4

So the story goes like this..

I recently rediscovered an old website i used to go on quite often but i couldn't remember my login. The site is poorly made and hasn't been updated in about 5 years, so i tried a simple SQL-Injection to gain access to my old account and lo and behold, i was in. The problem is that i (and anyone else with a bit of SQL knowledge) have access to ~2000 users:

  • Email
  • Password (Plain/text)
  • Full Name
  • Date of Birth
  • Private Messages

So i did the right thing, I sent an email to the owner of the site. It's been over a month and no response or changes to the site.

My question being:

What should i do in this position? Should i try to take down the site in a "not so legal" way? i doubt the owner will do anything about it. It's an old site with not more than 10-40 people online at one given time but a lot of people reuse emails and passwords so i bet that a lot of them could work on other more important accounts.

  • Should i try to take down the site in a "not so legal" way? No... – Abe Miessler May 1 '14 at 21:17
4

StackExchange is not the place for legal or ethical advice. Nonetheless, here are some possible course of actions (I'm not advising you on any of them).

First, note that you may have broken the law just by accessing that information in the first place, but that's an aside.

Actions you could take:

  • Nothing, do nothing and simply learn from this experience. Make sure your clients do not expose themselves this way.
  • Continue to attempt alerting the owners. A whois lookup will provide you with the details needed. Even if this is a private registration, the registrar (listed in leu of the real owner) will have records of the owner and can reach them.
  • Additionally, you can report this as a threat to the FBI if the vulnerability is not fixed. (http://www.fbi.gov/report-threats-and-crime)
  • Yet another idea would be to alert each person on that list about the issue.
  • While you could certainly do nefarious things, I would not. For one thing, this 'exploit' may be a honeypot or you could become the interest of an investigation.

Bear in mind that you are likely not the first person to discover this vulnerability. Thus the exposed data has been out there for some time and so even taking it down now wouldnt change the fact that it is now compromised.

Once again, I am not advising any particular course of action.

Edit: I reread your question. It seems you already did break the law by performing a SQL-injection so keep that in mind when making your decision.

Edit 2: Here are two more relevant links in reporting vulnerabilities:

|improve this answer|||||
12

Do absolutely nothing else with or at the site.

Don't make things worse.

In many jurisdictions you may have already crossed the line into not so legal. (You should get legal advice from a computer crime specialist lawyer in your jurisdiction about what you've done, by the way.)

You have notified the site owner, which we commend you for, and your lawyer will yell at you for. If they ignore it, that's down to them.

Lastly, if you've used that password anywhere else, change it there immediately.

|improve this answer|||||
  • 1
    I agree with everything @GrahamHill has said. I especially agree that you should think about consulting a lawyer as you have publicly admitted to hacking a website, which is almost certainly a crime. – GdD May 1 '14 at 8:16
  • Legally, I agree, but ethically ... assuming no reply, and just ignoring the issue? That's just not right. Could anyone elaborate on what's ethically right? :) – domen May 1 '14 at 10:28
  • 2
    @domen - Leaving it alone is ethically best. If you don't care about legal consequences, you could anonymously inform the ~2000 exposed users via email (from a public IP not linkable to you) that the site does not store their information securely and that you have recovered their names, pws, dobs (do not include this in the email). Personally, I would not do that. There are repercussions to this action; if any user then tests the site for flaws they could use the data unethically. Or the site owners could sue/prosecute you for hacking their site if your actions scare off their userbase. – dr jimbob May 1 '14 at 17:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.