How to make a website patch their poor security?

Question

I am following an online class from a local institution. Recently, I've noticed they don't hash passwords because they sent me my password by e-mail in clear text.

The website has a lot of personal information so I've decided to test how secure it is.

After a few minutes of testing the private message system, I've found out that you can view, delete, reply to any message with any username. Also, they sent a message to everyone with their password recently so I can see everyone's password. XSS attacks are possible as well.

I've reported the vulnerabilities and it still hasn't been patched (it's only been a week but if I were responsible of a system like this, I wouldn't sleep until everything's fixed).

How can I make them secure their website properly? My own personal information is also at risk here.

(To make sure there are no more answers related to that, I am well-aware of the laws. It doesn't change the fact that some day, someone will do exactly what I did but with bad intentions.)

Answer 1

So there's a couple of options open to you potentially, depending on the country you live in, however first a note of caution.

You "tested" the site and then reported your findings. In many countrys if the application owners want to make out that you "hacked" them, they could do that, and it may be bad for you. I say this just so you can weigh it up when you're considering taking other actions. I'll leave aside any more legal stuff on hacking as it's been covered in other answers.

Basically the main ways to get them to address this would either reporting this to a regulator/government body who are responsible for data protection (e.g. in the UK, the information commissioner), as it seems that they're not taking appropriate measures to protect personal data which they are processing. This may get them to fix it if the regulator contacts them regarding the problem.

The other option would be to try and attract bad publicity to the site, by publishing the details of the vuln. This may have the desired affect, but be aware a likely side affect is that they could take legal action against you (again depending on the jurisdiction, they're attitude to security etc)

Answer 2

"so I've decided to test how its security is." And there was the point where you crossed the line. Unless you have explicit permission to "test" security, you are breaking the law.

"Exceeds Authorization The term "exceeds authorized access" is defined by the CFAA to mean "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6)." https://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_%28CFAA%29

Now onto your other comment: "My own personal information is also at risk here." Ask to have your data removed as you do not wish to be on an insecure system. However, as I stated initially, unless you have explicit permission to test their site, I'd stay far away from doing so.

I am going to edit my comment. While I posted information on US Laws, this is because I am from the US. I have seen no other countries where testing without permission is not legal. To answer your edit Simon: "It doesn't change the fact that some day, someone will do exactly what I did but with bad intentions" This is completely irrelevant. Why break any laws to prove a point. If you're that opposed to having your information stored on that server, have them remove it.

While your initial thought would be that you are "helping" those with information posted by exposing the risk (you just as well may be), there have been instances where exposing "flaws" have led to jail time. You can contact whomever is responsible for their server, if that doesn't work, you can start CC'ing others in the same company/institution, maybe that would help. If you're in the US, you can try getting this addressed via CERT. If in another country, you can trying finding that country's CERT.