34 ms·

Maybe they could use some threatening instead of a proper report. Go to a public spot, open up a Tor browser, then report the vulnerability. Something like th

Maybe they could use some threatening instead of a proper report. Go to a public spot, open up a Tor browser, then report the vulnerability. Something like this: "I have hacked your system, accessed <this information> and modified <that bit of data>, using <this procedure>. You have <this time> to send <this much> Bitcoins to <this wallet>, or I <copy or trash> your database. Thank you for your attention." Maybe they will panic strongly enough to actually do something about the issue.

pfisch 9y ago
So you should just become a malicious actor and actually break the law? Good plan.
- Duplicated 9y ago
  What difference does it make if the outcome is the same?
  - imhoguy 9y ago
    Not the outcome for the informer in case one gets caught and accused of threatening for ransom.
- loup-vaillant 9y ago
  Becoming a malicious actor, no. Looking like one, definitely. Break the law, most probably. Also, I would rather threaten to publish if I did this for real. It's risky and scary, but also the right thing to do in some cases. You could also fail to report at all, and let their ship sink. Maybe they deserved it.
wlll 9y ago
Better hope you've not left any evidence on their systems then, you know, like a discounted transport pass.
PeterisP 9y ago
That is quite straightforward and makes it clear from all perspectives. From the hacker "hat classification" perspective, that's obviously black hat, nothing gray about it. From the legal perspective it's not a debate anymore (like in the original article) if you do this, it's clearly a crime, if you get caught in whatever way (e.g. by bragging about it someplace later that leads to your person, or by testing a "discounted" pass in some place that has cameras), it's a straightforward conviction for extortion. From the ethical perspective, that is an unethical action, doing that shows that the person is immoral. But you are right, yes, it can be quite effective, and definitely makes it more likely that they will panic strongly enough to actually do something about the issue. It's just that if this happens, then it's not sufficient to just fix the hole, identifying and catching the perpetrator becomes a big part of what they should be doing.
- OscarCunningham 9y ago
  My understand was that you just threaten to do those things but don't actually follow through on those threats. Then it's grey hat and ethical but still not legal. If they actually pay the bitcoins and don't fix the issue then you despair and go on with your life. It's hard to spend the bitcoins without deanonymising yourself, but you can try to give them to charity or something.
  - PeterisP 9y ago
    No, simply making that threat ("send <this much> Bitcoins to <this wallet>, or I <copy or trash> your database") is very definitely a crime (and black hat, and unethical) even without any followup. That's as classic as it can be, there's nothing new or technology related about this - for example, sending an anonymous message "Send cash or I'll burn your house" is a crime (and unethical) even if you don't burn anything. It is a crime (and unethical) even if you're just making an empty threat and never intend to burn anything, it still is extortion. Arson is one crime, and extortion is a separate crime punishable by itself. If you don't attempt to delete their data then you (obviously) don't get charged with deleting their data, but making threats like that is not acceptable in any way (legal or ethical) whatsoever. Once you press "send" on a message like that, you've crossed a very serious line.
etatoby 9y ago
Wrong. The latter half should read: You have <this time> to fix the issue, or I <copy or trash> your database. Asking for extortion does not push them to fix their systems, only to pay you and/or find you.

pfisch 9y ago

So you should just become a malicious actor and actually break the law? Good plan.

Duplicated 9y ago
What difference does it make if the outcome is the same?
- imhoguy 9y ago
  Not the outcome for the informer in case one gets caught and accused of threatening for ransom.
loup-vaillant 9y ago
Becoming a malicious actor, no. Looking like one, definitely. Break the law, most probably. Also, I would rather threaten to publish if I did this for real. It's risky and scary, but also the right thing to do in some cases. You could also fail to report at all, and let their ship sink. Maybe they deserved it.

wlll 9y ago

Better hope you've not left any evidence on their systems then, you know, like a discounted transport pass.

PeterisP 9y ago

That is quite straightforward and makes it clear from all perspectives. From the hacker "hat classification" perspective, that's obviously black hat, nothing gray about it. From the legal perspective it's not a debate anymore (like in the original article) if you do this, it's clearly a crime, if you get caught in whatever way (e.g. by bragging about it someplace later that leads to your person, or by testing a "discounted" pass in some place that has cameras), it's a straightforward conviction for extortion. From the ethical perspective, that is an unethical action, doing that shows that the person is immoral. But you are right, yes, it can be quite effective, and definitely makes it more likely that they will panic strongly enough to actually do something about the issue. It's just that if this happens, then it's not sufficient to just fix the hole, identifying and catching the perpetrator becomes a big part of what they should be doing.

OscarCunningham 9y ago
My understand was that you just threaten to do those things but don't actually follow through on those threats. Then it's grey hat and ethical but still not legal. If they actually pay the bitcoins and don't fix the issue then you despair and go on with your life. It's hard to spend the bitcoins without deanonymising yourself, but you can try to give them to charity or something.
- PeterisP 9y ago
  No, simply making that threat ("send <this much> Bitcoins to <this wallet>, or I <copy or trash> your database") is very definitely a crime (and black hat, and unethical) even without any followup. That's as classic as it can be, there's nothing new or technology related about this - for example, sending an anonymous message "Send cash or I'll burn your house" is a crime (and unethical) even if you don't burn anything. It is a crime (and unethical) even if you're just making an empty threat and never intend to burn anything, it still is extortion. Arson is one crime, and extortion is a separate crime punishable by itself. If you don't attempt to delete their data then you (obviously) don't get charged with deleting their data, but making threats like that is not acceptable in any way (legal or ethical) whatsoever. Once you press "send" on a message like that, you've crossed a very serious line.

etatoby 9y ago

Wrong. The latter half should read: You have <this time> to fix the issue, or I <copy or trash> your database. Asking for extortion does not push them to fix their systems, only to pay you and/or find you.