New answers tagged

2

If the admin did not address the security flaw, even after a kind soul informed them- this is their gaping hole, not yours, sir. You did the best you could, more than most. I've emailed admins, good ones say thanks, bad ones ignore. No need for worry, you are trying to help is all. Remember, they are being paid, you are not, it's a good job you said ...


3

This entirely depends on wether or not you violated any law or school rules when you stumbled onto the problem. If you found it without violating rules If you didn't violate any rules (e.g. this is a simple enumaration problem with a web app and you just put in yourID+1 and got another students data) there should be no problem with disclosing this ...


1

According to google, they recommend 90 to 120 days to patch after disclosing the vulnerability. I would be careful if you do not have permission to "play" on the network as this maybe illegal. Sounds like something you stumbled upon without probing for vulnerabilities. If you get no response, leave it alone as you may face legal issues


0

As a former government-contracted web service administrator, my experience is that almost all services follow a mandate to specify a contact person with cognizant ownership of the service itself -- their contact information should appear in the application somewhere, and any substantiable security error will generally result in the type of response you would ...


0

You shouldn't have been there so it doesn't matter what you found, you are currently in the wrong. Until you get permission to look, you have to stay quiet about it and hope they haven't detected your presence.


0

As drewbenn suggested in their second answer, but to put it in a slightly different way, where drewbenn said you can ask for permission, I'm saying you can also “suggest a security check or urge them to do it, with or without your help” with a reason like “I do X or engage in X communities online, and there have been reports or chatter about schools getting ...


0

Let's be honest here, when someone claims open source is safer than closed source, they're generalizing about what happens today in server/desktop operating systems, such as Linux (open source) versus Mac/Windows (proprietary, closed source). Why malware is more likely to affect the latter and not the former? Because of several reasons, for which I think ...


2

Use the Socratic method. Expose the vulnerability to whoever is in charge of security as a series of questions. If they, for security reasons (or whatever), can't or don't want to answer your questions, propose hypothetical situations and ask about them.


0

Tell them anonymously, citing everything you did, e.g the penetration tests, results, etc. so that they can check it for themselves (or hire someone). Make sure the message is sent to everyone who has the authority to delve into the issue(s).


4

"Ma'am, I'd just like to let you know that if you slide a strip of metal in the deadbolt of the door to your garage, you can open it with little effort." Just don't disclose. Many of us security folk have found vulnerabilities in our universities' computer systems, but there is nothing to be gained by disclosing it. Let someone else find it and disclose it, ...


1

Can you reveal the vunerability in a permissible way? You found a the issue in a way that is apparently not allowed. Can you present the issue in a way that you do have permission? If so, trying that might be a good idea. It may not even be the original vulnerability, but a bug that, when being investigated or fixed, reveals the vulnerability. For example, ...


7

How should you tell them? You shouldn't. Let's look at the potential consequences here. Since you were poking around on their network without permission (something which is almost certainly in violation of your student agreement and whatever consent you clicked through in order to gain access to their IT system) the very best outcome you can expect is that ...


55

Another thought struck me as I re-read your question (emphasis mine): How should I tell school that they are vulnerable when I wasn't given permission to check? Could you get permission? Once you have permission, you could "discover" the issue (without telling anyone you'd found it before) and report it without worrying about being blamed for hacking ...


77

If there is a teacher or counselor you can trust completely, that you know will keep your name secret even if the school administration starts making threats about firing people, I'd go to them first and talk to them in private. They don't need to understand computers or security (and you don't need to go into detail about the issue), they just need to be ...


2

Should Exceptions be shown to the user? No. Displaying exception messages is bad practice. Exceptions should be used to debug the code, they should not be used to display something to the user. If you use the same mechanism - exceptions - for both tasks, it will be very difficult to separate between them. Eventually, you will either show an exception ...



Top 50 recent answers are included