News for hackers. Stuff that matters.

A comment on Hackers ransack Citrix, make off with 6TB+ of emails, biz docs, secrets. Parent comment

Re:Hackers ransack Citrix, make off with 6TB+ of emails, biz... by obituary_latte on Sunday March 10, 2019 @09:16AM (#19351838)
Interesting question. Technically, it is public. The user didn’t break anything or use any nefarious techniques. The web server is configured to list directories which in concert with file permissions makes it public. Not sure how/if this might be analogous to “just because a door isn’t locked doesn’t mean you can go in”.
[ Parent | on HN ]
Re:Hackers ransack Citrix, make off with 6TB+ of emails, biz... by flattone on Sunday March 10, 2019 @09:35AM (#19351915)
feels like there isnt even a door . . "just because its in my front yard doesnt mean youre allowed to walk in front of my house and look at it sitting there."
[ Parent | on HN ]
Re:Hackers ransack Citrix, make off with 6TB+ of emails, biz... by Amezarak on Sunday March 10, 2019 @09:49AM (#19351973)
This argument is not much different than what the grandparent is referring to. weev was convicted of conspiracy to access a computer without authorization because he advised a guy who discovered a publicly available HTTP API hosted by AT&T that returned email addresses based on guessable ids. The conviction was overturned, but on procedural grounds, not legal ones.
[ Parent | on HN ]
Re:Hackers ransack Citrix, make off with 6TB+ of emails, biz... by wbl on Sunday March 10, 2019 @10:50AM (#19352197)
Directory listing wasn't on on the AT&T server.
[ Parent | on HN ]
Re:Hackers ransack Citrix, make off with 6TB+ of emails, biz... by wrs on Sunday March 10, 2019 @12:28PM (#19352647)
He accessed “public” URLs that he inferred the existence of but wasn’t supposed to access. So I guess if you can start at the homepage of this site and find a link to a directory, you’re OK.
[ Parent | on HN ]