the vulnerability somehow. There are some questions on Information Security that may be helpful in determining how to do this with minimal risk to yourself. – jpmc26 Jan 23 '17 at 0:42
  • 1
    To be clear, you lawfully obtained the copy of the program, correct? You didn't steal it or violate any license to get it. Otherwise, of course, you're already sunk and your question isn't really relevant. – David Schwartz Jan 23 '17 at 12:21
6

Forget about copyright or EULAs. In the UK this would be illegal under the Computer Misuse Act (1998) and you could be jailed for up to a year - specifically

Unauthorised access to computer material.

(1)A person is guilty of an offence if—

(a)he causes a computer to perform any function with intent to secure access to any program or data held in any computer, or to enable any such access to be secured;

(b)the access he intends to secure, or to enable to be secured, is unauthorised; and

(c)he knows at the time when he causes the computer to perform the function that that is the case.

This law has been applied even to simply altering parameters in a GET request to a website, so it is incredibly broad.

Other jurisdictions have similar wording, so be aware!

Improve this answer
  • 1
    It's not clear the owner and possessor of the computer that the program is held in isn't entitled to determine whether the access is authorized. – Ross Ridge Jan 22 '17 at 20:42
  • It can only be unauthorised if you don't have an account though, right? If you do have an account, you may still for whatever reason prefer to play on a private server, but that's when other laws come into play. – hvd Jan 22 '17 at 20:45
  • @RoryAlsop: (c) actually spells out explicitly that lack of knowledge is a defence. All three conditions (a)-(c) must be met simultaneously in order for an offence to have occurred. – MSalters Jan 22 '17 at 22:30
  • I meant it doesn't matter that the owner of the service doesn't know what the cracker is doing - I think that is what Ross was saying – Rory Alsop Jan 22 '17 at 22:46
  • 1
    Assuming he lawfully possesses both the computer and the program, in what sense is the access unauthorized? – David Schwartz Jan 23 '17 at 1:01
2

As a first note, I will provide the obvious statement that this may vary from jurisdiction to jurisdiction and I speak only from knowledge of UK law and the resources at my disposal that may cover some other jurisdictions in a light touch manner.

As your question considers the scenario where you are spoofing a check for a paid account, I will assume that you do not possess the appropriate license for the software and are using this technique to circumvent what is a license verification procedure.

That said, usually this would be illegal as you are using a piece of software without the appropriate license. This follows the agreement (read contract) you have formed in the installation of the program - the EULA (end user license agreement). Where the EULA stipulates that you only have rights to utilise the software if you have the appropriate license, you would still be in breach. See section 1.g. of the McAfee EULA.

Furthermore, while you may not be in direct breach of the decompilation/modification restrictions imposed by the EULA (3.f.), you may still be in breach of the proscription of 'Reverse Engineering', as through your analysis of the software you have been able to exploit a particular aspect.

Obviously, I have opted to use a fairly comprehensive EULA for the purpose of this answer and it is feasible that there may be software produced without the relevant provisions and protections.

Improve this answer
  • Of course, jurisdictions that specifically authorize Reverse Engineering as a matter of law (e.g. Netherlands) are different. – MSalters Jan 22 '17 at 22:34
  • @MSalters I completely agree - though other provisions of EULA may still proscribe the result of the Reverse Engineering. – Morgan Hickman Jan 23 '17 at 0:20
  • 1
    I don't think so. The law trumps any EULA restrictions on Reverse Engineering; those provisions are null and void. – MSalters Jan 23 '17 at 0:32
  • 1
    Simply accepting terms doesn't form a contract - for an agreement to be a contract two parties have to agree to each do something for the benefit of the other (e.g. paying money and supplying goods). – bdsl Jan 23 '17 at 1:25
  • 1
    @DavidSchwartz as I understand it, you are blurring the line between the ownership of a work and permitted use of a work. In very few circumstances does the possession of a CDROM (or similar medium) constitute ownership of the software that is loaded on it - it remains the intellectual property of the software publisher and as such you are only permitted to use it if you are licensed to do so and are obligated to adhere to the license terms. – Morgan Hickman Jan 23 '17 at 12:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.