I was googling for some PCI device code and stumbled upon an indexed /sys file on a web server. Poking around a bit, it seems that the complete root filesystem is exposed trough /uploads/ls. So I can assume this site is hacked?

I'm a bit concerned, as this is an elementary school and it exposes also (I think only normal) pictures of children to the outside world. Should I report this to the authorities, or just the site admin?

I prefer not to share the website url, for the sake of the privacy of the children.


Get in touch with the school by any means necessary. There will certainly be a 'contact us' form on the website; if not, pick up the phone and do them a favour and call them. Even if they are in a different country, VoIP calls are quite cheaper today and I'm sure you can afford the cost.

Explain the situation in good details, making clear that your intention is not to expose anyone's privacy nor to ask for a ransom but that you are doing your duty as a responsible citizen. This is because often non-techie tend to panic and call the police pointing you at the culprit.

If you are able to, offer your advice on how to protect the webserver or explain what should be done so they can independently verify your advice by going e.g. to OWASP or asking questions on Security Stack Exchange.

Offer some degree of personal information e.g. how to get in touch with you, what is your name, and make your e-mail as professional and polite as possible. It is very likely that it happened as a genuine mistake so there is no need to add fuel to the fire that will generate.

Imagine the person on the receiving end is e.g. your grandmother (or any non-techie -- no offense for grandmothers out there). How would you explain it to them? What details would you offer first?

Make sure you cc: other people e.g. the principal, vice-principal etc. so that there can be no "your word versus theirs" if it comes to litigation.

Lastly, if you think the data exposed is really dangerous, make it clear that you will report this to the police if you do not get an answer by XXX days (be reasonable and account for school holidays).

  • 8
    I'd be very careful before taking this advice, there have been occasions where this kind of contact has been mis-interpreted and the reporter accused of hacking. I'd recommend reporting anonymously. Mar 7 '16 at 13:49
  • I tried to do anonymous reporting (Dutch government has a phone number for this) but they don't take the report. Tried informing the police directly, they don't take the file if it is not reported by the owner of the site. In the end, contacted the school and no harm caused they are taking steps at this moment.
    – Tim
    Mar 7 '16 at 14:26
  • 1
    "...offer your advice on how to protect... or you will report this to police..." This will not be as helpful as you might hope.
    – J Kimball
    Mar 7 '16 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.