The branch of philosophy which deals with how the professionals should make decisions regarding professional and social conduct
2
votes
7answers
240 views
How to provide security for passwords stored in Database? [duplicate]
Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
6
votes
3answers
213 views
How and where can I best announce an XSS vulnerability in a relatively well-known website?
I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
4
votes
3answers
255 views
Is decompiling software considered unethical or illegal?
Is decompiling a dynamic link library considered unethical/illegal or blackhat?
If, for instance, the result of the decompile showed methods and literals that contain passwords that the application ...
5
votes
3answers
139 views
Disclosure in potential loss-of-life situations, with an uncooperative vendor
I recently discovered a publicly accessible web interface to a highly sensitive bit of lab equipment, the malfunction of which would result in potential loss of life or serious health concerns to a ...
2
votes
1answer
91 views
Encoding HTML email content
Say I have a form on my website.
The input elements of the form are: email address, name and some feedback textarea.
The server-side application that this form is submitted to will send an HTML ...
23
votes
4answers
1k views
consequences of grey hat hacking
While I was working on a anomaly detection system (finding cheaters in a quite popular online game service) I accidentally found a way to get a password of a user in a reasonable amount of time. ...
205
votes
22answers
287k views
I found that the company I work for is putting a backdoor into mobile phones
I have found out recently that the remote assistant software that we put in a smartphone we sell can be activated by us without user approval.
We are not using this option, and it is probably there ...
2
votes
2answers
295 views
I fortuitously accessed the configuration of unknown router: how come and what now?
I've encountered a strange thing. I connected to an open Wi-Fi, then I was just fooling around. First, I visited 192.168.0.1 and it was a router configuration page but default password didn't work.
...
1
vote
1answer
373 views
Found huge bug, what should I do? [duplicate]
Possible Duplicate:
How to disclose a security vulnerability in an ethical fashion?
Reporting vulnerable sites
I've found a huge bug which gives me the possibility to get (through ...
10
votes
2answers
501 views
What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?
I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder.
Lets assume, for the sake of this rather hypothetical question, that a ...
40
votes
4answers
3k views
I think I accidentally DoS'd a website. What should I do?
I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it.
I wanted ...
2
votes
1answer
106 views
What is a good method to report security breaches that are being used to actively spam?
I received an email the other day purporting to be from a bank I hadn't even heard of, so I decided to poke around. On some quick investigation, it looks like something has just latched onto some poor ...
105
votes
16answers
7k views
What should I do when my boss asks me to fabricate audit log data?
My boss just asked me to create a fictitious log entry to say that a user's account was updated before it was, to win a dispute.
I feel this is not right because I am trying to start a career in ...
6
votes
2answers
255 views
Ethics and economy in security research
How can we design a market for information disclosure where individual security researchers may benefit economically in an ethical way?
Assume a market where the participants are governments, ...
5
votes
5answers
1k views
Penetration testing by ethical Hackers/Crackers should be trusted?
My question today come from my homework question from class ethics in IT.
Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities ...
5
votes
3answers
210 views
Disclosing security vulnerabilities to paying customers first
Particular case
An (unnamed) vendor of an open source product also sells commercial licenses and support. One of the advantages of the commercial deal is that you get notified of security ...
4
votes
2answers
169 views
What to do in response to a source code and/or database leak by a third party hosting provider?
My PHP sourcecode and database (PHPMyAdmin Dump) has been leaked publicly and I believe that the web host I have used for this service are responsible for the leak.
On first appearances, the web host ...
8
votes
3answers
383 views
How do researchers “gain control of an attacking PC” and not themselves be considered attackers / criminals?
In reference to this Network Computing Report article titled "'Operation Shady Rat' Perpetrated Five Years Of Long-Term Attacks On Government, Enterprises"
The Cliff's Notes to the article is thus: ...
12
votes
3answers
566 views
Whistleblowing, business ethics and credit card data
I'm writing this post as I'm facing a personal, ethical dillemma and I would like feedback on the best way to approach this situation, particularly from a philosophical point of view.
I work for a ...
17
votes
2answers
455 views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
4
votes
4answers
393 views
What particular concerns should one bear in mind when wardriving?
I'm considering starting a neighborhood-wide wardrive, with the objective of raising awareness to the risks of running unsecured wireless networks.
Right now, I'm still in the planning stages of this ...
9
votes
3answers
286 views
Reporting vulnerable sites
Take this scenario:
You browse the web and find a website that is vulnerable to SQL Injection. Being a good guy/gal you report the vulnerability to the site owner (if you are able to find contact ...
7
votes
4answers
354 views
How should I escalate a vulnerability that is dismissed by the vendor?
I've come across a vulnerability that secure@microsoft does not think is worth pursuing.
I would estimate that there are many, many customers affected by this issue.
I do not want to start a ...
3
votes
5answers
320 views
Was the ASP.NET Padding Oracle exploit exposed in an ethical manner? What could have been done differently?
This is a multi-part question....
In regards to the ASP.NET Padding Oracle, (demo link)was that security exploit dealt with in an ethical manner? What could have been done differently or better?
...
18
votes
10answers
1k views
Is it ever appropriate to fight back?
When an website or system is being attacked, is there ever a scenario where it should automatically take action against the attackers rather than just passively handling the attack? If so, what ...
25
votes
6answers
913 views
How to disclose a security vulnerability in an ethical fashion?
How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
