Tag Info

Hot answers tagged

216

Just because they won't use it, doesn't mean someone else won't find it and use it. A backdoor is a built-in vulnerability and can be used by anyone. You should explain that doing something like this is very risky for your company. What happens when some malicious attacker finds this backdoor and uses it? This will cost your company a lot of time and money ...


111

Ask your boss to put the request in writing before you do it. Make sure to keep a copy of the request in your own personal files. Ideally a paper copy at home, or maybe an email in your own personal email account. You say that you already have a better job to go to, so just give your notice now and leave the company as soon as the notice period is up. ...


89

Don't do it. I did something unethical once for an executive and I am still troubled by it to this day. For legal reasons I cannot tell anybody. It is unethical and you have another job lined up. Don't let him bully you. If he fires you then make sure you have in writing his request and you have legal grounds to sue for wrongful dismissal in most ...


85

If you've informed decision-makers and they've decided not to do anything about it, then by definition your company is knowingly shipping a product with a serious security vulnerability. (And, I assume, hiding it from their customers.) This is a very serious matter. What's the worst that a malicious person with access to this backdoor could do? If it's ...


45

First off, let me say this: I respect the ethics of anyone who would ask this kind of question (rather than just closing their eyes, walking away, and forgetting the whole thing). My compliments to you. Ultimately, this is a matter of personal ethics, so it is hard to give advice. You need to do what you feel is right. That said, your suggestion to try ...


44

If they don't see it as a big deal, you're not asking them the right question. The question to motivate action on this isn't "is this right?" but "what happens to us when somebody finds and publishes this?" Whether you're a big or small company, you're looking at serious damage to your reputation and all the bad things that go along with it if someone ...


43

Please, pardon my cynicism, but this isn't the first and won't be the last backdoor we see in our legitimate, hardly-earned apps and devices. Just to refresh our memory, we can start from the most recent one, the new Amazon's Big Brother Kindle [1][2]. But we have an entire plethora of backdoored software and services, such as PGP Disk Encryption [3][4], ...


41

Does your company have an ethics officer, internal auditor or internal council? If so, then you should contact that person, explain what you have been asked to do (in writing), and let them handle it. If it is a small company without any of these positions, then take your concerns to the owner/president (also in writing). As far as your company is ...


29

Disclaimer: I'm not an IT guru nor a security expert. First, I agree with @D.W. that it can't hurt to contact the site owner and explain what happened. (For all you know, the 509 responses may be totally unrelated to your haywire script.) Second, in the future, it's a simple matter to include your email address or other contact info in the User-Agent ...


26

You should seriously consider going to some governmental or regulatory authority with this, just to protect yourself. Imagine this scenario: You inform management about the backdoor. Now they know you know. Evil Hacker ZmEu finds out about the backdoor, and puts something on pastebin. Your management finds out about Evil Hacker ZmEu's pastebin. Your ...


23

If you have your boss' request in writing in any form (paper, e-mail, etc.), make a copy for yourself that can be stored somewhere outside of your boss' control. Depending on the sensitivity of the information stored in the logs he's requested you to modify, you may also want to keep your own copy of the logs. (This is to say: If the logs have any data ...


22

It's ok, people will still buy the iPhones your company makes - your secret is safe. ;) If it was my workplace, where I'm employed as a security analyst, I'd accept that my job is to identify and communicate risk; it's up to the business to accept the risk. I can not accept risk personally, so my only real option is to ensure that I've communicated the ...


20

Before the smartphone area it was a standard feature of all mobile phone to have backdoors. The GSM protocol allowed the base station to update the phone software. http://events.ccc.de/congress/2009/Fahrplan/events/3654.en.html is a good talk about how crazy the security scheme has been. As far as I know no one of the companies involved in creating GSM got ...


19

Passive scanning such as determining geo location, IP address, network routes is probably a good idea (to give you an understanding of where attacks are originating from). Update: Actually for larger institutions this is kind of essential in determining whether the attack is a large scale organised attack or simply a lone hacker testing out the defences. ...


18

There really isn't enough information here to make a determination about your question. Jurisdiction and exactly what went on with how you found a flaw in the security and how you tested it and what their terms of service (which define how you are allowed to use their computers and data) all matter. In general, "hacking" isn't what is legal or illegal, ...


17

There are a few drawbacks to hiring a blackhat "hacker" instead of a security company. They are harder to trust Apart from backdooring your system, I would not trust a blackhat I pick off the street to keep his findings about my network confidential. Hackers like to boast to their peers. The knowledge they obtain about your security can bite you in the ass ...


16

You should let the developer(s) know privately so that they have a chance to fix it. After that, if and when you go public with the vulnerability, you should allow the developer enough time to fix the problem and whoever is exposed to it enough time to upgrade their systems. Personally, I would allow the developer to make the announcement in a security ...


16

Do not do it. Even in writing it does not matter. At the end of the day its your butt on the line. If you're boss asked you to shoot someone with a gun, and you got him to write permission in writing, do you think anyone in the court would care if your boss gave you permission or not? Regardless, you will be held accountable, not your boss. If your boss ...


15

I have worked as a solo security consultant, hired and vetted security testers, sat on the standards committee for CREST (the UK gold standard in penetration testing) and managed security teams of up to 100 people so I have a pretty broad experience of how this works. Risks An attacker goes "rogue" - having a contract with an established, reputable ...


15

Fighting back is what the cool kids do! >:) Regarding law, I grabbed this snippet from http://lawmeme.law.yale.edu/static/pastevents/digitalcops/papers/karnow_newcops.pdf (2005) "CONCLUSION Even under nuisance law, not every counterstrike – or “self help” effort – is automatically immune. It has to be reasonable, and proportional to the nuisance, ...


13

If the owner invited people to hack the site, then he accepts such things as DoS. It is possible that he configured the server to limit brute-force attempts by instituting rate-limiting. If he did, then you did not exceed the limit for his pipe, just the limit he gave you. Either way, no need to write an apology.


13

For this to be unethical there would need to be the potential for the information displayed to leak personal information. The numbers shown, while they have a small amount of background, do not show enough context for anyone to glean any extra information. The privacy issue of the source of these images, ie street view, is much more relevant as it allows ...


12

For legal advice you need to seek a lawyer. In some countries it is already illegal to do a "test" login with an account that does not belong to you. What I would do? If the IT-department does not answer and does not fix the issue, you should try to reach other people at the company, especially upper management, public relation, customer relation, high ...


12

-- Edit: This answer addressed the idea of applying for a job based on the discovery of a vulnerability. -- The chances are high that you would not get the job if you applied on the strength of the fact that you successfully hacked their user security. Trust me, if someone walked into an interview with me saying, "Oh, by the way, I found a hole in your ...


12

Do absolutely nothing else with or at the site. Don't make things worse. In many jurisdictions you may have already crossed the line into not so legal. (You should get legal advice from a computer crime specialist lawyer in your jurisdiction about what you've done, by the way.) You have notified the site owner, which we commend you for, and your lawyer ...


11

You have a professional responsibility and an ethical responsibility to ensure this is addressed, IMO. And you've stepped into a minefield. Protect yourself. Watch your step. Go slow. Think defense-in-depth. I successfully solicited a whistleblower, who has been able to maintain anonymity. The solicitation included advice on maintaining anonymity; ...


11

It is unlikely that you can legally make money from this bug. If you are considering some scheme to make lots of money from it: step away, take some time off. There is a significant risk that you will be prosecuted for hacking or for extortion if you try to demand compensation for reporting the vulnerability. Note that in the US, hacking is illegal. The ...


11

C6C server are often servers that got hacked, not servers rented by the attacker. Security support contracts For public organisations there are often CERTs (computer emergency response team) responsible for them. For example there is the DFN Cert for all Germany universities. Large companies tend to have support contracts with companies specialized in ...


11

Look up their DNS record with whois, and contact their listed admin. Also, contact their hosting provider.



Only top voted, non community-wiki answers of a minimum length are eligible