Hot answers tagged

83

First take screenshots of what you find. For the data that is yours, you should catalogue that. Personally, I would download it so you have a reference. You should take screenshots of your own data and avoid data that is not yours. Make sure you include the URLs. Document those in a way that a lawyer can understand. This is likely to become a legal ...


26

You typically want to contact the hosting company to take it down and hold all data and logs under a legal hold. You could also contact the other companies affected. Legally, you will need to contact a lawyer and the law enforcement in your jurisdition.


20

It should go without saying, but make sure that those login credentials are not working on your system. If they weren't deactivated when he left your organization (when they should have been), you'll want to audit your access logs to make sure they haven't been used since he left -- if they were on a public website where anyone could find them, you should ...


17

If you are a regular member of staff at the company, your correct escalation should be through the Infosec team, and fall back to the Legal and IT departments if your company isn't big enough to have a dedicated Infosec team. I would also copy HR on any communication. This is an extremely serious scenario. If you don't know what to do (and the fact that ...


8

For getting it taken down, you could have a US lawyer issue a DMCA takedown notice to the hosting provider, asserting that you own the content and have not consented to it being distributed - this should get an immediate reaction if the hosting provider honours DMCA notices, to which the contractor can respond.


5

First, a disclaimer. Your question is partially a legal one, and I am not a lawyer. I did, however, work as a penetration tester for a registered PCI ASV for nearly 6 years, and have done quite a bit of PCI-DSS compliance validation testing. I last worked on PCI stuff when PCI 3.2 was the latest release, and it seems PCI 3.2.1 is now the latest, so there may ...


5

The question of whether what they're doing is legal will very much depend on the country you are in as laws vary from place to place. As a general piece of advice, you might want to review your terms of employment and any company policies to do with monitoring. It's possible that they'll lay out what steps they can/will take there. If you don't trust them ...


3

Why would a web application try to connect to a port on localhost? A simple explanation that doesn't involve malicious acting is developmental tasks. Depending on the environment, some developers may install a local, lightweight copy of the backend API on their development machine. This would allow the frontend code to try and connect to localhost and do ...


3

Legally they can't, phisically they can. Its more of a "what do they use that information for" kind of scenario what would give them away if they truly are accessing your data without your consent. What I mean by this is that you would never know if they are going through your data unless they use it for something else.


2

Company Explanation is Wrong I used to work for a telco, and that is utterly wrong. First of all, yes, they are required to authenticate you somehow. That much is true. The telco can face severe penalties for disclosing CPNI without authenticating the caller or web site user properly. We're talking thousands of dollars per violation. A Right Way and A ...


2

Before I get into the details, understand that pirating software is illegal and will certainly land you in hot water. That being said, Android apps are really easy to pirate. An .apk file is really a collection of obfuscated Java bytecode, which can be easily reverse engineered to produce the original source (though, of course, with illegible method names, ...


2

I have been in a similar situation. I contacted my boss and the owner immediately (we only had 25 people). The owner handled everything, but he asked me to be available for a phone call. Since this involved a DOD contractor in the US, it was a DOD responsibility. We were never told the outcome. Let the owner/COO/corporate counsel contact law enforcement. ...


2

Do anything you have written, legally binding permission to do. Don’t do anything else. Those dos and donts apply pretty much everywhere and should be followed. There may be some gray areas such as stumbling onto a bug or glitch on a web facing portal, and you can report those, but don’t start anything intentionally just to have fun. This is where you can ...


2

There’s a bunch of discussion embedded in your question. Personally I would never trust Geek Squad, but most people don’t have a viable option. First of all, make sure you understand that you are handing over everything currently on your machine, most things recently deleted from your drive, and many back versions of things on your drive. Do you trust this ...


1

This is an addition to the other answer from the top (currently). I understand it's been 3 days already and we won't see an answer from OP, but I strongly suggest to anyone that will have this happen to them to consider the following. Understand how data leaks usually happen: third party contractors are targeted first. I will tell you that even the lowest, ...


1

It's legal within the USA* to test your own equipment inside your own network. Be aware that some of the newest ISP-provided routers (i.e. Comcast gigabit, aka Xfinity xFi) have some rudimentary security software built in, and they do internal network monitoring and detection to help homeowners secure their networks. The most I've seen them do is alert the ...


1

If you're hired by a company to pentest their system, this is a private agreement between you and the company. You can pretty much do anything, as long as it's agreed upon with the company beforehand. Most companies draw the line so that no real damage to customer data or company reputation, and no unnecessary damage beyond the minimum necessary to ...


1

PCI-DSS is required by law in some jurisdictions. If you plan on operating in those areas, make sure you follow all local laws. As an example, PCI-DSS is not required as the US Federal level, but some individual States require PCI-DSS or a similar protection. Also, major credit providers require PCI-DSS, and may charge non-compliant organizations a monthly ...


Only top voted, non community-wiki answers of a minimum length are eligible