7 ms·
> On the next screen I just hit the connect button to see what would happen: > Not really sure what it does, but I found several Droisys e-mail addresses in th
by caseysoftware 10y ago
> On the next screen I just hit the connect button to see what would happen:
> Not really sure what it does, but I found several Droisys e-mail addresses in the database and decided to mail them that their database was exposed on the internet.
Oh man, this is a bad idea.
If you find something out there that you think you can connect to - poor password, no password, etc - you must be very careful.
In some cases, just reporting it will cause you problems. At this point, you probably haven't broken the law but some companies are just jackasses.
But once you connect, the game changes. It is "unauthorized access" and it's probable that you broke your local laws. At that point, it's not just a jackass company that gets involved, it's local law enforcement too.
And then you get data from the database. It's probably going to get even worse for you.
When you go a step further and share a howto on the web... this is a bad idea all around.
This is not proper disclosure. If I was him, I'd get a good lawyer.
- michiel3 10y agoIt actually looks like the company was OK with it. The disclosure timeline shows they were responsive and addressed the problem quickly when they were made aware of its existence.
- cortesoft 10y agoRight, but he didn't know this when he originally connected.
- sccxy 10y agoEdit: Too much info. Don't want to be google indexed.
- eugenekolo2 10y agoNeed more details on how you got a criminal record for that. Did you settle? Did you do more than just that?
- sccxy 10y agoEdit: Too much info.
- karmelapple 10y agoAppears to be an alternative revenue stream traditional journalism has been desperately seeking.
- bragh 10y agoWhy are you lying? You didn't get a criminal record for that: [removed link proving his lie by request]
- sccxy 10y agoThanks for pointing out my personal information. You don't know local laws and haven't read the final agreement.
- bragh 10y agoOh come on. Like, don't 50% of Estonians have a misdemeanor because of traffic violations? Unless you wanted to work for Kapo or military, you should have no issues with that fine. Guys who have drug offenses still get work as software developers.
- kinai 10y agoSo true, no good deed goes unpunished.
- 13of40 10y agoI've always wondered about the legality of, say, going to google and entering "not for public release filetype:pdf" then downloading (presumably accidentally shared) confidential documents from someone's server. If no authentication is required, is it fair game?
- jsprogrammer 10y agoIf Google has already accessed, indexed, and published it, you are in pretty good company. At the least, you have the lawyers of a multi-billion $$$ company backing you.
- owenmarshall 10y agoGoogle isn't going to back you in any way - why would they?
- e12e 10y agoI think the parent alludes to Google being named as accomplices along with you. I do however think you're right that that might not mean much for your case. If nothing else, if two parties commit a crime, and one has a major legal team, it seems like the most probable outcome is that the other party will take the fall.
- owenmarshall 10y agoThat's beyond a fantasy - Google isnt party to a conspiracy because they have a built in affirmative defense: our actions weren't taken to further a conspiracy, they were incidental.
- jsprogrammer 10y agoThe question is whether the content is fair game (to access). Google has already proved it to be fair game and if anyone wants to argue otherwise, they would need to then argue with the most flagrant offender, Google, who has much more than just "Confidential" PDFs. Google would be guilty of any charge that could be levied against someone for accessing data that Google actively provides.
- 7ewis 10y agoI just did some searching, and found something similar. I cam across a Samba share for a company that has no security on it whatsoever. I can't tell who it is specifically, without opening up any of the files, but it's either the brand, or a franchise of it. I'm guessing I shouldn't connect to, or open anything on there due to 'unauthorized access'? But then I cannot report it either... guess it's their bad luck then? Edit: Ok, so I found out the owner by running a whois on the IP. It's not who I initially thought it was, but after researching the company they're worth just over $3m... too worried to report it though, I've never reported any findings like this before.
- bestnameever 10y agoWhy not forward it to the technical contact of the domain and/or ip address?
- ethbro 10y agoSign up for a disposable email account using Tor, then email blast a single email with all the details for reproducing the vulnerability to every official email address you can find, including a note that this is an anonymous address and there will be no further contact. The larger problem is what percentage of companies with glaring vulnerabilities in their infrastructure have the competence to fix them?
- themartorana 10y agoThis is sad. Probably smart, but the culture jerk companies and DAs have bred is one of rightfully fearing being the messenger because he always gets shot.
- tetrep 10y agoi don't see any contact info in your profile, but i'll report it for you? (not that you have any particular reason to trust me, just thought i'd offer to take the "heat")
- alphapapa 10y agoPeople are saying this guy accessed databases illegally, but what about Shodan? They crawl, port-scan, access, and index everything they can find, not just HTTP servers. They are what made it possible for this guy to find these unsecured databases in the first place. They even counted the total size of the exposed databases' records. Why isn't Shodan being sued to pieces for illegally accessing private databases and being a "Google for black hats"? I've even found them port-scanning my home DSL connection.
- deleted 10y ago[deleted]