Tag Info

New answers tagged

0

There is a service provided by Hewlett-Packard Tipping Point called the Zero Day Initiative. http://www.zerodayinitiative.com/ Here's how it works. They BUY the vulnerability from you HP Tipping Point gives protection to its customer base of smart firewall users ZDI works out with the vendor to try to get the issue fixed (this typically can take 6 months) ...


1

TL;DR - Being professional and humble will go a long way. Being secretive, prideful, or malicious will obviously not end so well. If you calmly and privately work with them, they're likely to do the same. This sounds almost cut and paste to how I started finding issues with my university's security. My university was putting the student's ID in a cookie and ...


4

Here is my approach: Try to find out if your University has a person who is responsible for security. Maybe they have a company which does that or they have a department. If so, try to contact these people. They often know what you're talking about. When contacting them, you don't need to tell them about wireshark. Say "I noticed that the site uses HTTP ...


-3

This seems more like a psychology/sociology question than a security one, as the issue seems to be how to best communicate with another party and convince them to take a specific action. I can't believe that any 'hacking' charge could have real legal ramifications for the reasons other answers have explained. An alternative approach to those above is to ...


18

If they ignore your emails, you may try reporting them to organisation responsible for enforcing Data Protection Act. I don't know where are you from, in UK it would be http://ico.org.uk/concerns They have a responsibility to keep your data safe.


1

At times it's very difficult to explain the importance of security to people. Some people just do not understand security and others feel that their system won't ever get compromised. Reporting a security threat at times get ignored or takes a very long time to be fixed. From my experience to get your point across to improve security, I would demo the ...


36

Simply reporting that it is using HTTP rather than HTTPS for login and that that is insecure shouldn't get you accused of hacking. It is something immediately publicly visible from looking at the site. There are many ways of detecting vulnerabilities which could actually be considered hacking (for example, running a vulnerability scanner against a target ...


11

First, you cannot make anyone do anything. As an alum, you can raise your own personal concerns that your credentials are exposed, but that's about it. I'm not sure how anyone would regard your stated actions as hacking, but that is dependent on your jurisdiction. In mine, capturing your own packets is not illegal at all. It is unfortunate that the IT ...



Top 50 recent answers are included