Skip to main content

Questions tagged [ethics]

The branch of philosophy which deals with how the professionals should make decisions regarding professional and social conduct

Filter by
Sorted by
Tagged with
0 votes
0 answers
47 views

How will the integration of AI impact cybersecurity? [closed]

With advancements in AI, there's a growing interest in cybersecurity. How will AI technologies enhance or transform traditional cybersecurity approaches, and what challenges might arise in terms of ...
IncidentHandler_35's user avatar
1 vote
1 answer
141 views

Does black hat always equal illegal? [closed]

I often hear of black-hat hacking discussed as if it was synonymous with illegal hacking. In other words, an act of hacking is black-hat iff it is illegal. Our own tag wiki for black-hat defines it as ...
Robert Columbia's user avatar
2 votes
1 answer
143 views

Alternative approaches to letting users identify themselves while maintaining privacy

This is kind of a weird question maybe, so let me explain a little background first that I hope is relevant. I work as a Developer/Analyst for an organization that operates in a federated model with ...
Cowman's user avatar
  • 123
2 votes
0 answers
152 views

Where is the line drawn for ethical hackers using stolen credentials in their paid services? [closed]

When “ethical” hackers/pen testers harvest repositories of stolen credentials to then use them in pen testing for paying clients, what ethical boundaries are broken? If a lazy hacker leaves their ...
Dakent's user avatar
  • 21
0 votes
1 answer
481 views

"I hacked my way into this interview": Is this a good idea for getting a job? [closed]

There's been some joking on the internet where a candidate would "hack their way into getting a job interview" and disclose that as a proof of skill in a job related to Infosec. If I somehow find a "...
ChocolateOverflow's user avatar
6 votes
1 answer
441 views

While cleaning up a hacked Wordpress site, I got access to the hacker's database. What action should I take?

I've just finished cleaning up a compromised Wordpress site; it was hacked through a vulnerable plugin & several fake sitemaps & redirects set up to pollute google results with pharma ads etc. ...
jammypeach's user avatar
3 votes
3 answers
303 views

How ethical is it to publish an (anonymous) password list from real sources

I'm currently doing security research on the dangers of using default or well known 'secrets' for applications. To test how big of an issue this actually is, I decided to download local copies of ...
Paradoxis's user avatar
  • 872
-1 votes
2 answers
2k views

What is difference between cracking and ethical hacking?

Today I read about ethical hacking and cracking. I read that ethical hacking is legal but cracking is illegal. The confusion came in my mind when I think that both are same. So how can we identify ...
Ijlal Hussain's user avatar
2 votes
0 answers
149 views

Security issue found in login system no resolved. Next Step?

Approximately 8 months ago I found and reported a serious security issue surrounding a website I use. This website holds confidential and protected personally identifiable information. I called the ...
Jim Baize's user avatar
6 votes
3 answers
354 views

As a security compliance professional, what should I do if I find that my employer has a PCI AOC but is not compliant?

I have an ethical dilemma. A couple of weeks ago, I accepted a security compliance role. For the past five years I have been working as a PCI QSA before accepting this role. In the short time that I ...
SecPro's user avatar
  • 69
4 votes
1 answer
248 views

How to responsibly disclose a vulnerability in a widespread algorithm?

Just to be clear, this is purely hypothetical. Yesterday I got hit in the head with some bricks and, in the haze of concussions, discovered a perfect preimage attack on SHA2. For any given hash, I ...
Hovercouch's user avatar
3 votes
3 answers
299 views

Multiple Passwords Appear to Log Into Single Account on Major Website

I have a single account for a very popular website. I noticed that certain variations of my set password will successfully log me in. I have tested the variations on 3 separate browsers and all have ...
thechimp's user avatar
  • 133
0 votes
1 answer
294 views

Is an exploit that exposes the balance of any account in the bank a high risk exploit?

I have found an exploit to get account balance information for any account in my bank website. What is the level of this exploit (risk, medium, low)? and is it ethical to ask for a prize or money ...
badr aldeen's user avatar
8 votes
1 answer
282 views

Should I follow up on vulnerabilities that were disclosed over a year ago but have not been fixed?

Background: A few years ago, I asked this question about disclosing somewhat serious vulnerabilities found in my high school's computer network. More than two years later, the principal was made ...
Anonymous's user avatar
-2 votes
2 answers
369 views

I developed a very disruptive program with major implications. What next? [closed]

Long story short and without giving away too many details, I and my business partner came up with an idea for a program. It essentially bypasses the monetization feature of another piece of software ...
user152225's user avatar
4 votes
2 answers
418 views

What to do if you think you discovered a zero day vulnerability? (white hat style) [duplicate]

Does anybody discovered a zero day vulnerability? I know some black hat hackers sell that kind of info on deep web. But if you are a white hat... Which steps to perform? How to assure a CVE is ...
OscarAkaElvis's user avatar
2 votes
2 answers
318 views

Contacting customers of vulnerable software, is it wrong?

Say you're a security researcher who finds vulnerabilities and reports them to vendors to try and receive a bug bounty. If the vendor is not willing to pay any bounty for any vulnerability, you simply ...
David Davidson's user avatar
2 votes
1 answer
188 views

How to proceed if the admin and the responsible CERT do not resolve the issue?

About six months ago, while trying new google dorks, I stumbled upon an open folder containing personal files. To my surprise, google had led me straight to the misconfigured folder of an employee ...
J.A.K.'s user avatar
  • 4,853
1 vote
3 answers
2k views

Is it legal/ethical to release commercial software with known security flaws

I am not a security professional. About 2.5 months ago I discovered systemic vulnerabilities in my employer's software with the potential for financial damage to customers if exploited. A logged in ...
user avatar
6 votes
1 answer
323 views

Publishing an exploit after vendor contact and patching [duplicate]

I recently discovered several serious security holes in a vendors product. I worked with them and they just released a patch. I understand this is a very competitive field so I would like to publish ...
Jason's user avatar
  • 3,106
2 votes
2 answers
2k views

Ethical Hacking: Cracking my personal wireless network

I am teaching myself ethical hacking. Now, I am attempting to crack the password of my Verizon FIOS Router at home. Using Kali Linux 2 based on this website. Steps So Far On Kali Linux typed airmon-...
Rhonda's user avatar
  • 143
10 votes
1 answer
693 views

How does responsible disclosure work, once vendor says it's not a security bug?

I have identified a software bug in a platform, one that causes leakage of possibly private information in situations where an app developer on that platform might not expect such leakage. It's not ...
CommonsWare's user avatar
8 votes
1 answer
3k views

Hacker's code of ethics, does it exist? [closed]

We often hear the term black-hat or white-hat hacking, but it seems like these days with many companies implementing tougher policies on information security and many companies focusing on penetration ...
Michael Lai's user avatar
2 votes
2 answers
4k views

Why do porn websies not use HTTPS? [closed]

It seems that information relating to porn habits is quite telling, why wouldn't porn websites make the effort in protecting them?
whatever489's user avatar
11 votes
1 answer
3k views

Burpsuite accidental defacement, should I be concerned?

I was spidering a website with Burpsuite and the automated Form Submission caused me to unknowingly deface the main page with "[email protected]". It took me a decent amount of time to notice ...
QUEX0R's user avatar
  • 113
5 votes
3 answers
207 views

Ethics & releasing research with no viable solution [duplicate]

I've been doing some pretty interesting research that involves abusing a particular technology to carry out malicious behavior. Normally, upon completion of my research, I'd hand over all of my work ...
haze's user avatar
  • 468
1 vote
3 answers
342 views

Possibly illegal material discovered through hacking - theoretical discussion [closed]

Lets say for instance... X has hacked Y. X does not know Y but thought Y looked and sounded suspicious over social media. X infiltrated their emails and discovered content that local authorities ...
JohnDoe's user avatar
  • 43
3 votes
2 answers
285 views

What should I tell my client if I see that their site is susceptible to SQL injection?

Someone asked me to take over maintaining their (quite old) website. I looked at the code, and I see that every page has calls to mysql_query, with sql strings concatenated with completely unsanitized ...
clum's user avatar
  • 157
142 votes
8 answers
16k views

How do I report a security vulnerability about a trusted certificate authority?

I stumbled across a huge security vulnerability in a Certificate Authority that is trusted by all modern browsers and computers. Specifically, I am able to get a valid signed certificate for a domain ...
MotorStoicLathe's user avatar
9 votes
1 answer
485 views

How to communicate a positive feeling about ethical hacking to non technical people? [closed]

Summary: For most non technical people, who hear about computer security either in the news because of some giant breach or in the movies, there are two kind of hackers: The professional people ...
undo's user avatar
  • 2,125
4 votes
0 answers
414 views

What to do if I accidentally DoS a site? [closed]

A few weeks ago I was non-maliciously using a website with server-side calculations when curiosity got the better of me and I decided to mess with some GET request values. I expected the site to give ...
Tokamocha's user avatar
  • 141
7 votes
3 answers
387 views

Found a security vulnerability on gov related site

So I'm unsure how to go about dealing with what I found. It's a really simple security hole, but opens lots of personal data if exploited. I was on a government utility (being vague intentionally) ...
Un Named's user avatar
0 votes
2 answers
166 views

Legality of cookie(set by other sites) tracking

I have created a website A which asks username & password, there exists another closed source website B which again asks for login credentials. A user uses both these websites .I want to ...
Puneet S. Chauhan's user avatar
5 votes
2 answers
576 views

My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do? [duplicate]

Four years ago, I discovered that an applet on my college's website sends SQL queries directly to a server application. The databases contain nominal and personal information about students and grades,...
Concerned Kid's user avatar
1 vote
1 answer
2k views

Secure automatic authentication to samba share

I need to pull some data from network storage to a publicly available laptop that is running Linux. The network storage used to be provided via a server that could be connected to via ssh, but it has ...
StrongBad's user avatar
  • 261
10 votes
5 answers
4k views

Is it ethical to use ReCAPTCHA to decode house addresses? [closed]

I noticed recently that ReCAPTCHA is using house numbers and street numbers as images for humans to decode. How ethical is it for Google to do this to this? Does it hamper privacy of an individual? ...
Vineet Menon's user avatar
4 votes
4 answers
1k views

Ethical brute force demo on a web login when knowing the password complexity requirements

We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks. I wanted ...
Belmin Fernandez's user avatar
8 votes
2 answers
389 views

Ethical question regarding accessible sensitive data at school [duplicate]

Skip to the fifth paragraph for the actual question, before that is some background. I am a highschool student with an interest in computers and penetration testing. Given the restrictions placed on ...
Anonymous's user avatar
4 votes
2 answers
242 views

2000 Sets of Personal Information

So the story goes like this.. I recently rediscovered an old website i used to go on quite often but i couldn't remember my login. The site is poorly made and hasn't been updated in about 5 years, so ...
b00n's user avatar
  • 151
2 votes
1 answer
240 views

Ethicality of websites that test other sites for Heartbleed [closed]

I realize that this may be more of an opinion type question, but I see a lot of questions on ethics in this forum so I hope mine fits in. I was reading a BBC article about Heartbleed, and in the ...
LB2's user avatar
  • 420
5 votes
3 answers
306 views

Fixing security issues without boss/client's authorisation

I have a fair number of security concerns with a client's operation and it made me think about all the security concerns I've observed and noticed throughout the years with different clients/jobs. ...
ScottMcGready's user avatar
2 votes
2 answers
216 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
735Tesla's user avatar
  • 379
7 votes
4 answers
434 views

Best practice for informing a website they've been compromised?

I've received a spam email that claims to be invoicing me for some service in New Jersey, USA with whom I've not had any dealings. The email includes a link to a zip file that is hosted on a greek ...
kobrien's user avatar
  • 173
1 vote
2 answers
265 views

Advice of responsible disclosure

Some time ago, I hacked into my school's internet integrated system, and I had the entire database(users, passwords, photos and whatsoever) and source code of it. At some point, I disclosed the ...
user35393's user avatar
3 votes
3 answers
1k views

Ethics question, post-publication of 'DIY hack' that implies security hack

I've read this post at length, but I believe this question is subtly different. Consider this scenario: a municipal, non-profit organization has a website with authentication (username, password). ...
Michael Easter's user avatar
2 votes
1 answer
192 views

Ethical approach about corporate website and vulnerabilities [closed]

I like web security and i have academic formation about that. Just for fun I found a website (insurance company) with critical vulnerabilities like xss or sql injection. Now, I obviously will alert ...
daniel__'s user avatar
  • 131
3 votes
7 answers
768 views

How to provide security for passwords stored in Database? [duplicate]

Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
Vikas V's user avatar
  • 683
6 votes
3 answers
621 views

How and where can I best announce an XSS vulnerability in a relatively well-known website?

I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
Anonymous's user avatar
18 votes
4 answers
23k views

Is decompiling software considered unethical or illegal?

Is decompiling a dynamic link library considered unethical/illegal or blackhat? If, for instance, the result of the decompile showed methods and literals that contain passwords that the application ...
Lock's user avatar
  • 281
6 votes
3 answers
287 views

Disclosure in potential loss-of-life situations, with an uncooperative vendor

I recently discovered a publicly accessible web interface to a highly sensitive bit of lab equipment, the malfunction of which would result in potential loss of life or serious health concerns to a ...
Polynomial's user avatar
  • 135k