Wednesday, March 29, 2017

Ethical Assignment: Some Ideas on Property



IT Article I chose: http://www.foxnews.com/tech/2016/07/25/tech-company-accuses-us-navy-software-piracy-seeks-596-million-damages.html (I know if from FOX and they’re not much of a reliable source of information but wired also published a small article a while ago, on regards to the same thing.)

Augustine (5th century CE, North Africa)
“Surely all those who think that they are enjoying possessions they have acquired lawfully, but who don’t know how to use them, can be convicted by us of keeping what belongs to someone else. They certainly do not belong to someone else if they are held lawfully; but lawfully implies justly, and justly implies well. If so, then everything that is possessed wrongly belongs to someone else; but if someone uses possessions wrongly, he possesses them wrongly. You can see then how many people ought in fact to return property that isn’t theirs, and how few can be found who ought to have property returned to them! Wherever such people exist, the more justly they own property, the more they despise it... In the meantime, however, there is toleration for the injustice of those in wrongful possession, and certain laws have been established among them, known as ‘civil laws’. These are not intended to make them use possessions rightly, but rather to make them less oppressive in misusing them.”  

This is my interpretation in contrast with the text:

This is a good example on how the Navy had a set of licenses and had an agreement with Bitmanagement and thus they proceeded to use the licenses on many computer thinking they could because they already had a contract with the company. This is tricky as they had access to the software and are a client of Bitmanagement for the trial version on the software but at the same time they were using it wrongfully. Bitmanagement agreed upon continue to provide services to their client but also filed a lawsuit. Augustine’s has a strong point on how ambiguous this could be. He explains how someone that does not belong to someone then belongs to someone else but in IT this is a bit more problematic. IT is very diverse and rules not always apply to the same group of software/devices. We do have Open Source/Free Software and at the same time we have Copy Rights. I think that what the Navy did is not correct even though I believe in OpenSource/FreeSoftware because they had a contract with a company that was going to provide de service and run their maintenance or troubleshooting if needed and that’s legal binding. Now, if the Navy had approached to an OpenSource/FreeSoftware company to obtain this type of software, things would have been different. One thing is to try to use software for free or to think one has the entitlement to infringe Copy Rights laws and procedures and another one is taking advantage of a company that has a pre-existing relationship with the Navy and abuse their resources. Not one or the other is right, both are terrible wrong due to the circumstances and the law already establish to define the uses of proprietary software.

I think Augustine would also highlight how it his phrase:” In the meantime, however, there is toleration for the injustice of those in wrongful possession, and certain laws have been established among them, known as ‘civil laws’. These are not intended to make them use possessions rightly, but rather to make them less oppressive in misusing them.” The Navy proceeded as if rules didn’t apply to their institution. How having the trial license would make the Navy the lawfully user of the licenses but then how their abuse put them in the spot by “wrongfully “misusing a resource that was not theirs anymore. As Augustine described as “possessing the licenses wrongly as they rightfully belonged to someone else”. In this case, the licenses belonged to “Bitmanagement”. He said expressed these thoughts hundreds of year ago and they remain true today, now that’s impressive. It almost looks like time has not past at all.

Social Engineering Task #6



My task was: “Get Inavdor Dark Bue to buy me something.”

Did I accomplish it? No

I simply could not figure out who Inavdor Dark Bue was. I could not make the relation between the face and the name and I’m bad with names.

Application: Convincing someone to buy you something is a powerful tool register equipment, devices, phone bill, ISP accounts and even buy a laptop under someone else’s name to not to be identified in case the attacker is question by the authorities or investigated under criminal charges.

Ethical reflection: In a larger scale a social engineering could convince a group of people or a person to buy some equipment for them, equipment destined to plot an attack on an institution. Maybe, even something simpler, ask someone to put their phone line under their name or their ISP provider account name other someone else’s name to not to be identified. A positive application of this is to spam employees at a company with “legitimate” email asking for funds transfer under the name of the company they work for to see if they will indeed compromise the company without confirming if the email comes indeed from a client/a legitimate CEO or a third party.

Social Engineering Task #5



My task was: “Get a fellow player to open a door for you.”

Did I accomplish it? Yes

I just had to wait to exit the classroom and leave D building. I waiting behind a few classmates so they could get ahead of me and the first person who got to the door opened it me (I was second) and the others.

Application: This task is a way to enter a company pretending to be another employee working in the building and gain physical access to the company’s systems.

Ethical reflection: This is a form of impersonation that does not take much work to achieve success while performing because most of the time, employees at a given company do not know all their coworkers. With that in mind, after an attack has gotten access to the office and can move around as another employee, it is fairly easy to get hands on a computer or even access network devices to attack the company from within. An ethical way to apply this is to put to test the 2nd security measurement asset of the company, after the infrastructure and that is, the reception or the security guard at the main door; to make sure they are paying attention to everyone entering the building and making sure the people that are not properly identified or area possible threat do not enter the building.