Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teen Reported to Police After Finding Security Hole in Website

wired.com

Post reply on HN
Print view View original

31–40 of 123 posts

Re: Teen Reported to Police After Finding Security Hole in Website

#31

Post by seabee »

watty wrote: post #25

(DEVIL'S ADVOCATE) Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police. Websites, like locks, aren't bullet proof. How many web applications out there don't have a security flaw somewhere? Doing penetration tests on unwilling victims is risky. Trying to break wifi, company intra…

> Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police.

Sometimes these discoveries aren't intentional. Let's say I lean against a door and it's not locked. Well, I never meant to open it up, but since I can't prove I didn't intend to, and since the business can't distinguish people with honorable intentions vs. those without, why risk telling them?

If you tar the helpful with the same brush as the crooks then you shall always learn the hard way from your mistakes.

Re: Teen Reported to Police After Finding Security Hole in Website

#32

Post by jerf »

ams6110 wrote: post #24

Suppose while you were away from your house someone came to your front door and found it unlocked. Assume he entered your house and had a look around, but didn't take anything. He then later notified you that you had left your house unlocked. Did he do anything wrong?

Physical metaphors DO NOT WORK in this scenario. This is not a house or a car or commercial warehouse or anything else... it's a website. There are far too many relevant differences between physical locations and web sites for metaphorical reasoning to work.

Re: Teen Reported to Police After Finding Security Hole in Website

#34

Post by aaronem »

bluedino wrote: post #27
ams6110 wrote: post #24

Suppose while you were away from your house someone came to your front door and found it unlocked. Assume he entered your house and had a look around, but didn't take anything. He then later notified you that you had left your house unlocked. Did he do anything wrong?

That's trespsassing, isn't it?

More likely illegal entry, but certainly unlawful either way.

Re: Teen Reported to Police After Finding Security Hole in Website

#35

Post by unethical_ban »

watty wrote: post #25

(DEVIL'S ADVOCATE) Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police. Websites, like locks, aren't bullet proof. How many web applications out there don't have a security flaw somewhere? Doing penetration tests on unwilling victims is risky. Trying to break wifi, company intra…

Always beware of physical -> digital analogies. When the whole world has the ability to walk by your door, windows, and alarm system and pick at it without being seen, then you probably should be grateful when some of them let you know the back door is open.

Re: Teen Reported to Police After Finding Security Hole in Website

#36

Post by aaronem »

Fuxy wrote: post #8
onion2k wrote: post #6

Clearly, the government department is wholly responsible for putting up a rubbish website, but from another article on the story, "He first contacted PTV by email on Boxing Day.." . I wonder if the "white-hat hacker" didn't time his notification quite intentionally knowing there was a much lower probability of action being taken promptly. If they'd just patched the security hole he wouldn't get any exposure. It makes…

By that logic why would he even bother reporting it and have security experts poking around the logs and potentially find traces of his download. Personally i would have sold it to the highest bidder. Being "white hat" gets you in trouble more often than not. Il stick to "gray hat" thank you very much. If i ever choose to disclose any vulnerability to the owners i will not reveal my identity and after arbitrary amoun…

> Being "white hat" gets you in trouble more often than not.

Granted. I've lost clients this way, despite having been actually invited to do work on their systems; such experience has taught me that the political concerns around unsolicited vulnerability reporting dwarf the technical considerations involved, and that trying to navigate such minefields is worthwhile only when the status quo is utterly untenable.

> Personally i would have sold it to the highest bidder.

Well, that's a wholly different consideration, isn't it? Saying nothing is one thing. Gravely violating the ethics of your profession, and possibly criminal law as well, is quite another.

Re: Teen Reported to Police After Finding Security Hole in Website

#37

Post by nhangen »

vividmind wrote: post #33

To me this is really weird. If a neighbor knocks on your door to tell you that you forgot the keys in the keyhole outside you thank him, you don't call the police...

This is a bit different and would be like the neighbor opening the door and waking into your bedroom to tell you.

Re: Teen Reported to Police After Finding Security Hole in Website

#39

Post by aaronem »

betterunix wrote: post #14
rlpb wrote: post #12

Earlier quoted context omitted.

It should never be a crime to report something to the police. It should be the police's responsibility to make a decision about whether reports should be followed up or not. We should hold the police, prosecutors and the courts culpable for making reasonable judgements here, not random uninformed members of the public.

"It should never be a crime to report something to the police." I am not sure about that: http://www.wired.com/politics/law/news/2008/02/blind_hacker?...

False reporting is already a crime, and I think it's fair to assume that by 'something' (parent (parent)) meant 'a crime', rather than assuming that he meant false reporting should be made lawful.

Re: Teen Reported to Police After Finding Security Hole in Website

#40

Post by nhangen »

seabee wrote: post #31
watty wrote: post #25

(DEVIL'S ADVOCATE) Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police. Websites, like locks, aren't bullet proof. How many web applications out there don't have a security flaw somewhere? Doing penetration tests on unwilling victims is risky. Trying to break wifi, company intra…

> Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police. Sometimes these discoveries aren't intentional. Let's say I lean against a door and it's not locked. Well, I never meant to open it up, but since I can't prove I didn't intend to, and since the business can't distinguish peo…

The articled states that the kid used SQL injection techniques to access the site and gauge the vulnerability.
Post reply on HN