5 ms·

I once found a state website exposing info they probably (?) shouldn't have been in some JSON fields. The sensitive data was not shown on the rendered page but

I once found a state website exposing info they probably (?) shouldn't have been in some JSON fields. The sensitive data was not shown on the rendered page but it was in the browsers memory all nicely formatted. I thought of reporting it, but thought it was more likely they would try to save face by accusing me of being a hacker because I pressed F12 (and that I might have to fight charges in a far away state), rather than accept their mistake. I chose to stay quiet. I guess I'm not the only one to have faced this dilemma.

kop316 8y ago
I did try to use their "fraud waste and abuse" line, thats how i got to an investigator. I just think the report went into the circular filing cabinet.
AlphaWeaver 8y ago
A friend was once in a similar situation and reached out to the Electronic Frontier Foundation... She didn't end up taking it very far (for other reasons) but their legal team was interested in at least hearing what she had to say, and potentially connecting her with legal advice if it fell in their scope of work.
LeftTurnSignal 8y ago
I found a Windows 2003 server (back in the day) with RDP open directly to it. It wasn't behind much (if any) external firewall. It also wasn't patched, and I got in using some exploit I found within a few mins of googlin. Here it was a citys (pop 2mil+) water system. I didn't need a name or password to it once I got into the server itself. I screenshotted the login, the exploit, their water system (it reminded me of MS Paint, which a lot of those system seem to look like), then created a fresh e-mail using Tor, sent a few e-mails to several e-mail addresses I could find for contacting them, and within a few days it was no longer accessible. For a longer time than I should have, I felt bad for doing it, but at the same time, I doubt they would have done much if I just e-mailed them without showing proof. I never received anything, threats or thanks, in that e-mail account. So hopefully someone appreciated it.

kop316 8y ago

I did try to use their "fraud waste and abuse" line, thats how i got to an investigator. I just think the report went into the circular filing cabinet.

AlphaWeaver 8y ago

A friend was once in a similar situation and reached out to the Electronic Frontier Foundation... She didn't end up taking it very far (for other reasons) but their legal team was interested in at least hearing what she had to say, and potentially connecting her with legal advice if it fell in their scope of work.

LeftTurnSignal 8y ago

I found a Windows 2003 server (back in the day) with RDP open directly to it. It wasn't behind much (if any) external firewall. It also wasn't patched, and I got in using some exploit I found within a few mins of googlin. Here it was a citys (pop 2mil+) water system. I didn't need a name or password to it once I got into the server itself. I screenshotted the login, the exploit, their water system (it reminded me of MS Paint, which a lot of those system seem to look like), then created a fresh e-mail using Tor, sent a few e-mails to several e-mail addresses I could find for contacting them, and within a few days it was no longer accessible. For a longer time than I should have, I felt bad for doing it, but at the same time, I doubt they would have done much if I just e-mailed them without showing proof. I never received anything, threats or thanks, in that e-mail account. So hopefully someone appreciated it.