Hot answers tagged

69

It sounds like your issue is that this vulnerability is bigger than you know what to do with. The rules of responsible disclosure, as decribed here, say that you should contact the vendor and negotiate a period of time - between 1 week and 6 months, depending on the depth of the changes required - in which they can implement a patch, revoke and re-issue ...


44

Such a claim is generally quite serious. While reaching out to the vendor in question is a responsible matter, you should certainly consider notifying the relevant root store security teams, since they are responsible for designing, evaluating, and applying the security controls to prevent this, and will likely need to directly work with the CA to ascertain ...


27

Number one rule of penetration testing: don't do it on things that don't belong to you. Yes, it is merely a spider. However, people think wget is a scary hacker tool and the US govt. actually used that in a case. I appreciate that you rectified your mistake, and I think that reflects well on you. You have a few options here, depending on your moral beliefs: ...


25

Congratulations! Sounds like a major find. First, generate some proof. The github.com SSL certificate sounds like a great start. Make sure you keep all the network traces you need to show exactly what happened. You need to determine if you broke any laws or T&Cs while doing this. If the CA does not have a bug bounty, you almost certainly did. In that ...


23

There really isn't enough information here to make a determination about your question. Jurisdiction and exactly what went on with how you found a flaw in the security and how you tested it and what their terms of service (which define how you are allowed to use their computers and data) all matter. In general, "hacking" isn't what is legal or illegal, ...


23

This is a bit of a load question with a few different parts, but I think it is answerable overall. Is there a Hacker Ethos Yes and no. The main problem is the wide diversity of hacker groups that differ by targets and thus ethical code. Just to name a few: white hats usually follow the "do no harm"-type of ethics and try to close security-leaks. Regarding ...


19

Legality of reverse engineering depends on the country. As a rough summary: In the USA, it is legal as long as the software was obtained legally, but if the license prohibits it explicitly (and most software licenses do) then it is a breach of the contract which the license constitutes -- thus "illegal", but a matter of civil law, not penal. The DMCA also ...


18

When unsure, you can also contact CERT: https://forms.cert.org/VulReport/ They have experience in dealing with even very serious security vulnerabilities, and are generally considered a trusted party. At least they can confirm that your assessment of the vulnerability is correct, and document your part in finding it. While CERT generally advises you to ...


17

-- Edit: This answer addressed the idea of applying for a job based on the discovery of a vulnerability. -- The chances are high that you would not get the job if you applied on the strength of the fact that you successfully hacked their user security. Trust me, if someone walked into an interview with me saying, "Oh, by the way, I found a hole in your ...


15

For this to be unethical there would need to be the potential for the information displayed to leak personal information. The numbers shown, while they have a small amount of background, do not show enough context for anyone to glean any extra information. The privacy issue of the source of these images, ie street view, is much more relevant as it allows ...


12

Do absolutely nothing else with or at the site. Don't make things worse. In many jurisdictions you may have already crossed the line into not so legal. (You should get legal advice from a computer crime specialist lawyer in your jurisdiction about what you've done, by the way.) You have notified the site owner, which we commend you for, and your lawyer ...


11

Look up their DNS record with whois, and contact their listed admin. Also, contact their hosting provider.


10

Sadly I think that such situation isn't new and isn't going to disappear in the near future. I don't know if you ever read the Hacker Manifesto? This text was written in the eighties, but chances are that you will recognize yourself in some aspect of this text... It is interesting in your text that you first explain that you had difficulties to make friend, ...


9

Although your intentions are good, schools and colleges are notorious for being heavy-handed with this kind of thing. They may well want to kick you out for (a) violating school policy and (b) making them look like idiots. My advice would be to detail the problems you found in an anonymous letter, explain very clearly that you're not trying to be malicious ...


8

You can Make a Responsible Disclosure with ZDI (Zero day Initiative), They are well known for their work and you have a good opportunity to earn some money depending on how strong exploits can be plotted upon the vulnerability you have found. Many security experts submit CVE's to ZDI, Its legal and secured in case you are afraid of company to sue you. ...


8

Contra Position I wish to take the position of Devils Advocate here. Your schooling/future is WAY more important to you than the security of the schools network. You should take the point of view that NOTHING good can come of you mentioning this issue. Consider the following scenarios: The School actually investigates this issue. You become the prime ...


7

Any issue with a federal government web application, I would contact the office of my congress-person. They are becoming increasingly aware of and concerned with security and privacy of government computer systems. You can say what you want about our deadlocked, ineffective congress, but they are still pretty good at making things happen at the various ...


7

You are not "obliged" to follow any such practise. Not following them may simply mean that you won't be eligible for some goodies. Or that they can't properly provide a fix. As for the disclosure itself, it would be ethical in my opinion not to wait for the remaining 80 days. There's a notorious case of a security researcher that used its not-a-bug on ...


7

Gaining access to a computer system without the consent of the owner is a violation of law in most countries (if not all of them). If it is your future employer, then I would guess it shows that you can not be trusted with confidentiality, on top of it being illegal. Please don't do it. If you want to show off your skill, then offer to take a test or get ...


6

The ethical approach is to report, confidentially, and to not combine the reporting with a request for payment to fix it, which could be seen as extortion. Explain how you found the problem, and possibly include steps to remedy what you found, but leave the fixing to them. As a Security Manager for an insurance company, I can tell you that I would be ...


6

If you are no longer a student in that college, then you could sue them for not applying due care in the handling of your personal data. Technically you could also do that if you are still a student there, but no longer being a student means that they would have a harder time retaliating if they are so minded. The crucial point here is that being a ...


6

They have experienced attacks, they just don't know it. You should tell them: Assume that all data in the site has been compromised. Tell them what you told us: The site needs to be re-written.


6

X should do nothing. X likely broke a few laws by hacking into the system controlled by Y, so by reporting it they are incriminating themselves. Should it come to a criminal case against Y, the defense of Y will likely be that any evidence X claims to have found was forged by X to incriminate Y. X admitted to being a cyber criminal, after all, so X can not ...


6

Porn sites and advertisements are two business models which often depend on getting the best performance with the fewest costs. HTTPS impacts performance during the initial TLS handshake (can be reduced but not eliminated with session resumption). It also needs more computing resources to encrypt the traffic on the server side and decrypt it on the client ...


5

The actions you described constitute at least one felony. Regarding the ethics of this type of disclosure: If you had discovered this vulnerability by chance alone and immediately reported it, you might not have gotten in trouble. Your self-described actions differ however, in that you not only intentionally breached the system's security and made ...


5

From what I understand of your question, my opinion is No. You describe a web based brute force tool, sans the brute force capability. In short, what you describe is a couple of lines of code that almost anyone could make in a couple minutes. There exist many web based brute force tools, so if this particular script didn't exist, it wouldn't make much of a ...


5

It is never acceptable to look for vulnerabilities in websites or services without permission. This is against the law, and rightfully so. It is completely legal to look for vulnerabilities in your own system, and software that you are running. You could easily find an 0-day that affects many other people, and its legal to whatever you would like with ...


5

The particular site linked in that BBC article is not launching attacks. It simply is checking the HTTP headers of the website you enter and decides if the site is vulnerable or not based on if it can identify the version of open SSL it is using, the date of the certificate and a database of known vulnerable sites. It does this because this is all public ...


5

Well there's a couple of aspects to consider here, as has been said there is no clear answer. On the one hand you've correctly identified the risks of public disclosure with no easy remediation, which is that attackers can take advantage of the issue. However there are also risks with not publicly releasing. For example, it's entirely possible that other ...


Only top voted, non community-wiki answers of a minimum length are eligible