Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am following an online class from a local institution. Recently, I've noticed they don't crypt passwords because they sent me my password by e-mail in clear text.

The website has a lot of personal information so I've decided to test how its security is.

After a few minutes of testing the private message system, I've found out that you can view, delete, reply to any message with any username. Also, they sent a message to everyone with their password recently so I can see everyone's password. Obviously, XSS attacks are possible too.

I've reported the vulnerabilities and it still hasn't been patched (it's only been a week but if I was responsible of a system like this, I wouldn't sleep until everything's fixed).

How can I make them secure their website properly? My own personal information is also at risk here.

Edit: To make sure there are no more answers related to that, I am well-aware of the laws. It doesn't change the fact that some day, someone will do exactly what I did but with bad intentions.

share|improve this question
3  
About the only thing you can do is make it very clear to them (and to more than one contact at the company if possible) just how serious this is. If you can get an e-mail contact of someone in charge, and not just info@example.com, then try to make upper management aware of the problem. Give them time to fix it. It may take more than a few weeks to do this as it may be a lot more complicated than you might imagine. –  Rod MacPherson Jun 3 '13 at 15:20
3  
You don't. nbcnews.com/id/51983204/ns/… –  Travis Jun 3 '13 at 15:22
4  
Please realise that while your intent is noble that "testing" the security of a website without prior approval of its owner is in most countries considered illegal and may result in prosecution. –  Lucas Kauffman Jun 3 '13 at 15:25
1  
Others have discovered this is dangerous territory - techdirt.com/articles/20111015/20563516374/… –  zedman9991 Jun 3 '13 at 17:36
1  
Agree with the above! "No good deed goes unpunished", so "let them stew in their own juices". –  Kaz Jun 3 '13 at 19:32
show 1 more comment

2 Answers

up vote 16 down vote accepted

So there's a couple of options open to you potentially, depending on the country you live in, however first a note of caution.

You "tested" the site and then reported your findings. In many countrys if the application owners want to make out that you "hacked" them, they could do that, and it may be bad for you. I say this just so you can weigh it up when you're considering taking other actions. I'll leave aside any more legal stuff on hacking as it's been covered in other answers.

Basically the main ways to get them to address this would either reporting this to a regulator/government body who are responsible for data protection (e.g. in the UK, the information commissioner), as it seems that they're not taking appropriate measures to protect personal data which they are processing. This may get them to fix it if the regulator contacts them regarding the problem.

The other option would be to try and attract bad publicity to the site, by publishing the details of the vuln. This may have the desired affect, but be aware a likely side affect is that they could take legal action against you (again depending on the jurisdiction, they're attitude to security etc)

share|improve this answer
1  
This is the kind of answer I'm looking for. Reporting this to a government sounds like a great idea. It will take some research but most-likely what I'll end up doing. Publishing the vulnerabilities definitely would get it fixed but I don't feel like doing this because it will penalize users who are only trying to complete some classes for their education degree. Thank you. –  Simon Jun 3 '13 at 16:14
add comment

"so I've decided to test how its security is." And there was the point where you crossed the line. Unless you have explicit permission to "test" security, you are breaking the law.

"Exceeds Authorization The term "exceeds authorized access" is defined by the CFAA to mean "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6)." https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_%28CFAA%29

Now onto your other comment: "My own personal information is also at risk here." Ask to have your data removed as you do not wish to be on an insecure system. However, as I stated initially, unless you have explicit permission to test their site, I'd stay far away from doing so.

I am going to edit my comment. While I posted information on US Laws, this is because I am from the US. I have seen no other countries where testing without permission is not legal. To answer your edit Simon: "It doesn't change the fact that some day, someone will do exactly what I did but with bad intentions" This is completely irrelevant. Why break any laws to prove a point. If you're that opposed to having your information stored on that server, have them remove it.

While your initial thought would be that you are "helping" those with information posted by exposing the risk (you just as well may be), there have been instances where exposing "flaws" have led to jail time. You can contact whomever is responsible for their server, if that doesn't work, you can start CC'ing others in the same company/institution, maybe that would help. If you're in the US, you can try getting this addressed via CERT. If in another country, you can trying finding that country's CERT.

share|improve this answer
2  
I'm sorry but there is no indication that this person lives in the U.S. –  Lucas Kauffman Jun 3 '13 at 15:28
1  
You're correct, however there is no known place that I can think of, where it is legal to perform arbitrary security tests. Since I am in the US, its easier to reference local laws –  munkeyoto Jun 3 '13 at 15:31
2  
True but it is preferred to make your answers as applicable as possible if you could just add something like your comment to your answer it would benefit your answer and I'd give you an upvote –  Lucas Kauffman Jun 3 '13 at 15:47
1  
@simon that doesn't make it any more legal –  Lucas Kauffman Jun 3 '13 at 15:50
2  
@LucasKauffman You are absolutely right but let's see it the other way around; it doesn't make the website secure because it's not legal to test if it has vulnerabilities. –  Simon Jun 3 '13 at 15:52
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.