Questions tagged [ethics]

The branch of philosophy which deals with how the professionals should make decisions regarding professional and social conduct

Filter by
Sorted by
Tagged with
2
votes
1answer
62 views

Alternative approaches to letting users identify themselves while maintaining privacy

This is kind of a weird question maybe, so let me explain a little background first that I hope is relevant. I work as a Developer/Analyst for an organization that operates in a federated model with ...
2
votes
0answers
90 views

Where is the line drawn for ethical hackers using stolen credentials in their paid services? [closed]

When “ethical” hackers/pen testers harvest repositories of stolen credentials to then use them in pen testing for paying clients, what ethical boundaries are broken? If a lazy hacker leaves their ...
0
votes
1answer
342 views

“I hacked my way into this interview”: Is this a good idea for getting a job? [closed]

There's been some joking on the internet where a candidate would "hack their way into getting a job interview" and disclose that as a proof of skill in a job related to Infosec. If I somehow find a "...
6
votes
1answer
345 views

While cleaning up a hacked Wordpress site, I got access to the hacker's database. What action should I take?

I've just finished cleaning up a compromised Wordpress site; it was hacked through a vulnerable plugin & several fake sitemaps & redirects set up to pollute google results with pharma ads etc. ...
3
votes
3answers
229 views

How ethical is it to publish an (anonymous) password list from real sources

I'm currently doing security research on the dangers of using default or well known 'secrets' for applications. To test how big of an issue this actually is, I decided to download local copies of ...
-1
votes
2answers
1k views

What is difference between cracking and ethical hacking?

Today I read about ethical hacking and cracking. I read that ethical hacking is legal but cracking is illegal. The confusion came in my mind when I think that both are same. So how can we identify ...
2
votes
0answers
83 views

Security issue found in login system no resolved. Next Step?

Approximately 8 months ago I found and reported a serious security issue surrounding a website I use. This website holds confidential and protected personally identifiable information. I called the ...
6
votes
3answers
214 views

As a security compliance professional, what should I do if I find that my employer has a PCI AOC but is not compliant?

I have an ethical dilemma. A couple of weeks ago, I accepted a security compliance role. For the past five years I have been working as a PCI QSA before accepting this role. In the short time that I ...
4
votes
1answer
149 views

How to responsibly disclose a vulnerability in a widespread algorithm?

Just to be clear, this is purely hypothetical. Yesterday I got hit in the head with some bricks and, in the haze of concussions, discovered a perfect preimage attack on SHA2. For any given hash, I ...
3
votes
3answers
222 views

Multiple Passwords Appear to Log Into Single Account on Major Website

I have a single account for a very popular website. I noticed that certain variations of my set password will successfully log me in. I have tested the variations on 3 separate browsers and all have ...
0
votes
1answer
228 views

Is an exploit that exposes the balance of any account in the bank a high risk exploit?

I have found an exploit to get account balance information for any account in my bank website. What is the level of this exploit (risk, medium, low)? and is it ethical to ask for a prize or money ...
8
votes
1answer
202 views

Should I follow up on vulnerabilities that were disclosed over a year ago but have not been fixed?

Background: A few years ago, I asked this question about disclosing somewhat serious vulnerabilities found in my high school's computer network. More than two years later, the principal was made ...
-2
votes
2answers
291 views

I developed a very disruptive program with major implications. What next? [closed]

Long story short and without giving away too many details, I and my business partner came up with an idea for a program. It essentially bypasses the monetization feature of another piece of software ...
4
votes
2answers
314 views

What to do if you think you discovered a zero day vulnerability? (white hat style) [duplicate]

Does anybody discovered a zero day vulnerability? I know some black hat hackers sell that kind of info on deep web. But if you are a white hat... Which steps to perform? How to assure a CVE is ...
2
votes
2answers
227 views

Contacting customers of vulnerable software, is it wrong?

Say you're a security researcher who finds vulnerabilities and reports them to vendors to try and receive a bug bounty. If the vendor is not willing to pay any bounty for any vulnerability, you simply ...
2
votes
1answer
119 views

How to proceed if the admin and the responsible CERT do not resolve the issue?

About six months ago, while trying new google dorks, I stumbled upon an open folder containing personal files. To my surprise, google had led me straight to the misconfigured folder of an employee ...
1
vote
3answers
1k views

Is it legal/ethical to release commercial software with known security flaws

I am not a security professional. About 2.5 months ago I discovered systemic vulnerabilities in my employer's software with the potential for financial damage to customers if exploited. A logged in ...
6
votes
1answer
223 views

Publishing an exploit after vendor contact and patching [duplicate]

I recently discovered several serious security holes in a vendors product. I worked with them and they just released a patch. I understand this is a very competitive field so I would like to publish ...
2
votes
2answers
1k views

Ethical Hacking: Cracking my personal wireless network

I am teaching myself ethical hacking. Now, I am attempting to crack the password of my Verizon FIOS Router at home. Using Kali Linux 2 based on this website. Steps So Far On Kali Linux typed airmon-...
10
votes
1answer
471 views

How does responsible disclosure work, once vendor says it's not a security bug?

I have identified a software bug in a platform, one that causes leakage of possibly private information in situations where an app developer on that platform might not expect such leakage. It's not ...
8
votes
1answer
3k views

Hacker's code of ethics, does it exist? [closed]

We often hear the term black-hat or white-hat hacking, but it seems like these days with many companies implementing tougher policies on information security and many companies focusing on penetration ...
2
votes
2answers
4k views

Why do porn websies not use HTTPS? [closed]

It seems that information relating to porn habits is quite telling, why wouldn't porn websites make the effort in protecting them?
11
votes
1answer
2k views

Burpsuite accidental defacement, should I be concerned?

I was spidering a website with Burpsuite and the automated Form Submission caused me to unknowingly deface the main page with "555-555-0199@example.com". It took me a decent amount of time to notice ...
5
votes
3answers
145 views

Ethics & releasing research with no viable solution [duplicate]

I've been doing some pretty interesting research that involves abusing a particular technology to carry out malicious behavior. Normally, upon completion of my research, I'd hand over all of my work ...
1
vote
3answers
282 views

Possibly illegal material discovered through hacking - theoretical discussion [closed]

Lets say for instance... X has hacked Y. X does not know Y but thought Y looked and sounded suspicious over social media. X infiltrated their emails and discovered content that local authorities ...
3
votes
2answers
227 views

What should I tell my client if I see that their site is susceptible to SQL injection?

Someone asked me to take over maintaining their (quite old) website. I looked at the code, and I see that every page has calls to mysql_query, with sql strings concatenated with completely unsanitized ...
138
votes
8answers
15k views

How do I report a security vulnerability about a trusted certificate authority?

I stumbled across a huge security vulnerability in a Certificate Authority that is trusted by all modern browsers and computers. Specifically, I am able to get a valid signed certificate for a domain ...
9
votes
1answer
399 views

How to communicate a positive feeling about ethical hacking to non technical people? [closed]

Summary: For most non technical people, who hear about computer security either in the news because of some giant breach or in the movies, there are two kind of hackers: The professional people ...
4
votes
0answers
216 views

What to do if I accidentally DoS a site? [closed]

A few weeks ago I was non-maliciously using a website with server-side calculations when curiosity got the better of me and I decided to mess with some GET request values. I expected the site to give ...
7
votes
3answers
312 views

Found a security vulnerability on gov related site

So I'm unsure how to go about dealing with what I found. It's a really simple security hole, but opens lots of personal data if exploited. I was on a government utility (being vague intentionally) ...
0
votes
2answers
101 views

Legality of cookie(set by other sites) tracking

I have created a website A which asks username & password, there exists another closed source website B which again asks for login credentials. A user uses both these websites .I want to ...
5
votes
2answers
508 views

My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do? [duplicate]

Four years ago, I discovered that an applet on my college's website sends SQL queries directly to a server application. The databases contain nominal and personal information about students and grades,...
1
vote
1answer
2k views

Secure automatic authentication to samba share

I need to pull some data from network storage to a publicly available laptop that is running Linux. The network storage used to be provided via a server that could be connected to via ssh, but it has ...
10
votes
5answers
4k views

Is it ethical to use ReCAPTCHA to decode house addresses? [closed]

I noticed recently that ReCAPTCHA is using house numbers and street numbers as images for humans to decode. How ethical is it for Google to do this to this? Does it hamper privacy of an individual? ...
4
votes
4answers
1k views

Ethical brute force demo on a web login when knowing the password complexity requirements

We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks. I wanted ...
8
votes
2answers
319 views

Ethical question regarding accessible sensitive data at school [duplicate]

Skip to the fifth paragraph for the actual question, before that is some background. I am a highschool student with an interest in computers and penetration testing. Given the restrictions placed on ...
4
votes
2answers
184 views

2000 Sets of Personal Information

So the story goes like this.. I recently rediscovered an old website i used to go on quite often but i couldn't remember my login. The site is poorly made and hasn't been updated in about 5 years, so ...
2
votes
1answer
180 views

Ethicality of websites that test other sites for Heartbleed [closed]

I realize that this may be more of an opinion type question, but I see a lot of questions on ethics in this forum so I hope mine fits in. I was reading a BBC article about Heartbleed, and in the ...
5
votes
3answers
244 views

Fixing security issues without boss/client's authorisation

I have a fair number of security concerns with a client's operation and it made me think about all the security concerns I've observed and noticed throughout the years with different clients/jobs. ...
2
votes
2answers
159 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
7
votes
4answers
357 views

Best practice for informing a website they've been compromised?

I've received a spam email that claims to be invoicing me for some service in New Jersey, USA with whom I've not had any dealings. The email includes a link to a zip file that is hosted on a greek ...
1
vote
2answers
193 views

Advice of responsible disclosure

Some time ago, I hacked into my school's internet integrated system, and I had the entire database(users, passwords, photos and whatsoever) and source code of it. At some point, I disclosed the ...
3
votes
3answers
1k views

Ethics question, post-publication of 'DIY hack' that implies security hack

I've read this post at length, but I believe this question is subtly different. Consider this scenario: a municipal, non-profit organization has a website with authentication (username, password). ...
2
votes
1answer
139 views

Ethical approach about corporate website and vulnerabilities [closed]

I like web security and i have academic formation about that. Just for fun I found a website (insurance company) with critical vulnerabilities like xss or sql injection. Now, I obviously will alert ...
3
votes
7answers
664 views

How to provide security for passwords stored in Database? [duplicate]

Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
6
votes
3answers
519 views

How and where can I best announce an XSS vulnerability in a relatively well-known website?

I'd like advice on how and where to announce an XSS vulnerability (persistent XSS to be exact). My greatest fear is the announcement getting snowed under, thus rendering the disclosure ineffective in ...
15
votes
4answers
17k views

Is decompiling software considered unethical or illegal?

Is decompiling a dynamic link library considered unethical/illegal or blackhat? If, for instance, the result of the decompile showed methods and literals that contain passwords that the application ...
6
votes
3answers
223 views

Disclosure in potential loss-of-life situations, with an uncooperative vendor

I recently discovered a publicly accessible web interface to a highly sensitive bit of lab equipment, the malfunction of which would result in potential loss of life or serious health concerns to a ...
3
votes
1answer
228 views

Encoding HTML email content

Say I have a form on my website. The input elements of the form are: email address, name and some feedback textarea. The server-side application that this form is submitted to will send an HTML ...
29
votes
4answers
6k views

Consequences of grey hat hacking

While I was working on a anomaly detection system (finding cheaters in a quite popular online game service) I accidentally found a way to get a password of a user in a reasonable amount of time. ...