6

What is the ethics and legality of developing and using a tool to grab data on employees in the client's company in social networks such as facebook, twitter and linkedin. The data should then be used in a pentest in social engineering attacks.

Data could be grabbed via the API, or maybe web scraping.

h00j
  • 766
  • 1
  • 7
  • 18
  • 6
    You covered this in your contract and get out of jail free card, right? If it's not in scope ... better not to do it without renegotiating the engagement. – adric May 11 '12 at 20:18

2 Answers2

5

Legality depends on local laws that will change and are subject to interpretation. Best to consult a local lawyer who specializes in these matters. For example, data privacy law in the EU is quite strict about notifying people before aggregating data about them.

Ethically, its best to have been given explicit permission by the individuals to aggregate their information before doing so. In your scenario, its probably best for say your client to give you permission to aggregate the specific data about their employees for your pen test purposes. For your client to ethically give you permission, they should have previously explicitly obtained permission from their employees that included letting third parties (such as yourself) aggregate the data for these sorts of purposes.

dr jimbob
  • 39,312
  • 8
  • 94
  • 164
  • Thanks, what about the legality of the act of grabbing the data from the social network? Would the social networks allow it? – h00j May 11 '12 at 18:17
  • 3
    @HenryHoggard The legality of grabbing data from social networks is addressed in the first paragraph of this answer. In short, consult a lawyer and/or look up your current, local laws on the matter. – Iszi May 11 '12 at 18:46
  • 1
    @Henry - If the data is publicly available and you have the users explicit permission to download it, I don't see any ethical reasons against aggregating it (though a social network may have policy forbidding robots trawling their site). However if the data is private, social networks like facebook have fought against employers demanding access to it as an invasion of privacy. – dr jimbob May 11 '12 at 19:46
  • So linkedin public and twitter is okay, but maybe not facebook? – h00j May 11 '12 at 21:10
  • @HenryHoggard - Why would it be allowed for twitter but not Facebook. Both my twitter and facebook are non-public profiles. Unless you have permission of the user you are scrapping data from you could have a problem, even if your "client" gave you permission, your client cannot give you permission to scrap their employee's profiles. – Ramhound May 14 '12 at 16:27
  • Realistically, if you get employer permission to do it then it is no longer your issue to worry about. If an employer decides to take on the risk of litigation because they hired someone to perform recon on their employees (that is what they would be doing) then it's their problem, not yours (as long as it's in your contract) – gal Feb 11 '13 at 14:55
2

As a contracted penetration tester you have a moral obligation to provide the best service you can provide within the bounds of local law and your pre-engagement agreement (in that order).

That said, do your fact checking and get legal advice from legal professionals and make sure to discuss the matter with your employer. They may not be comfortable with you pursuing their employees in this manner. Companies are not always comfortable with social engineering.

Even if you decide not to for whatever reason (legal/moral compass), still discuss the matter with your employer, make sure they know you are limiting the scope of the test to exclude social engineer or these intelligence gathering tactics. It's important they stay informed.

chao-mu
  • 2,821
  • 19
  • 22