When is a permission required to attack a system?

Question

Never attack something you don't have a permission for!

This is one of the golden rules of penetration testing, yet it's surprisingly unclear. What exactly counts as an attack, and when do I need permission?

Let's consider some examples:

Example 1

I want to log in on example.com, and accidentally type my password incorrectly, yet the website authenticates me successfully. Baffled, I try again, this time with a completely wrong password. Again, the website authenticates me successfully. It seems to me as if the back-end doesn't check the password at all! Would I have needed permission for this?

Example 2

I buy myself a set of Bluetooth speakers. They come in a cheap "basic" and a more expensive "premium" variant. The only difference is that the more expensive ones have better sound quality.

After opening the cheap ones up, I realize that they are built identically to the expensive ones, and just have a jumper on the circuit board that determines whether the speakers are "basic" or "premium". I change the jumper, and sure enough, the sound is better now.

Realizing what I have done, I ask myself whether I needed permission from the vendor for this.

Example 3

I use a website like TIO to execute some code. Out of curiosity, I try system("cat /etc/passwd") and sure enough, I get a file in the passwd format. I poke around the system a bit more to find the webroot and write a file into it. Again, I can open this file now. I could basically do anything on the web server, including modifying the website, visible to other users.

Did I need permission from the website owners for this?

Example 4

My 12 year old cousin shows me a browser game he likes to play. As a joke, I log in as admin'; -- and the admin interface revealed itself to me in all it's unescaped, unprepared glory.

Did I need permission from the game's owners for this?

---

As shown in these examples, I didn't do anything malicious, and the difference between legitimate use an an attempted "attack" is difficult to tell - at least on closer inspection.

As such, is there a clear line when exactly permission is necessary?

---

This question was originally asked in Security.SE. I am mostly interested in answers relevant to laws in the European Union.

Answer 1

Disclaimer: Not a lawyer or even living in US. I try to write the answer under US law. Other countries law may differ. Make sure you consult a lawyer in your jurisdiction.

Here is my understanding of the individual examples:

1. You don't need permission legally, because you are only accessing your own account and your own information. You are the only one damaged by the intrusion and therefore, nobody can really file a lawsuit against you. This is often used by security researchers when the subjects are uncooperative. That being said, if it is an actual pentesting client, you may want to refrain from it regardless.

2. You don't need a permission to modify hardware you own. This is completely legal and not considered an attack. It would qualify as an upgrade, such as replacing a component in your laptop. You are allowed to do that.

3. You should have a permission here. This is an intentional penetration test and you should have permission to do this.

4. The same as 3. This is an intentional penetration test and you should get a permission. Though if you logout immediately and don't mess with the interface, it may not be illegal on the basis that you did not cause any damage or steal any information, or it may be illegal under some circumstances. It may also be impossible to prove that you did not do anything while there.