I wasn't sure if I should post this here or on the legal side. Last night while on a double date I had connected to a public wifi and scanned the network, I noticed two peculiar things so I decided to do a little more of a deeper look at them, on their public wifi there were two hosts one named Desktop, and the other named BackOffice1, I scanned services for both computers and noticed that they had open SMB ports and both had open guest accounts through which you could log in, and both were company computers that had information like employee files, what ever bad checks they had recieved, etc. I brought it up to the staff as soon as I found it and showed them, that they had two company computers unsecured on the public wifi they offered. I am worried I have done something wrong, any sound advice would be appriciated.
closed as off-topic by Anders, LvB, Purefan, Steffen Ullrich, Rory Alsop♦ Jun 16 '16 at 9:41
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question does not appear to be about Information security within the scope defined in the help center." – Anders, LvB, Purefan, Steffen Ullrich, Rory Alsop
You had no right to scan their network, and any decision now is up to them. They could try and sue you (I doubt that), simply scold you or even thank you, and it very much depends on how you told them.
I brought it up to the staff as soon as I found it and showed them, that they had two company computers unsecured on the public wifi they offered.
I do think that telling them they had unsecured computers wasn't the smartest move. You could have simply told them you happened to see their computers on the network when you were connected, and ask if they were aware of that fact and if they had taken the measures to secure them (justify this coming forth by being a security enthusiast maybe).
If you really wanted to make them aware, you could have waited a bit and sent an anonymous message telling them about the situation.
But first of all, don't go scanning infrastructures that are not yours/which you are not permitted to scan, it can get you in trouble no matter what your intentions are ("I'm just a security engineer" is every black hat's first excuse).