1

Some time ago, I hacked into my school's internet integrated system, and I had the entire database(users, passwords, photos and whatsoever) and source code of it. At some point, I disclosed the password of the admin, and because of it, some random person put random cows in the site and I got caught by social engeneering.

The problem now are two:

  • They still think I just had their passwords, and it bugs me that somewhere in the future they will discover the other things I still have.
  • At least 5 other schools still have the same problem, and I fear I could be indicated as the responsible if someone else manages to rediscover the vuln.

So, how do I deal with this situation? Do I keep everything to myself and expect it to be forgotten when the system gets obsolete? Or do I risk to going to them and telling them so?

Note: I did got punished because of doing what I did from my school(I got expelled) but that was it. My question now is that the other sites have exactly the same vulnerability (the same software of the same vendor), and I was asking about disclosing it or not.

|improve this question
  • 1
    You do not have the option for 'responsible disclosure' any more. You have tainted yourself, the evidence, and your honour. As others have mentioned, you need to talk to an attorney. – schroeder♦ Dec 9 '13 at 23:56
5

The actions you described constitute at least one felony.

Regarding the ethics of this type of disclosure:

If you had discovered this vulnerability by chance alone and immediately reported it, you might not have gotten in trouble.

Your self-described actions differ however, in that you not only intentionally breached the system's security and made copies of sensitive / proprietary data, you also disclosed administrative-level credentials to a third party without prior written authorization to do so, and then got "caught" through social engineering.

You don't need our advice, you need an attorney.

|improve this answer
  • I have already gotten expelled for what I have done (with my particular school), and for what they know there is no more problems. But the problem now are the other ones. – user35393 Dec 9 '13 at 23:09
  • That is, publicly I have received what they wanted, but they still don´t know the other part. – user35393 Dec 9 '13 at 23:10
  • 2
    You need an attorney. – Panther Modern Dec 9 '13 at 23:37
1

You have a legal problem, not an IT Security problem. Contact a lawyer and do as they say. They will be able to advise on how wise it would be (bearing in mind your legal problems), to proceed with responsible disclosure of the still-present vulnerability.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.