privacy hacking
Is it illegal to reverse engineer an unsecured API
<p>Is it legal to reverse engineer an unsecured API? </p>

<ul>
<li>Simple REST API used in Android app  </li>
<li>No SSL (just straight HTTP)</li>
<li>Passwords are sent in plain text over this HTTP API</li>
</ul>

<p>I ran the Android app and placed wire shark in the middle of the connection with a simple man-in-the-middle attack. I could then examine how the API calls were structured, and created my own program that used the API and displayed the same data in better ways.</p>

<p>The API has not been explicitly released or documented for public use.</p>

<p>If the application end-user licence agreement prohibits reverse engineering, then reverse engineering <strong>is</strong> prohibited, no matter if there is some security measures or not and no matter your purposes.</p>

<p>When you walk on the street, the fact that you pass near an open door or window doesn't make this home a public place, and does not make you free to enter in the house to ensure that there is nothing to steal "in order to inform the house holder about the threat". The same logic apply for this API.</p>

<p>If you have any concern, you may get in touch with the software editor. If they are willing to do so, you may have a contractual written agreement from them allowing you some otherwise forbidden actions and clearly stating the limits you should not cross. Actually, some large editors even organize security bounty programs allowing anyone to proceed with security analysis of their products up to a certain defined limit.</p>

<p>But, without such written agreement, the answer seems quite clear to me.</p>

<p>As an addendum, local laws may have some subtleties like what is covered exactly by the notion of "<em>fair use</em>", is it legal to reverse engineer a software one did not install and therefore never agreed to the agreement, etc. You can find some relevant information <a href="https://www.chillingeffects.org/topics/15" rel="nofollow">here</a> and <a href="http://blog.erratasec.com/2007/05/liability-of-reverse-engineering.html" rel="nofollow">there</a>.</p>

<p>However I would personally not rely on such excuses to be "out-of-jail" guaranties. In France, we had <a href="https://en.wikipedia.org/wiki/Serge_Humpich" rel="nofollow">Serge Humpich</a> who, while taking all the precautions to stay within the boundary of the law (all discussions went through a lawyer, <a href="https://en.wikipedia.org/wiki/Serge_Humpich" rel="nofollow">longer story here</a>), was condemned when he proved to the GIE (organism in charge of French credit cards) that our payment system was not secured enough. I can also mention the case of <a href="http://www.zdnet.com/article/security-researcher-to-be-jailed-for-finding-bugs-in-software/" rel="nofollow">Guillaume Tena</a> who was condemned for having proved that the assertion of an anti-virus editor that their product was able to stop 100% of viruses was false.</p>
