Long story short and without giving away too many details, I and my business partner came up with an idea for a program. It essentially bypasses the monetization feature of another piece of software by injecting packets. It's a very simple script with 30 lines of code.

The software is used by thousands or millions of people and the developer earns $120,000+ a day. He basically charges a 1% fee for using it. I'm pretty sure he was just an ordinary programmer who released this program and became rich overnight.

We already determined that our script is probably illegal. But we think it's also unethical for many reasons:

  • Deprives the developer of potentially millions of dollars. This depends on the userbase of the script. He worked hard to develop a program which was better than the others and deserves the money, according to capitalism.
  • Discourages programmers and white-hat hackers from discovering this exploit by themselves. It's like finding a cheat code for a game and telling everybody. The game isn't fun anymore.
  • Takes away from the economy instead of contributing to it. We could have used our knowledge and time to create value and grow the economy instead of taking somebody else's earnings
  • Gives the developer extra work to patch the application and re-release it.

We are not a huge software company or security researcher. We are just two kids in a garage who don't know what we're doing. The developer has millions of dollars to lose. It's not the law that scares us, but retaliation:

  • What if the developer is enraged we are ripping him off and he's a violent person?
  • What if he traces us and hacks our computers? There might be backdoors in the software.
  • Once we're traced he could hire hitmen or kidnappers to come after us
  • We don't know how much power and influence this developer has over the community

What should we do? Delete this script and wipe the sectors of the files? Use the script ourselves silently? Or are we getting too worried and is it safe to release the script?

EDIT: Thank you all for the wonderful advice. After a day I've calmed down a little and thought about my dilemma logically. Yes, we have tested the exploit and it works, increasing our income by 1%, which is $0.70/day. I decided to approach the developer and inform him about the bug. I'll slowly ease my way in and make it seem like I'm trying to help him. If he's rich he might be generous. If not, nothing is lost and I don't have to worry about this anymore.

I'm not a white-hat or black-hat or any-hat hacker who searches for exploits in my free time, or has a passion for it. I'm just a user of the software who came up with this idea one day. I also never thought of adding the discovery to my resumé and taking credit if the dev accepts our bug report.

If we release it as open-source, we have to worry about being traced and hitmen, only for $0.70 more a day. The other users collectively save $120k but we only save $0.70. If we tell the dev, we have something to gain but nothing to lose.

Also, this prevents people in the future from stumbling upon the exploit themselves, not realizing the implications, and releasing it.

Obviously the topic can't be re-opened because it's off-topic. I just want to tell everybody who's read this so far.

closed as off-topic by Sjoerd, Steffen Ullrich, John Wu, Xiong Chiamiov, schroeder Jun 30 '17 at 19:04

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Sjoerd, Steffen Ullrich, John Wu, Xiong Chiamiov, schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    I think this is off-topic and/or primarily opinion based. That's why not an answer but a comment: You already figured out that it is probably illegal and that it definitely causes harm. Unless you exactly want this to do or profit yourself in a way you find unethical yourself don't use it and don't release it. Even better, you might contact the developer of the original software and inform him about the problem so it can be fixed before others cause harm the same way. – Steffen Ullrich Jun 30 '17 at 17:45
  • 'an idea for a program' - are you sure it will work? A program with that kind of revenue will have been scrutinized by many more eyes than just yours, yet nobody cottoned up to a 30-line script security flaw. However, you could simply contact the developer and ask whether there's any reward for finding bugs. – LSerni Jun 30 '17 at 18:03
  • Try to contact the developer, check if the developer had a public bug bounty or responsible vulnerability disclosure program, agree a term for disclosure with them. You might want to contact an experienced security researcher to help you with the responsible disclosure, who will help you not to get caught in unwarranted retaliation. – Lie Ryan Jul 1 '17 at 0:53
  • Once the term of the responsible disclosure are finished (usually a set time after you reported the issue, to allow the developer the chance to fix and deploy to their users), you may choose to release the vulnerability publicly, and take credit for it, which will look good in your resume if you decide a security career. Note that not all vulnerabilities are worthwhile for public disclosure. If the vulnerability only affects the developers rather than users, then there would be little public benefit from publishing the vulnerability. – Lie Ryan Jul 1 '17 at 0:54

Things like this will be going on all the time. What you need to understand is that the developer will simply find out what's wrong with their software, patch the bug and move on.

However, if you've distributed the script to other people this makes what you are doing very illegal and I highly recommend deleting the script and never using it again.

As Steffen Ulrich has said, you could contact the developer about the problem and who knows, they might reward you for discovering such a bug.


Delete this script and wipe the sectors of the files?

Yes, but not for the reasons you think.

Use the script ourselves silently?

Are you seriously asking for validation to do something unethical and illegal for personal gain?

Or are we getting too worried and is it safe to release the script?

Also illegal, and foolish, as it will ultimately be attributable to you.

Congratulations, you figured out a way to rip off a darkweb druglord/bitcoin exchange. You're also smart enough to realize actually going through with it is a bad idea. Consider this an enlightening experience in the principles of penetration testing and just go do something else.

You're not obligated to divulge this and without legal counsel, you shouldn't. When people divulge exploits to vendors, it's a very carefully orchestrated exchange with a lot of legal assistance-- it's not just an email saying "Hey bro, I spent the weekend hacking your site. Let's talk."

But you don't need to be paranoid that just because you developed it and did nothing with it (yet), he's already on to you and the black helicopters are going to start circling your house.

If anything, if you're truly that afraid of the target, you need to make sure you secure whatever copies of this script are out there and make sure your partner is not greedy or irrational enough to take the script and exploit it on his own. All collaborative criminal enterprises are eventually brought down because one of the partners did something stupid.

Not the answer you're looking for? Browse other questions tagged or ask your own question.