Questions tagged [ethics]
The branch of philosophy which deals with how the professionals should make decisions regarding professional and social conduct
71 questions
1
vote
1
answer
150
views
Does black hat always equal illegal? [closed]
I often hear of black-hat hacking discussed as if it was synonymous with illegal hacking. In other words, an act of hacking is black-hat iff it is illegal. Our own tag wiki for black-hat defines it as ...
- 119
2
votes
1
answer
151
views
Alternative approaches to letting users identify themselves while maintaining privacy
This is kind of a weird question maybe, so let me explain a little background first that I hope is relevant.
I work as a Developer/Analyst for an organization that operates in a federated model with ...
- 123
2
votes
0
answers
155
views
Where is the line drawn for ethical hackers using stolen credentials in their paid services? [closed]
When “ethical” hackers/pen testers harvest repositories of stolen credentials to then use them in pen testing for paying clients, what ethical boundaries are broken?
If a lazy hacker leaves their ...
- 21
0
votes
1
answer
530
views
"I hacked my way into this interview": Is this a good idea for getting a job? [closed]
There's been some joking on the internet where a candidate would "hack their way into getting a job interview" and disclose that as a proof of skill in a job related to Infosec.
If I somehow find a "...
- 3,482
6
votes
1
answer
458
views
While cleaning up a hacked Wordpress site, I got access to the hacker's database. What action should I take?
I've just finished cleaning up a compromised Wordpress site; it was hacked through a vulnerable plugin & several fake sitemaps & redirects set up to pollute google results with pharma ads etc.
...
- 163
3
votes
3
answers
308
views
How ethical is it to publish an (anonymous) password list from real sources
I'm currently doing security research on the dangers of using default or well known 'secrets' for applications.
To test how big of an issue this actually is, I decided to download local copies of ...
- 872
-1
votes
2
answers
2k
views
What is difference between cracking and ethical hacking?
Today I read about ethical hacking and cracking. I read that ethical hacking is legal but cracking is illegal. The confusion came in my mind when I think that both are same.
So how can we identify ...
- 101
2
votes
0
answers
153
views
Security issue found in login system no resolved. Next Step?
Approximately 8 months ago I found and reported a serious security issue surrounding a website I use. This website holds confidential and protected personally identifiable information.
I called the ...
- 83
6
votes
3
answers
372
views
As a security compliance professional, what should I do if I find that my employer has a PCI AOC but is not compliant?
I have an ethical dilemma. A couple of weeks ago, I accepted a security compliance role. For the past five years I have been working as a PCI QSA before accepting this role.
In the short time that I ...
- 69
4
votes
1
answer
253
views
How to responsibly disclose a vulnerability in a widespread algorithm?
Just to be clear, this is purely hypothetical.
Yesterday I got hit in the head with some bricks and, in the haze of concussions, discovered a perfect preimage attack on SHA2. For any given hash, I ...
- 343
3
votes
3
answers
301
views
Multiple Passwords Appear to Log Into Single Account on Major Website
I have a single account for a very popular website. I noticed that certain variations of my set password will successfully log me in. I have tested the variations on 3 separate browsers and all have ...
- 133
0
votes
1
answer
301
views
Is an exploit that exposes the balance of any account in the bank a high risk exploit?
I have found an exploit to get account balance information for any account in my bank website.
What is the level of this exploit (risk, medium, low)?
and is it ethical to ask for a prize or money ...
- 111
8
votes
1
answer
285
views
Should I follow up on vulnerabilities that were disclosed over a year ago but have not been fixed?
Background:
A few years ago, I asked this question about disclosing somewhat serious vulnerabilities found in my high school's computer network.
More than two years later, the principal was made ...
- 81
-2
votes
2
answers
373
views
I developed a very disruptive program with major implications. What next? [closed]
Long story short and without giving away too many details, I and my business partner came up with an idea for a program. It essentially bypasses the monetization feature of another piece of software ...
4
votes
2
answers
422
views
What to do if you think you discovered a zero day vulnerability? (white hat style) [duplicate]
Does anybody discovered a zero day vulnerability?
I know some black hat hackers sell that kind of info on deep web. But if you are a white hat...
Which steps to perform?
How to assure a CVE is ...
- 5,365
2
votes
2
answers
331
views
Contacting customers of vulnerable software, is it wrong?
Say you're a security researcher who finds vulnerabilities and reports them to vendors to try and receive a bug bounty. If the vendor is not willing to pay any bounty for any vulnerability, you simply ...
- 579
2
votes
1
answer
196
views
How to proceed if the admin and the responsible CERT do not resolve the issue?
About six months ago, while trying new google dorks, I stumbled upon an open folder containing personal files.
To my surprise, google had led me straight to the misconfigured folder of an employee ...
- 4,861
1
vote
3
answers
2k
views
Is it legal/ethical to release commercial software with known security flaws
I am not a security professional. About 2.5 months ago I discovered systemic vulnerabilities in my employer's software with the potential for financial damage to customers if exploited.
A logged in ...
anon
6
votes
1
answer
327
views
Publishing an exploit after vendor contact and patching [duplicate]
I recently discovered several serious security holes in a vendors product. I worked with them and they just released a patch.
I understand this is a very competitive field so I would like to publish ...
- 3,126
2
votes
2
answers
2k
views
Ethical Hacking: Cracking my personal wireless network
I am teaching myself ethical hacking.
Now, I am attempting to crack the password of my Verizon FIOS Router at home. Using Kali Linux 2 based on this website.
Steps So Far
On Kali Linux typed airmon-...
- 143
10
votes
1
answer
707
views
How does responsible disclosure work, once vendor says it's not a security bug?
I have identified a software bug in a platform, one that causes leakage of possibly private information in situations where an app developer on that platform might not expect such leakage. It's not ...
- 613
8
votes
1
answer
3k
views
Hacker's code of ethics, does it exist? [closed]
We often hear the term black-hat or white-hat hacking, but it seems like these days with many companies implementing tougher policies on information security and many companies focusing on penetration ...
- 281
2
votes
2
answers
4k
views
Why do porn websies not use HTTPS? [closed]
It seems that information relating to porn habits is quite telling, why wouldn't porn websites make the effort in protecting them?
- 868
11
votes
1
answer
3k
views
Burpsuite accidental defacement, should I be concerned?
I was spidering a website with Burpsuite and the automated Form Submission caused me to unknowingly deface the main page with "[email protected]".
It took me a decent amount of time to notice ...
- 113
5
votes
3
answers
209
views
Ethics & releasing research with no viable solution [duplicate]
I've been doing some pretty interesting research that involves abusing a particular technology to carry out malicious behavior. Normally, upon completion of my research, I'd hand over all of my work ...
- 468
1
vote
3
answers
346
views
Possibly illegal material discovered through hacking - theoretical discussion [closed]
Lets say for instance...
X has hacked Y.
X does not know Y but thought Y looked and sounded suspicious over social media.
X infiltrated their emails and discovered content that local authorities ...
- 43
3
votes
2
answers
292
views
What should I tell my client if I see that their site is susceptible to SQL injection?
Someone asked me to take over maintaining their (quite old) website. I looked at the code, and I see that every page has calls to mysql_query, with sql strings concatenated with completely unsanitized ...
- 157
143
votes
8
answers
16k
views
How do I report a security vulnerability about a trusted certificate authority?
I stumbled across a huge security vulnerability in a Certificate Authority that is trusted by all modern browsers and computers.
Specifically, I am able to get a valid signed certificate for a domain ...
- 1,051
9
votes
1
answer
491
views
How to communicate a positive feeling about ethical hacking to non technical people? [closed]
Summary:
For most non technical people, who hear about computer security either in the news because of some giant breach or in the movies, there are two kind of hackers:
The professional people ...
- 2,155
4
votes
0
answers
468
views
What to do if I accidentally DoS a site? [closed]
A few weeks ago I was non-maliciously using a website with server-side calculations when curiosity got the better of me and I decided to mess with some GET request values. I expected the site to give ...
- 141
7
votes
3
answers
405
views
Found a security vulnerability on gov related site
So I'm unsure how to go about dealing with what I found. It's a really simple security hole, but opens lots of personal data if exploited.
I was on a government utility (being vague intentionally) ...
- 81
0
votes
2
answers
173
views
Legality of cookie(set by other sites) tracking
I have created a website A which asks username & password, there exists another closed source website B which again asks for login credentials.
A user uses both these websites .I want to ...
5
votes
2
answers
580
views
My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do? [duplicate]
Four years ago, I discovered that an applet on my college's website sends SQL queries directly to a server application. The databases contain nominal and personal information about students and grades,...
1
vote
1
answer
3k
views
Secure automatic authentication to samba share
I need to pull some data from network storage to a publicly available laptop that is running Linux. The network storage used to be provided via a server that could be connected to via ssh, but it has ...
- 261
10
votes
5
answers
4k
views
Is it ethical to use ReCAPTCHA to decode house addresses? [closed]
I noticed recently that ReCAPTCHA is using house numbers and street numbers as images for humans to decode.
How ethical is it for Google to do this to this? Does it hamper privacy of an individual?
...
- 403
4
votes
4
answers
1k
views
Ethical brute force demo on a web login when knowing the password complexity requirements
We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks.
I wanted ...
- 203
8
votes
2
answers
394
views
Ethical question regarding accessible sensitive data at school [duplicate]
Skip to the fifth paragraph for the actual question, before that is some background.
I am a highschool student with an interest in computers and penetration testing. Given the restrictions placed on ...
- 81
4
votes
2
answers
245
views
2000 Sets of Personal Information
So the story goes like this..
I recently rediscovered an old website i used to go on quite often but i couldn't remember my login. The site is poorly made and hasn't been updated in about 5 years, so ...
- 151
2
votes
1
answer
243
views
Ethicality of websites that test other sites for Heartbleed [closed]
I realize that this may be more of an opinion type question, but I see a lot of questions on ethics in this forum so I hope mine fits in.
I was reading a BBC article about Heartbleed, and in the ...
- 420
5
votes
3
answers
309
views
Fixing security issues without boss/client's authorisation
I have a fair number of security concerns with a client's operation and it made me think about all the security concerns I've observed and noticed throughout the years with different clients/jobs. ...
- 271
2
votes
2
answers
218
views
Where is the Line? [closed]
A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
- 379
7
votes
4
answers
435
views
Best practice for informing a website they've been compromised?
I've received a spam email that claims to be invoicing me for some service in New Jersey, USA with whom I've not had any dealings. The email includes a link to a zip file that is hosted on a greek ...
- 173
2
votes
2
answers
271
views
Advice of responsible disclosure
Some time ago, I hacked into my school's internet integrated system, and I had the entire database(users, passwords, photos and whatsoever) and source code of it. At some point, I disclosed the ...
- 23
3
votes
3
answers
1k
views
Ethics question, post-publication of 'DIY hack' that implies security hack
I've read this post at length, but I believe this question is subtly different.
Consider this scenario: a municipal, non-profit organization has a website with authentication (username, password). ...
2
votes
1
answer
194
views
Ethical approach about corporate website and vulnerabilities [closed]
I like web security and i have academic formation about that. Just for fun I found a website (insurance company) with critical vulnerabilities like xss or sql injection. Now, I obviously will alert ...
- 131
3
votes
7
answers
784
views
How to provide security for passwords stored in Database? [duplicate]
Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
- 693
6
votes
3
answers
625
views
How and where can I best announce an XSS vulnerability in a relatively well-known website?
I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
- 61
18
votes
4
answers
23k
views
Is decompiling software considered unethical or illegal?
Is decompiling a dynamic link library considered unethical/illegal or blackhat?
If, for instance, the result of the decompile showed methods and literals that contain passwords that the application ...
- 281
6
votes
3
answers
291
views
Disclosure in potential loss-of-life situations, with an uncooperative vendor
I recently discovered a publicly accessible web interface to a highly sensitive bit of lab equipment, the malfunction of which would result in potential loss of life or serious health concerns to a ...
- 136k
3
votes
1
answer
437
views
Encoding HTML email content
Say I have a form on my website.
The input elements of the form are: email address, name and some feedback textarea.
The server-side application that this form is submitted to will send an HTML ...
