Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teen Reported to Police After Finding Security Hole in Website

wired.com

Post reply on HN
Print view View original

81–90 of 123 posts

Re: Teen Reported to Police After Finding Security Hole in Website

#81

Post by helicon »

nhangen wrote: post #65
ihsw wrote: post #45

Earlier quoted context omitted.

No, the kid didn't log into the website and make some postings to their internal communication systems (forums, email listings, etc). He attempted to contact them through official channels but was ignored. After that, he went to the local news agency. This is totally different.

OK, so he went into your room, you weren't there, and he came back to knock on the door to let you know he went to your room to find you. It's close enough. Edit: I just want to clarify that I don't think the kid should be prosecuted, but I also don't like the fact that he went as far as to check for sensitive information inside of their system.

I think this is one of those situations where the analogy just doesn't work, but well done for trying!

Re: Teen Reported to Police After Finding Security Hole in Website

#82

Post by suprjami »

[deleted] wrote: post #78
PythonicAlpha wrote: post #76

This seems to be the state of society we are in: If somebody uncovers a problem that exists, he is reported to the police. But if one organization spies on everybody and uses the data in irresponsible ways, they are promoted. I have no doubt, that the coming generations will have big difficulties to distinguish between right and wrong. We don't have the problem now with single fallen states, but with a fallen human k…

[deleted]

A seam is a join in fabric. You guys mean to say "It seems" which is like "It appears that".

I don't mean to be a dick, just a friendly correction :)

Re: Teen Reported to Police After Finding Security Hole in Website

#84

Post by PythonicAlpha »

suprjami wrote: post #82
[deleted] wrote: post #78

Earlier quoted context omitted.

[deleted]

A seam is a join in fabric. You guys mean to say "It seems" which is like "It appears that". I don't mean to be a dick, just a friendly correction :)

Thanks for the friendly correction!

I am no native speaker and every friendly correction is helpful, of course!

Trouble with spelling correction: It does not understand context and thus lets you run into wrong wording ....

Re: Teen Reported to Police After Finding Security Hole in Website

#85

Post by politician »

scarmig wrote: post #57
nhangen wrote: post #40

Earlier quoted context omitted.

The articled states that the kid used SQL injection techniques to access the site and gauge the vulnerability.

It's perfectly possible to accidentally stumble across SQL injection. E.g. my street address growing up was 1901 Mayor's Road.

Yeah, I had a hard time with my street address: 5987 O'Drop Table users; Go

Re: Teen Reported to Police After Finding Security Hole in Website

#86

Post by hrjet »

algorias wrote: post #41
staticshock wrote: post #28

Earlier quoted context omitted.

With a physical lock, you'd have to pick the lock each time you wanted access, and avoid being seen. The bar for repetitive attacks on the web is much lower, because you only need to write the "lock picking" script once, and then you can use it indefinitely, disseminate it, etc. A poorly protected website is more akin a house with no lock on it at all, and reporting that "this house has no lock" is not a criminal act…

(Devils Advocate) What about this: seeing the house has no lock, opening the door, going inside, counting the money in the owners wallet, putting it back, then reporting that "Anyone could steal $300 from that guy".

If I were that guy I would be very happy that someone informed me about the vulnerability of my wallet. I would definitely thank them and invite them for tea. Reporting them to police would be the last thing on my mind.

Re: Teen Reported to Police After Finding Security Hole in Website

#87

Post by brianbarker »

xux wrote: post #79

In December I found a glitch in my university's directory that let me have access to personal info of over 60,000 professors, students, and staff. I was thinking of writing an email to the IT, but fuck that. I'm not paying for someone else's mistake.

Send an anonymous email or other notification to them? I agree it's scary to be penalized for "hacking" the system (in their eyes), but I also think these things can't be left alone. It'd be cool if you found a way to let them know.

Re: Teen Reported to Police After Finding Security Hole in Website

#88

Post by pbhjpbhj »

PythonicAlpha wrote: post #84
suprjami wrote: post #82

Earlier quoted context omitted.

A seam is a join in fabric. You guys mean to say "It seems" which is like "It appears that". I don't mean to be a dick, just a friendly correction :)

Thanks for the friendly correction! I am no native speaker and every friendly correction is helpful, of course! Trouble with spelling correction: It does not understand context and thus lets you run into wrong wording ....

Meta: I've mentioned it before here - why is standard spell-checking so lame. The phrase "It seams that" is only going to be correct about 1 in a few-million times ["if you bend it seams that have high pressure applied will burst", maybe].

If I was clever enough I could probably fix it; I've heard that phrase based analysis is used for translation. Most homophonic spelling errors seem fixable using automated lexical context analysis.

Seems there is movement in mobile spell-check and word suggestion but not in desktop?

Re: Teen Reported to Police After Finding Security Hole in Website

#89

Post by perlpimp »

catenate wrote: post #19

In high school I was blacklisted from an admin position for demonstrating that you could write in Digital Command Language a program that simulated the login environment, stored login attempts, and then after three tries exited to the real login environment to let the user in. In college I was nearly expelled for just mentioning to the IT guys that they didn't have a password on some database, and I could get in with…

Witches were burned at the stake, basic human reactions have not evolved since dark ages. So basic premise of somewhat trivialistic movie "Hackers" the one with Jonny Lee Miller holds right - rest of the world is sheep(and it will get worse as we migrate from general purpose computing to specialized devices). Most of the world is made up of unwashed masses that consider computing something that resembles magic - you only scare and confuse them talking all the smart things that they do not really understand or grasp.

I'll conjure up respected Arthur C. Clarke - Third law: Any sufficiently advanced technology is indistinguishable from magic. Put scared people and magic together and you got bonfires going. This why hackers rot in jail for longer than murderous psychopaths.

But then again I was more of a black hat for most of my life than white.

my 2c

Re: Teen Reported to Police After Finding Security Hole in Website

#90

Post by [deleted] »

nhangen wrote: post #65
ihsw wrote: post #45

Earlier quoted context omitted.

No, the kid didn't log into the website and make some postings to their internal communication systems (forums, email listings, etc). He attempted to contact them through official channels but was ignored. After that, he went to the local news agency. This is totally different.

OK, so he went into your room, you weren't there, and he came back to knock on the door to let you know he went to your room to find you. It's close enough. Edit: I just want to clarify that I don't think the kid should be prosecuted, but I also don't like the fact that he went as far as to check for sensitive information inside of their system.

[deleted]
Post reply on HN