4

So the story goes like this..

I recently rediscovered an old website i used to go on quite often but i couldn't remember my login. The site is poorly made and hasn't been updated in about 5 years, so i tried a simple SQL-Injection to gain access to my old account and lo and behold, i was in. The problem is that i (and anyone else with a bit of SQL knowledge) have access to ~2000 users:

  • Email
  • Password (Plain/text)
  • Full Name
  • Date of Birth
  • Private Messages

So i did the right thing, I sent an email to the owner of the site. It's been over a month and no response or changes to the site.

My question being:

What should i do in this position? Should i try to take down the site in a "not so legal" way? i doubt the owner will do anything about it. It's an old site with not more than 10-40 people online at one given time but a lot of people reuse emails and passwords so i bet that a lot of them could work on other more important accounts.

1
  • Should i try to take down the site in a "not so legal" way? No... May 1, 2014 at 21:17

2 Answers 2

4

StackExchange is not the place for legal or ethical advice. Nonetheless, here are some possible course of actions (I'm not advising you on any of them).

First, note that you may have broken the law just by accessing that information in the first place, but that's an aside.

Actions you could take:

  • Nothing, do nothing and simply learn from this experience. Make sure your clients do not expose themselves this way.
  • Continue to attempt alerting the owners. A whois lookup will provide you with the details needed. Even if this is a private registration, the registrar (listed in leu of the real owner) will have records of the owner and can reach them.
  • Additionally, you can report this as a threat to the FBI if the vulnerability is not fixed. (http://www.fbi.gov/report-threats-and-crime)
  • Yet another idea would be to alert each person on that list about the issue.
  • While you could certainly do nefarious things, I would not. For one thing, this 'exploit' may be a honeypot or you could become the interest of an investigation.

Bear in mind that you are likely not the first person to discover this vulnerability. Thus the exposed data has been out there for some time and so even taking it down now wouldnt change the fact that it is now compromised.

Once again, I am not advising any particular course of action.

Edit: I reread your question. It seems you already did break the law by performing a SQL-injection so keep that in mind when making your decision.

Edit 2: Here are two more relevant links in reporting vulnerabilities:

12

Do absolutely nothing else with or at the site.

Don't make things worse.

In many jurisdictions you may have already crossed the line into not so legal. (You should get legal advice from a computer crime specialist lawyer in your jurisdiction about what you've done, by the way.)

You have notified the site owner, which we commend you for, and your lawyer will yell at you for. If they ignore it, that's down to them.

Lastly, if you've used that password anywhere else, change it there immediately.

3
  • 1
    I agree with everything @GrahamHill has said. I especially agree that you should think about consulting a lawyer as you have publicly admitted to hacking a website, which is almost certainly a crime.
    – GdD
    May 1, 2014 at 8:16
  • Legally, I agree, but ethically ... assuming no reply, and just ignoring the issue? That's just not right. Could anyone elaborate on what's ethically right? :)
    – domen
    May 1, 2014 at 10:28
  • 2
    @domen - Leaving it alone is ethically best. If you don't care about legal consequences, you could anonymously inform the ~2000 exposed users via email (from a public IP not linkable to you) that the site does not store their information securely and that you have recovered their names, pws, dobs (do not include this in the email). Personally, I would not do that. There are repercussions to this action; if any user then tests the site for flaws they could use the data unethically. Or the site owners could sue/prosecute you for hacking their site if your actions scare off their userbase.
    – dr jimbob
    May 1, 2014 at 17:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .