News for hackers. Stuff that matters.

A comment on What NPM should do to stop a new colors attack. Parent comment

Re:What NPM should do to stop a new colors attack by rsstack on Monday January 10, 2022 @03:31PM (#29881819)
The precedent doesn't apply. The SCOTUS interpreted (and in effect, defined) that the "authorized access" in 18 U.S.C. § 1030(a)(2) can't be qualified and limited to less access. If I'm authorized to see usernames, and due to light hacking I can also see emails - I'm n̵o̵t̵ ̵a̵ ̵c̵r̵i̵m̵i̵n̵a̵l̵ maybe a criminal (EDITED). If I'm authorized to check license plates for some reasons, and despite employer policy I checked license plates for some other reasons - I'm not a criminal.

The issue we're discussing here is based on 18 U.S.C. § 1030(a)(5) (note the last digit) and "authorized access" is not mentioned there at all. This section deals with damage and not access.

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by awinter-py on Monday January 10, 2022 @04:30PM (#29882887)
hmm, not really my area. This coverage of van buren seems to show the court trying to make 'authorization' agree in meaning in different parts of (a)(2)?

https://www.natlawreview.com/article/supreme-court-ends-long...

[ Parent | on HN ]
Re:What NPM should do to stop a new colors attack by rsstack on Monday January 10, 2022 @04:40PM (#29883031)
This incident has nothing to do with (a)(2) as Marak didn't _access_ any system. The only sections violated are (a)(5) (_knowingly damaging_ a system) and, arguably, (a)(7) (extortion). (a)(7) is a lot harder to argue though as his extortion attempt doesn't have a named target or an explicit demand and is generally... lame.

Edit: Note that I'm seeing this the same as a virus, not the same as a data-extraction hack.

[ Parent | on HN ]