Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teen Reported to Police After Finding Security Hole in Website

wired.com

Post reply on HN
Print view View original

101–110 of 123 posts

Re: Teen Reported to Police After Finding Security Hole in Website

#101

Post by gatehouse »

xux wrote: post #79

In December I found a glitch in my university's directory that let me have access to personal info of over 60,000 professors, students, and staff. I was thinking of writing an email to the IT, but fuck that. I'm not paying for someone else's mistake.

You could send a postcard through regular mail to the head of IT's house, I think that would get the point across haha. They might be able to find you by checking access logs after the fact though, I don't think there is any riskless way to disclose.

Re: Teen Reported to Police After Finding Security Hole in Website

#102

Post by aaron695 »

The article isn't to specific but they imply he used SQL injection.

It's pretty simple people this is against the law in most countries. SQL injection, default passwords, remote injection are illegal.

The big thing for me is not what happened to him but young people thinking this is legal. Why didn't he try and be anonymous?

Don't care whether it should or should not be legal to hack sites but how could he not know it was illegal? (I guess that's slightly rhetorical, he was 16)

Re: Teen Reported to Police After Finding Security Hole in Website

#103

Post by skeletonjelly »

pavel_lishin wrote: post #73
ASpring wrote: post #67

Earlier quoted context omitted.

>When The Age called the Transportation Department for comment, it reported Rogers to the police. Last sentence in the third paragraph.

I assumed that "it" refers to the Transportation Department.

It went like this. Kid didn't get a response from PTV, so he contact The Age. The Age went and called PTV to call them out. PTV responded to The Age and then stupidly went "whelp we have no choice but to notify the Police".

Re: Teen Reported to Police After Finding Security Hole in Website

#104

Post by pbhjpbhj »

dkuntz2 wrote: post #94
pbhjpbhj wrote: post #88

Earlier quoted context omitted.

Meta: I've mentioned it before here - why is standard spell-checking so lame. The phrase "It seams that" is only going to be correct about 1 in a few-million times ["if you bend it seams that have high pressure applied will burst", maybe]. If I was clever enough I could probably fix it; I've heard that phrase based analysis is used for translation. Most homophonic spelling errors seem fixable using automated lexical…

One of the Senior Thesis presentations at my college last year was someone working on a context spell-checker. I don't know if his demo could suggest a better word, but it would highlight words that seemed wrong. It was based off of Google's NGrams, I think he used 3-grams, and checked to see how frequently a word showed up between the two words next to it. The problem with that was it required a HUGE amount of data.…

Average vocabulary isn't going to require using that massive a set of 3-grams though. If we started with homophones (https://en.wikipedia.org/wiki/Homophone#English) that would seem to make a large difference; add in ability to easily get a definition (or list of synonyms) for words/phrases (like in Google Translate). Google suggest already does a lot of what is required.

Re: Teen Reported to Police After Finding Security Hole in Website

#105

Post by skeletonjelly »

onion2k wrote: post #6

Clearly, the government department is wholly responsible for putting up a rubbish website, but from another article on the story, "He first contacted PTV by email on Boxing Day.." . I wonder if the "white-hat hacker" didn't time his notification quite intentionally knowing there was a much lower probability of action being taken promptly. If they'd just patched the security hole he wouldn't get any exposure. It makes…

I agree it was a bad day to email PTV, but in another article I read on it he was simply trying to find out some info on Myki (the current travel card). Unfortunately I can't find it though.

Assumptions are the mother of all fuckups.

Re: Teen Reported to Police After Finding Security Hole in Website

#106

Post by [deleted] »

chimeracoder wrote: post #56
jbrooksuk wrote: post #54

Earlier quoted context omitted.

> You never know if they're going to involve the police anyway after you spill the beans, and if they do, you'd rather they do it without already having a confession from you. I was definitely worried about this, but I figured that if anything, I've not lied to anybody, so I'd be happy with myself.

> if anything, I've not lied to anybody, so I'd be happy with myself. Unfortunately, that's not the way police encounters work in practice. Even if you've done nothing wrong, talking to the police can really only hurt you. For example, this re-enactment is based on a true story in which an old lady in Baltimore was convicted of drug possession because some neighborhood children had left a dime bag under her sofa (whi…

[deleted]

Re: Teen Reported to Police After Finding Security Hole in Website

#107

Post by guard-of-terra »

Always pastebin it on reddit anonymously.

And if you care about users' private data being leaked, said users can always use the assassinaton market to dispose said sites' admin staff.

I'm dead serious on both point. I would love to see somebody die a violent death over such shit as exposing user data and then reporting white hat to the police without even securing the system in the first place.

Re: Teen Reported to Police After Finding Security Hole in Website

#108

Post by bertil »

A lot of comments here:

- complain how white-hat practice are not well understood;

- advise to report, but anonymously.

It sounds like a simple enough website to set up. It would encourage script-kiddies to report anonymously, send a warning to the right person, and include explanations — maybe free best practice tips and references to known security professionals if necessary. Now that Scheider is in the news, his name could help reassure uninformed admins that this is not a racket.

I'm not a coder, and the furthest thing from a security professional, though.

Re: Teen Reported to Police After Finding Security Hole in Website

#109

Post by tn13 »

A lot of these kind of things we seen in news these days is a result of a highly networked society colliding with a hierarchical administration/governance system.

A typical college management or government is designed to take orders from top. A persons ability to make decisions and process information is not often correlated with this position. But in this real world a 16 year old can beat a 50 years on basis of pure merit. As a society we are adapted to it but governments and management practices haven't. So when a teen calls up to report a security hole the lower level of administration panics.

Re: Teen Reported to Police After Finding Security Hole in Website

#110

Post by jayhuang »

Back in high school I found a vulnerability in the website of a major online DVD retailer.

I notified them about it, and included information on what specifically was wrong, the impact it had (over 6 million credit cards, social insurance numbers, addresses, full names, and telephone numbers), and they hired me to help them fix it.

I often look back on that event and am quite thankful for how it turned out. I've read about plenty of stories where the person who found the vulnerability was not as fortunate.

Post reply on HN