How to report vulnerabilities without being regarded as a hacker?

Question

I just discovered that my university alumni's login page is just plain HTTP. Wireshark confirmed that the credentials are sent using an HTTP POST message. I did a bit of research and, as I thought, HTTPS should always be used on the login page (See Is it secure for a site to serve the login page with HTTP, but have the actual site in HTTPS?).

First of all, I'd like to do my university a favour, but how can I make them to take some actions? It's highly probable that my personal data, such as degree and year graduated, is store on the alumni database. It's not surprising that some organizations don't take such a report seriously (See How do I report a vulnerability to a large organization that doesn't believe it has a problem?). I've emailed the university's IT helpdesk using my alumni email account, but the personnel asked me to direct my inquiry to a general alumni inquiry email.

On top of the technical details, how can I make sure that no police will arrest me for hacking? I have not attempted to steal any personal information. I am not interested to report this vulnerability to some security forum before the university takes some action.

P.S. I'm embarrassed that my CS degree was from that school.

Answer 1

Simply reporting that it is using HTTP rather than HTTPS for login and that that is insecure shouldn't get you accused of hacking. It is something immediately publicly visible from looking at the site.

There are many ways of detecting vulnerabilities which could actually be considered hacking (for example, running a vulnerability scanner against a target you aren't authorized to run it against), but I'm not aware of any jurisdictions that would consider looking at the page and recognizing a flaw that is immediately visible to be hacking. It would be a bit like walking by a house, noticing that someone was leaving their door open when they were leaving and being accused of being a thief when you pointed out to them they left the door open (while you aren't even standing on their property.)

Answer 2

If they ignore your emails, you may try reporting them to organisation responsible for enforcing Data Protection Act. I don't know where are you from, in UK it would be http://ico.org.uk/concerns

They have a responsibility to keep your data safe.

Answer 3

First, you cannot make anyone do anything. As an alum, you can raise your own personal concerns that your credentials are exposed, but that's about it.

I'm not sure how anyone would regard your stated actions as hacking, but that is dependent on your jurisdiction. In mine, capturing your own packets is not illegal at all.

It is unfortunate that the IT support shuttled you off to the general email bin, but you have to follow their procedures.

Answer 4

Here is my approach:

Try to find out if your University has a person who is responsible for security. Maybe they have a company which does that or they have a department. If so, try to contact these people. They often know what you're talking about.

When contacting them, you don't need to tell them about wireshark. Say "I noticed that the site uses HTTP and, since I work in computer security, I know that means my name and password will be sent over the Internet without any protection of any kind. Any malicious person in any network between you and me could steal my identity this way. Are you aware of this?"

So the first goal is: "I found a risk and I know what I'm talking about". Then see how they respond. This isn't a life-threatening situation. It's OK if it takes a couple of days to resolve. You can use several mails to make your point.

If they refuse to believe you, then give them a recipe how they can see for themselves (install Wireshark, use this rule, do the login, look back what Wireshark shows you). That way, they run the "bad" tool. At no time, you need to tell them what you did on your own computer. If pressed, you can say "I used the security tools of my company to capture the data which my browser sends to you and I saw that ..."

Answer 5

TL;DR - Being professional and humble will go a long way. Being secretive, prideful, or malicious will obviously not end so well. If you calmly and privately work with them, they're likely to do the same.

This sounds almost cut and paste to how I started finding issues with my university's security. My university was putting the student's ID in a cookie and that's who you were signed in as. If you manipulated the cookie, you signed in as whoever you wanted. It was the discovery that led me to look deeper into their security. They also had an insecure mail server that would relay anything without authentication. The filenames of the images in the school directory were just a weird encoding of that student's ID. At one point, I could look up an SSN and get a student's name.

I found these bugs a little at a time. It started with a sense of "My information needs to be safe and it's not" and I would point out the latest flaw I discovered to IT. After about the 3rd time I reported something, I began feeling both angry and superior to the department. Every other week I'd be in the Vice President's of Technologies office pointing out a new way to get SSNs or financial records of students as far back as 1995 or some stalker technique to determine somebody's entire class schedule (including their letter grade in that class). The VP also began to get hostile with me. I admit I may not have had the best attitude after the 6 month mark. At one point I was expelled for about 3 weeks when they heard I was trying to reverse engineer their encoding (linked above). I wanted to show them what holes were vulnerable when an individual wasn't working with them and they were in the dark. Eventually we sorted it out, but there was a lot of anger, paperwork, and ego going around in the mean time on both sides.

The point I'm trying to make is that the IT department worked with me despite me being a jerk. They fixed the problems and the school is better off for it. As long as I was upfront about my intentions and open about what I was doing, they didn't threaten me or hinder me. It wasn't until I was working in secret that they took disciplinary action. I was all over the board with things that absolutely could be considered hacking including injection attacks, social engineering, reverse engineering, packet sniffing, port scanning, custom software exploits, and more. Since I never changed anything and always (well... usually) reported my findings quietly and directly to them, they worked with me. I have no doubt that if I wasn't an ass then I wouldn't have been temporary expelled.

Answer 6

There is a service provided by Hewlett-Packard Tipping Point called the Zero Day Initiative. http://www.zerodayinitiative.com/

Here's how it works.

1. They BUY the vulnerability from you
2. HP Tipping Point gives protection to its customer base of smart firewall users
3. ZDI works out with the vendor to try to get the issue fixed (this typically can take 6 months)
4. If the vendor won't respond or budge, then ZDI reports the vulnerability publicly.

As you can see, you're done at step 1, and you get money, and you get to stay anonymous.

Answer 7

At times it's very difficult to explain the importance of security to people. Some people just do not understand security and others feel that their system won't ever get compromised. Reporting a security threat at times get ignored or takes a very long time to be fixed. From my experience to get your point across to improve security, I would demo the attack. When you demo an attack, I would suggest you use your own box where you can setup a similar environment. Doing this you can show people visually how data can be stolen.

Answer 8

This is a fairly difficult issue, as companies and universities have a long and proud history of reacting with hostility and shooting the messenger in cases like this. And there's no guarantee that you won't be prosecuted for nothing more than noticing their insecurity. They might not have a case against you, but that doesn't mean they can't make you miserable.

So here's a few ideas that might help.

• Remain Anonymous: There are many ways to protect your identity. I won't go in to them here, but for the most part you don't have to identify yourself to disclose a vulnerability. If you're worried about retaliation, it may be best that you don't.

• Don't disclose directly: While it would be ideal for you to deal with the issue privately, doing so affords you little to no protection if they decide to retaliate. Disclosing the vulnerability through a trusted third party shields you somewhat from direct action by preventing them from controlling the story. Often indirect disclosure is a way to maintain anonymity.

• Focus on their negligence rather than their vulnerability: If you preemptively assume moral high ground, attacking you would paint them as more negligent, rather than less so. It is extremely difficult (and extremely rare) for a service that has been accused primarily of negligence to paint their whistleblower as a criminal. Simply pointing out their poor security doesn't afford you any moral superiority, and give them the opportunity to paint themselves as the victims by accusing you of criminal misconduct. Don't give them that out.

Answer 9

Judging by what you said there's no evidence of you attempting to hack. You simply monitored the incoming and outgoing requests of your own network.

If you're still sticky on the situation, try contacting the Privacy Commissioner in Canada to see what they recommend. https://www.priv.gc.ca/

Answer 10

This seems more like a psychology/sociology question than a security one, as the issue seems to be how to best communicate with another party and convince them to take a specific action. I can't believe that any 'hacking' charge could have real legal ramifications for the reasons other answers have explained.

An alternative approach to those above is to practice a strong offense. If they refuse to acknowledge your emails, send a semi-threatening one in a polite but firm tone explaining that if they do not address this security vulnerability to protect your personal data, you may need to take legal action to protect yourself. This may or may not be practical, depending on what personal information they actually store of yours.

This approach naturally sets up a confrontational interaction, so consider carefully before heading down this road.