I found a vulnerability. they found a lawyer • Hacker News Board

Re: I found a vulnerability. they found a lawyer

#201

Post by lucb1e » Sat, Feb 21, 2026, 4:13 AM UTC

esafak wrote: post #192

lucb1e wrote: post #179

Earlier quoted context omitted.

What risk? It sounds to me like the worst they could get is a subpoena to produce the identity of the reporter Besides, it's usually governmental organizations that do this sort of thing

The risk of lawsuits like the ones threatened to be filed against this researcher.

They can also sue the pope but I don't think the pope finds that a risk worth considering either when they didn't do any hacking, legal or otherwise. How would an organization get sued for hacking when they didn't do any hacking and are merely passing on a message?

Re: I found a vulnerability. they found a lawyer

#202

Post by BobbyTables2 » Sat, Feb 21, 2026, 4:22 AM UTC

godelski wrote: post #133

janalsncm wrote: post #71

Three thoughts from someone with no expertise. 1) If you make legal disclosure too hard, the only way you will find out is via criminals. 2) If other industries worked like this, you could sue an architect who discovered a flaw in a skyscraper. The difference is that knowledge of a bad foundation doesn’t inherently make a building more likely to collapse, while knowledge of a cyber vulnerability is an inherent risk.…

In other industries there are professional engineers. People who have a legal accountability. I wonder if the CS world will move that way, especially with AI. Since those engineers are the ones who sign things off. For people unfamiliar, most engineers aren't professional engineers. There are more legal standards for your average engineer and they are legally obligated to push back against management when they think…

I don’t think the current cost structure of software development would support a professional engineer signing their name on releases or the required skill level of the others to enable such …

We’d actually have to respect software development as an important task and not a cost to be minimized and outsourced.

Re: I found a vulnerability. they found a lawyer

#203

Post by DANmode » Sat, Feb 21, 2026, 4:22 AM UTC

tokenless wrote: post #190

zaptheimpaler wrote: post #183

Earlier quoted context omitted.

Maybe the law should be changed then. The companies that have this level of disregard for security in 2026 are not going to change without either a good samaritan or a data breach.

He didn't have to crack the site. He could have reported up to that point. We need a change in law but more to do with fining security breaches or requiring certification to run a site above X number of users.

Showing up without a PoC complicates things.

Re: I found a vulnerability. they found a lawyer

#204

Post by b8 » Sat, Feb 21, 2026, 4:23 AM UTC

Sounds like they were bluffing and trying to coerce the researcher in to signing an NDA. I wouldn't of signed and they wouldn't have reach in the US and presumably Germany where the researched is based. Also, I'm glad the affected vendor isn't DAN.

Re: I found a vulnerability. they found a lawyer

#205

Post by lucb1e » Sat, Feb 21, 2026, 4:24 AM UTC

DANmode wrote: post #195

lucb1e wrote: post #165

Earlier quoted context omitted.

You don't need to retrieve other people's data to demonstrate the vulnerability. It's readily evident that people have an account with a default password on the site for some amount of time, and some of them indefinitely. You know what data is in the account (as the person who creates the accounts) and you know the IDs are incremental. You can do the login request and never use the retrieved access/session token (or…

> You don't need to retrieve other people's data to demonstrate the vulnerability. If you’re reporting to a nontechnical team…which sometimes you are…sometimes you do?

If the nontechnical team is refusing to forward it to whoever maintains the system, they apparently see no problem and you could disclose it to a journalist or the public. Or you could try it via the national CERT route, have them talk to this organization and tell them it's real. In some cases you could send a proof of concept exploit that you say you haven't run, but they can, to verify the bug. You can choose to retrieve only your own record, or that of someone who gave consent. You can ask the organization "since you think the vulnerability is not real, do you mind if I retrieve 1 record for the sole purpose of sending you this data and prove it is real?"

In jurisdictions like the one I'm most familiar with, it's official national policy not to prosecute when you did the minimum necessary. In a case where you're otherwise stuck, it's entirely reasonable to retrieve 1 record for the sake of a screenshot and preventing a bigger data leak. You could also consider doctoring a screenshot based on your own data. By the time they figured out the screenshot was fake, it landed on a technical person's desk who saw that the vulnerability is real

Lots of steps to go until it's necessary to dump the database as OP did, but I'll agree it can sometimes (never happened to me) be necessary to access at least one other person's data, and more frequently that it will happen by accident

Re: I found a vulnerability. they found a lawyer

#206

Post by f30e3dfed1c9 » Sat, Feb 21, 2026, 4:25 AM UTC

Not clear to me why the author thinks he's the good guy in this scenario. His letter to the company might as well read "I am a busybody who downloaded private information about a person who is not me from your web site, ENTIRELY WITHOUT AUTHORIZATION from that person. Here, let me show it to you."

Why does he think he's entitled to do this? I get that his intentions are more or less good but don't see that as much excuse. What did he expect them to say? "Oh thank you wise and wonderful full-time Linux Platform Engineer"?

I appreciate that the web site in question seems to have absolutely pathetic security practices. Good reason not to do business with them. Not a good reason to do something that, in many jurisdictions at least, sounds like it constitutes a crime.

Re: I found a vulnerability. they found a lawyer

#207

Post by tokenless » Sat, Feb 21, 2026, 4:46 AM UTC

DANmode wrote: post #203

tokenless wrote: post #190

Earlier quoted context omitted.

He didn't have to crack the site. He could have reported up to that point. We need a change in law but more to do with fining security breaches or requiring certification to run a site above X number of users.

Showing up without a PoC complicates things.

You can lead a horse to water, as they say.

Re: I found a vulnerability. they found a lawyer

#208

Post by cryptonector » Sat, Feb 21, 2026, 5:02 AM UTC

Hey TFA, other people have gone to prison for finding monotonic user/account IDs and _testing_ their hunch to see if it's true. See, doing that puts you at great risk of violating the CFAA. Basically, the moment you knew they were allocating account IDs monotonically and with a default password was the moment you had a vulnerability that you could report without fear of prosecution, but the moment you tested that vulnerability is the moment you may have broken the law.

Writing about it is essentially confessing. You need a lawyer, and a good one. And you need to read about these things.

Re: I found a vulnerability. they found a lawyer

#209

Post by smcin » Sat, Feb 21, 2026, 5:08 AM UTC

macintux wrote: post #188

smcin wrote: post #139

Earlier quoted context omitted.

'canary', 'review canary' or something.

There's a related (apocryphal?) story from Interplay about adding a duck to animations so that the producer would ask for it to be removed, to make him happy, while leaving the rest alone. https://bwiggs.com/notebook/queens-duck/

Yeah, that one too.

Re: I found a vulnerability. they found a lawyer

#210

Post by user3939382 » Sat, Feb 21, 2026, 5:39 AM UTC

godelski wrote: post #133

janalsncm wrote: post #71

Three thoughts from someone with no expertise. 1) If you make legal disclosure too hard, the only way you will find out is via criminals. 2) If other industries worked like this, you could sue an architect who discovered a flaw in a skyscraper. The difference is that knowledge of a bad foundation doesn’t inherently make a building more likely to collapse, while knowledge of a cyber vulnerability is an inherent risk.…

In other industries there are professional engineers. People who have a legal accountability. I wonder if the CS world will move that way, especially with AI. Since those engineers are the ones who sign things off. For people unfamiliar, most engineers aren't professional engineers. There are more legal standards for your average engineer and they are legally obligated to push back against management when they think…

We check the output of engineers tjats what infra audits and certs are for. We basically tell industry if you want to waste your money on poor engineers whose output doesn’t certify go ahead.

you could do that with civil engineering. anyone gets to design bridges. bridge is done we inspect, sorry x isn’t redundant your engineering is bad tear it down.