Never attack something you don't have a permission for!

This is one of the golden rules of penetration testing, yet it's surprisingly unclear. What exactly counts as an attack, and when do I need permission?

Let's consider some examples:

Example 1

I want to log in on example.com, and accidentally type my password incorrectly, yet the website authenticates me successfully. Baffled, I try again, this time with a completely wrong password. Again, the website authenticates me successfully. It seems to me as if the back-end doesn't check the password at all! Would I have needed permission for this?

Example 2

I buy myself a set of Bluetooth speakers. They come in a cheap "basic" and a more expensive "premium" variant. The only difference is that the more expensive ones have better sound quality.

After opening the cheap ones up, I realize that they are built identically to the expensive ones, and just have a jumper on the circuit board that determines whether the speakers are "basic" or "premium". I change the jumper, and sure enough, the sound is better now.

Realizing what I have done, I ask myself whether I needed permission from the vendor for this.

Example 3

I use a website like TIO to execute some code. Out of curiosity, I try system("cat /etc/passwd") and sure enough, I get a file in the passwd format. I poke around the system a bit more to find the webroot and write a file into it. Again, I can open this file now. I could basically do anything on the web server, including modifying the website, visible to other users.

Did I need permission from the website owners for this?

Example 4

My 12 year old cousin shows me a browser game he likes to play. As a joke, I log in as admin'; -- and the admin interface revealed itself to me in all it's unescaped, unprepared glory.

Did I need permission from the game's owners for this?

As shown in these examples, I didn't do anything malicious, and the difference between legitimate use an an attempted "attack" is difficult to tell - at least on closer inspection.

As such, is there a clear line when exactly permission is necessary?

This question was originally asked in Security.SE. I am mostly interested in answers relevant to laws in the European Union.

  • 1
    Most of what you are describing isn't something you'd experience in pentesting. Permission to attack is only relevant when you have a contract and need to determine what is in-scope. If you buy your own stuff, you can generally do whatever you want with them. If you're dealing with, say, company Bluetooth speakers, then you would need the contract to clearly spell out that you are allowed to test them. – forest Aug 5 '19 at 9:28
  • If you need a clear line, you'll have to ask a court for that. If you ignore the need for a permission, sooner or later a court will show you when you crossed the line... – Josef says Reinstate Monica Aug 5 '19 at 9:29
  • 3
    This is purely a legal question, asking whether you're allowed to flip a switch on a PCB given that this unlocks premium features, enter a simple sql injection for fun, etc., or if one would need permission from the vendor for that. I've flagged the question to move it to the law stackexchange site. They may have less knowledge about admin';-- but they should understand the idea of entering a simple test string and be able to answer the point of this question, which is purely legal. – Luc Aug 5 '19 at 9:51
  • 3
    Additionally, you may want to edit the question to clarify which country this is supposed to be in, since that will change the answer. I'm not sure about specifics, but I'm fairly sure reverse engineering laws (relevant to your bluetooth speaker example) are an example of something that frequently differs even between neighbouring countries. – Luc Aug 5 '19 at 9:54
  • 1
    The country you reside in dictates the laws you are required to follow. – forest Aug 5 '19 at 10:49

Disclaimer: Not a lawyer or even living in US. I try to write the answer under US law. Other countries law may differ. Make sure you consult a lawyer in your jurisdiction.

Here is my understanding of the individual examples:

  1. You don't need permission legally, because you are only accessing your own account and your own information. You are the only one damaged by the intrusion and therefore, nobody can really file a lawsuit against you. This is often used by security researchers when the subjects are uncooperative. That being said, if it is an actual pentesting client, you may want to refrain from it regardless.

  2. You don't need a permission to modify hardware you own. This is completely legal and not considered an attack. It would qualify as an upgrade, such as replacing a component in your laptop. You are allowed to do that.

  3. You should have a permission here. This is an intentional penetration test and you should have permission to do this.

  4. The same as 3. This is an intentional penetration test and you should get a permission. Though if you logout immediately and don't mess with the interface, it may not be illegal on the basis that you did not cause any damage or steal any information, or it may be illegal under some circumstances. It may also be impossible to prove that you did not do anything while there.

| improve this answer | |
  • 1
    Rather than saying "not from the USA", it might be more useful to say where you are from ;). I don't assume everyone here is from the USA; the USA isn't the world... – Luc Aug 5 '19 at 10:02
  • 1
    @Luc Bad frasing, the answer is mostly ment for US laws.Obviously there will always be at least one country with wastly different laws so a wordwide answer is not possible and US seemed as a good one to pick. PS: I live in Slovakia, which I doubt anyone is interested in. – Peter Harmann Aug 5 '19 at 10:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.