I wasn't sure if I should post this here or on the legal side. Last night while on a double date I had connected to a public wifi and scanned the network, I noticed two peculiar things so I decided to do a little more of a deeper look at them, on their public wifi there were two hosts one named Desktop, and the other named BackOffice1, I scanned services for both computers and noticed that they had open SMB ports and both had open guest accounts through which you could log in, and both were company computers that had information like employee files, what ever bad checks they had recieved, etc. I brought it up to the staff as soon as I found it and showed them, that they had two company computers unsecured on the public wifi they offered. I am worried I have done something wrong, any sound advice would be appriciated.

closed as off-topic by Anders, LvB, Purefan, Steffen Ullrich, Rory Alsop Jun 16 '16 at 9:41

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Anders, LvB, Purefan, Steffen Ullrich, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 6
    You might well have done something wrong the moment you scanned the public network. Don't scan things you don't either own, or have written permission to scan! – Matthew Jun 13 '16 at 11:52
  • 9
    Are your double dates that terrible that you have to scan neighbouring networks to pass the time? – MadWard Jun 13 '16 at 12:13
  • @MadWard someone tell XKCD ... that would make a great cartoon ! ;-) – Little Code Jun 13 '16 at 13:56
  • 1
    Well... my wifes sister is dating someone who is, a raging alcoholic and can make a fun situation not fun. – user114266 Jun 13 '16 at 14:30
up vote 4 down vote accepted

You had no right to scan their network, and any decision now is up to them. They could try and sue you (I doubt that), simply scold you or even thank you, and it very much depends on how you told them.

I brought it up to the staff as soon as I found it and showed them, that they had two company computers unsecured on the public wifi they offered.

I do think that telling them they had unsecured computers wasn't the smartest move. You could have simply told them you happened to see their computers on the network when you were connected, and ask if they were aware of that fact and if they had taken the measures to secure them (justify this coming forth by being a security enthusiast maybe).
If you really wanted to make them aware, you could have waited a bit and sent an anonymous message telling them about the situation.

But first of all, don't go scanning infrastructures that are not yours/which you are not permitted to scan, it can get you in trouble no matter what your intentions are ("I'm just a security engineer" is every black hat's first excuse).

  • Additionally to MadWard's last sentence - in some jurisdictions, you would get punished more for being a security engineer (as you should know better) than if you were unskilled in this area... – Rory Alsop Jun 13 '16 at 14:29
  • Thank you for your answer, I was more worried about them calling thenpolice or something like that. – user114266 Jun 13 '16 at 14:30
  • On another note to the both of you, being that i pointed out a pretty severe security loop hole to them, wouldn't they be thankful for that? In the sense that i helped them with a possible leak of sensitive information, and quite possibly bank account information, social security numbers of employees, etc. I don't see why they would be vindective about it. – user114266 Jun 13 '16 at 17:13
  • 1
    @MatthewCone: "you find some damaged goods on the shelf", it would be more something like "you find some damaged goods in the stockroom of the store". While they may thank you for having found the damaged goods, they could still sue you for having been in a place you had no right and no legitimate reason to go. – WhiteWinterWolf Jun 15 '16 at 12:32
  • 1
    @MatthewCone: A public wifi is usually proposed for a certain set of uses: accessing the Internet, possibly accessing some local officially published services, etc. However, I do not think that scanning and connecting to the other computers connected to the network is part of this legitimate set of uses: this is where you were starting to wander in the stockroom to see if everything was fine there ;). – WhiteWinterWolf Jun 15 '16 at 12:41