Is it legal to reverse engineer an unsecured API?

  • Simple REST API used in Android app
  • No SSL (just straight HTTP)
  • Passwords are sent in plain text over this HTTP API

I ran the Android app and placed wire shark in the middle of the connection with a simple man-in-the-middle attack. I could then examine how the API calls were structured, and created my own program that used the API and displayed the same data in better ways.

The API has not been explicitly released or documented for public use.

  • It depends: If you reverse it to make the application / API better by explaining the pitfalls to the developer in order to make the application more secure (responsible disclosure), I think it is fine. It also depends on the country and its laws.
    – Jeroen - IT Nerdbox
    Aug 23 '15 at 7:34
  • 1
    @Jeroen-ITNerdbox: Hem, I would be more than cautious using this approach, see my answer below. There are numerous example of people prosecuted for having reverse enginered some code or technology in order to freely help the developers...
    – WhiteWinterWolf
    Aug 23 '15 at 9:17

If the application end-user licence agreement prohibits reverse engineering, then reverse engineering is prohibited, no matter if there is some security measures or not and no matter your purposes.

When you walk on the street, the fact that you pass near an open door or window doesn't make this home a public place, and does not make you free to enter in the house to ensure that there is nothing to steal "in order to inform the house holder about the threat". The same logic apply for this API.

If you have any concern, you may get in touch with the software editor. If they are willing to do so, you may have a contractual written agreement from them allowing you some otherwise forbidden actions and clearly stating the limits you should not cross. Actually, some large editors even organize security bounty programs allowing anyone to proceed with security analysis of their products up to a certain defined limit.

But, without such written agreement, the answer seems quite clear to me.

As an addendum, local laws may have some subtleties like what is covered exactly by the notion of "fair use", is it legal to reverse engineer a software one did not install and therefore never agreed to the agreement, etc. You can find some relevant information here and there.

However I would personally not rely on such excuses to be "out-of-jail" guaranties. In France, we had Serge Humpich who, while taking all the precautions to stay within the boundary of the law (all discussions went through a lawyer, longer story here), was condemned when he proved to the GIE (organism in charge of French credit cards) that our payment system was not secured enough. I can also mention the case of Guillaume Tena who was condemned for having proved that the assertion of an anti-virus editor that their product was able to stop 100% of viruses was false.

  • 2
    What does "prohibited" mean? I'm prohibited from walking on the grass in some gardens, but that carries no legal meaning. I think the house and door/window analogy isn't great from a legal perspective either. They've permitted you to use their API. It's more akin to entering a shopping mall, finding there is no map of shops, and then making your own map. Aug 24 '15 at 5:23
  • 1
    @Cybergibbons Unless that there would be a notice at the entrance of the shopping mall telling you that, by entering in the mall you confirm your agreement of not making a map or collect any data regarding shop location. Your example is good though, since it highlight what I think (personal opinion) to be the silly side of such licence agreements and laws which deprives end-users of evolutions which would benefit to everyone. I've updated my answer to add a few references and the possible "grey area" which may exists in some location. Aug 24 '15 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy