Hacking: Legal and Ethical Problems

[ISamson]

On the weekend I have participated in a hacking and cybersecurity competition.
We were assigned some capture the flag challenges in teams and we had an awesome weekend of hacking!
My teammate and I have won the high school division and as a prize we get a Wi-fi Pineapple Nano Basic. This is a cool wireless hacking module. I also want to continue with my interests in technology and cybersecurity.
However, as I do not know much about Governmental Laws, I would like to know how I could infringe with the Law in any possible way with network and port scans, the Pineapple module, any connections to open ports and so on. Does anybody know any possibilities of law infringement? Precautions?
Thank you.

 

[jedishrfu]

Make your own off net network sandbox with a few raspberry pis and windows machines and explore your penetration testing there.

Once you start playing on the internet you run the risk of crossing a line and getting into big trouble.

Remember the famous case of Robert Morris who created the first internet worm. He wanted to see if he could make a self-replicating program to explore the size of the internet and unleashed it on the real network with disastrous results. He became famous, embarrassed his father, a noted security expert and now works at MIT as a tenured professor.

At the time he got 3 years probation and was fined $10K.

https://en.wikipedia.org/wiki/Robert_Tappan_Morris

 

[Borg]

The simplest rule is to assume that you're breaking the law if you don't have written permission.

 

[ISamson]

Make your own off net network sandbox with a few raspberry pis and windows machines and explore your penetration testing there.

I do not have raspis.
I don't think I know how to make my own network, unfortunately. However, yes, I was thinking about this, good idea, but I don't know how to make thw network and raspis are not my speciality.
What if I hack my own phone for example? I have my permission.
Thank you.

 

[jedishrfu]

Here's another cautionary tale although with some clearly illegal aspects:

https://arstechnica.com/tech-policy...-massive-botnet-tracked-down-by-sloppy-opsec/

Don't be this guy, become a Sheriff and wear a White Hat instead.

 

[ISamson]

How to make an inner network?

 

[jedishrfu]

I do not have raspis.
I don't think I know how to make my own network, unfortunately. However, yes, I was thinking about this, good idea, but I don't know how to make thw network and raspis are not my speciality.
What if I hack my own phone for example? I have my permission.
Thank you.

Your phone has connections to the outside world. No wifi, no cellular, no connections to any network.

Creating a network isn't that hard. You just need connect your machines to your router and disconnect it from the internet. Gamers used to do this all the time for group play aka a LAN party.

 

[ISamson]

Creating a network isn't that hard. You just need connect your machines to your router and disconnect it from the internet.

Ok. Yep, I remember we did this with a multiplayer game. Would that waste mobile data?

 

[jedishrfu]

Only if you use the cellular network to transfer data. Thats why folks try to connect to wifi whenever possible.

Caveat: Never connect to a public wifi unless you absolutely have to and you then take on the risk of not divulging private inof or cc card numbers...

Its too easy to do a man-in-the-middle attack or some other similar attack and read your transmissions.

 

[ISamson]

Does this have anything to do with web servers/servers?

 

[ISamson]

You just need connect your machines to your router and disconnect it from the internet.

How can you do that?
How can you disconnect something from the internet and still wirelessly communicating between devices?

 

[ISamson]

Are we talking about VPNs?

 

[jedishrfu]

The router broadcasts the wifi signal so your local devices can talk to the internet or each other. The router is the gateway to the internet but you can unplug it and then you have a local wifi network not connected to the internet.

Here's some more details:

https://www.cnet.com/how-to/home-networking-explained-part-1-heres-the-url-for-you/

https://www.lifewire.com/building-a-wireless-home-network-816562

 

[ISamson]

https://www.cnet.com/how-to/home-networking-explained-part-1-heres-the-url-for-you/

https://www.lifewire.com/building-a-wireless-home-network-816562

Can this be done with streamed mobile data? We don't have a router and my mother streams her limited mobile data.

 

[DavidSnider]

There are lots of sites on the internet that have public wargames servers. You could use one of those.

 

[ISamson]

There are lots of sites on the internet that have public wargames servers. You could use one of those.

Yes, but I wanted to experiment with my own things.
Thanks.

 

[DavidSnider]

Yes, but I wanted to experiment with my own things.
Thanks.

The "offline" route is creating a virtual network and have the edges of the network have VMs with images of "damn insecure linux". They have prepackaged docker images that set up a pretty good out of the box lab for you.

 

[ISamson]

Anyone know of Wi-fi Pineapple?

 

[ISamson]

What if I hack my own phone for example? I have my permission.

What if I hack my phone? I have my permission...
@jedishrfu, I don't get your answer:

Your phone has connections to the outside world. No wifi, no cellular, no connections to any network.

 

[jedishrfu]

Ask yourself "Do I want yo go to jail for hacking?" and then answer "NO!"

Solution: Don't connect to wifi, don't connect to cellular, don't connect to any system connected to the internet.

Consider your experiments like a contagious virus. You don't want to create a pandemic right?

https://en.wikipedia.org/wiki/Biosafety_level#Biosafety_level_4

So you must play in total isolation. Learn from your experiences and become a successful computer security expert. Anything beyond that will lead to prison.

Skilled hacker:
https://en.wikipedia.org/wiki/Hacker

Wannabe hacker:
https://en.wikipedia.org/wiki/Script_kiddie

Hacked hackers:
https://en.wikipedia.org/wiki/List_of_computer_criminals

Don't be these guys! Don't go to prison! Don't be Mr Robot! Watch Mr Robot instead.

https://en.wikipedia.org/wiki/Mr._Robot

 

[ISamson]

Don't be Mr Robot! Watch Mr Robot instead.

The prize for the competition I mentioned earlier, that I won, was seasons 1 & 2 of Mr Robot. But since it is an MA rated show, the organisers did not give it to us, because we are only in year 7 and thay did not expect such young people. Instead they will give us a Pineapple Nano Basic.

 

[jedishrfu]

The prize for the competition I mentioned earlier, that I won, was seasons 1 & 2 of Mr Robot. But since it is an MA rated show, the organisers did not give it to us, because we are only in year 7 and thay did not expect such young people. Instead they will give us a Pineapple Nano Basic.

Oh well, it’s a pretty good show. It’s the most accurate portrayal of a hacker on tv to date.

 

[ISamson]

Your phone has connections to the outside world. No wifi, no cellular, no connections to any network.

Creating a network isn't that hard. You just need connect your machines to your router and disconnect it from the internet. Gamers used to do this all the time for group play aka a LAN party.

So, must I put the "Mobile hotspot" on without data, connect to it and that is it?

 

[ISamson]

Creating a network isn't that hard.

I get it. Just connect all the devices as in the picture and disconnect from the big Earth icon...

 

[jedishrfu]

Yes that's a great setup.

The one limitation is that you have only one PC whereas I think you need a second to be the hacking master console.

How did you downsize the Earth?

 

[donpacino]

Can this be done with streamed mobile data? We don't have a router and my mother streams her limited mobile data.

If you don't have a wifi router you have very little use for the wifi pineapple device.

 

[ISamson]

The one limitation is that you have only one PC whereas I think you need a second to be the hacking master console.

To my disposal anytime I want I have a phone and a Mac Pro Pc. + another PC if I want to.

How did you downsize the Earth?

I did not. What do you mean?

 

[jedishrfu]

It was a joke reference to a new Matt Damon movie called Downsizing where people get reduced to 5” tall and live in a community specially built for them and essentially saving money because they use less resources or something like that.

What I meant about the second pc is that you’d use it to do hack testing on all the devices in your picture as I thought that was your intent to make a legit hackers test setup. The second pc would allow you to do hacking penetration on the first pc as well as the other devices.