Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teen Reported to Police After Finding Security Hole in Website

wired.com

Post reply on HN
Print view View original

21–30 of 123 posts

Re: Teen Reported to Police After Finding Security Hole in Website

#21

Post by jaryd »

falcolas wrote: post #18
blueskin_ wrote: post #7

...and now, all future holes in that site will be sold instead of reported to the owners. I'm fine with that.

The problem is that this property transfers to other websites. I'd much rather a 16 year old report problems with my website to me, but if she doesn't because of fears that I will call the police as other webmasters have, I'm worse off as a result. This is bad news for everyone who runs a website.

This highlights the importance of having a visible bug bounty program (or at least something very basic) that clearly states that you take security seriously and appreciate/reward (whatever you prefer) bug reports from security researchers.

Re: Teen Reported to Police After Finding Security Hole in Website

#22

Post by edvinbesic »

catenate wrote: post #19

In high school I was blacklisted from an admin position for demonstrating that you could write in Digital Command Language a program that simulated the login environment, stored login attempts, and then after three tries exited to the real login environment to let the user in. In college I was nearly expelled for just mentioning to the IT guys that they didn't have a password on some database, and I could get in with…

Funny enough, I did the exact same thing when I was in high school, only we were running Novell on NT4 and I did it in basic and started it from autorun.bat which loaded before the network login screen.

It would let you try one time, tell you you entered the wrong password (saving it to file) and exit, at which point windows would load the novell login screen that looked exactly the same.

Good times.

Re: Teen Reported to Police After Finding Security Hole in Website

#23

Post by ZoFreX »

falcolas wrote: post #18
blueskin_ wrote: post #7

...and now, all future holes in that site will be sold instead of reported to the owners. I'm fine with that.

The problem is that this property transfers to other websites. I'd much rather a 16 year old report problems with my website to me, but if she doesn't because of fears that I will call the police as other webmasters have, I'm worse off as a result. This is bad news for everyone who runs a website.

This is why you should have a page describing your security reporting process.

> (1) Have a security contact, (2) publish a GPG key and accept GPG mail, (3) respond promptly with a "security flaw ID".

https://news.ycombinator.com/item?id=640367

Re: Teen Reported to Police After Finding Security Hole in Website

#24

Post by ams6110 »

Suppose while you were away from your house someone came to your front door and found it unlocked. Assume he entered your house and had a look around, but didn't take anything. He then later notified you that you had left your house unlocked. Did he do anything wrong?

Re: Teen Reported to Police After Finding Security Hole in Website

#25

Post by watty »

(DEVIL'S ADVOCATE)

Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police.

Websites, like locks, aren't bullet proof. How many web applications out there don't have a security flaw somewhere? Doing penetration tests on unwilling victims is risky. Trying to break wifi, company intranets, people's computers, etc. It's best to pentest as a professional, with willing victims or wait for a "pentest" contest.

Re: Teen Reported to Police After Finding Security Hole in Website

#26

Post by specialist »

ams6110 wrote: post #24

Suppose while you were away from your house someone came to your front door and found it unlocked. Assume he entered your house and had a look around, but didn't take anything. He then later notified you that you had left your house unlocked. Did he do anything wrong?

My doormat says "GO AWAY", the old school robots.txt.

Your analogy doesn't hold. There are few spiders trying every door and window of every house. The risk profile (attack surface area) is much smaller in the physical world.

If a service publishes a port, many someone's will probe it, legitimately or not.

Where your analogy does hold is courtesy. If one of my neighbors sees my door open, does a walk thru to check things out (I might be bleeding out in the basement), finds nothing, then I absolutely do want her/him to clue me in.

Ditto my website(s).

Re: Teen Reported to Police After Finding Security Hole in Website

#27

Post by bluedino »

ams6110 wrote: post #24

Suppose while you were away from your house someone came to your front door and found it unlocked. Assume he entered your house and had a look around, but didn't take anything. He then later notified you that you had left your house unlocked. Did he do anything wrong?

That's trespsassing, isn't it?

Re: Teen Reported to Police After Finding Security Hole in Website

#28

Post by staticshock »

watty wrote: post #25

(DEVIL'S ADVOCATE) Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police. Websites, like locks, aren't bullet proof. How many web applications out there don't have a security flaw somewhere? Doing penetration tests on unwilling victims is risky. Trying to break wifi, company intra…

With a physical lock, you'd have to pick the lock each time you wanted access, and avoid being seen. The bar for repetitive attacks on the web is much lower, because you only need to write the "lock picking" script once, and then you can use it indefinitely, disseminate it, etc.

A poorly protected website is more akin a house with no lock on it at all, and reporting that "this house has no lock" is not a criminal act.

Re: Teen Reported to Police After Finding Security Hole in Website

#29

Post by wglb »

When I first read The Cuckoo's Egg by Cliff Stoll, I was wondering if anyone would think to criminalize connecting something to the network that had no protection. So instead of throwing teenagers in jail, they would make an example of systems administrators. Perhaps that would have quickened the advance of internet security awareness.

At one time, there was a law in Minnesota that it was a misdemeanor to leave your car unlocked in a public place, so the idea is not totally without precedent.

Re: Teen Reported to Police After Finding Security Hole in Website

#30

Post by GrinningFool »

edvinbesic wrote: post #22
catenate wrote: post #19

In high school I was blacklisted from an admin position for demonstrating that you could write in Digital Command Language a program that simulated the login environment, stored login attempts, and then after three tries exited to the real login environment to let the user in. In college I was nearly expelled for just mentioning to the IT guys that they didn't have a password on some database, and I could get in with…

Funny enough, I did the exact same thing when I was in high school, only we were running Novell on NT4 and I did it in basic and started it from autorun.bat which loaded before the network login screen. It would let you try one time, tell you you entered the wrong password (saving it to file) and exit, at which point windows would load the novell login screen that looked exactly the same. Good times.

Hah! Exact same thing, I used... Borland Basic, IIRC, to build the executable that I called from autorun.

I collected many passwords - I never used them or intended to, I just wanted to see if I could do it.

I made the classic mistake though - I told someone about it. A few days later word got around. I was suspended for a week and was banned from computers for the rest of my time there.

Edit: Now that I think about it (I haven't in years): What kind of response is that? Someone shows some creative thinking and does so in a way that is obviously[1] quite naive/without ill intent. While I understand that you want to discourage the specific behavior, perhaps steering the culprit to use talents with more foresight would have been a better answer.

[1] Looking back, I was something of an asshat in the personal skills department so it's entirely possible that they simply didn't believe my lack of nefarious intent.

Post reply on HN