22 ms·

This is extortion, plain and simple.

by mahmud 16y ago

cubicle67 16y ago
if you read grumo's comment http://news.ycombinator.com/item?id=2160916 http://news.ycombinator.com/item?id=2160916 you'll see it's not quite that simple [edited to fix name. sorry 'bout that, been a long day]
- grumo 16y ago
  Thanks cubicle67, it is "grumo" instead, no worries.
JoachimSchipper 16y ago
From Markus' account, it sure looks like that; but note that a "chris russo" says, in the comments, that he's only given a proof of concept and that the web server logs will show that he didn't make a full dump. Of course, sending a PoC with an offer to fix the security does have a "nice website you have there, it'd be a shame if something happened to it" vibe to it; still, it's factually different from trying to extort money from a company by dangling a dump of their customer database.
- jacquesm 16y ago
  That's a technicality in my opinion. If the website owner would ask you to fix it that would be one thing, to hack them and then to 'offer to fix it' (presumably for a fee) is across the line. It's a fine one but it's definitely there. Hacked a site? Send them a message about it, give them time to respond and time to fix. If they don't respond after a reasonable time has passed go public with it, don't try to translate it in to paid work.
  - JoachimSchipper 16y ago
    Trying to turn a PoC into paid work is indeed sketchy; but I do understand that security researchers/whitehat hackers would like to get paid for their work. It would be good if more companies set up bug bounties, and even better if they'd set the reward a bit closer to (reputed) black-market prices.
- mahmud 16y ago
  How come Russo was not shocked to hear the Russian threat story? It sure seems very suspicious NOT to refute that little nugget, no?
nopassrecover 16y ago
Telling someone they should lock their door, and that you could do it for them (but not necessarily that noone else could, I mean what kind of developer can't fix a SQL injection attack in a couple of hours max?) doesn't seem like extortion to me. Now, if the claims about a stolen data dump held as collateral and threatening media reports are true, it borders on extortion.
motherwell 16y ago
http://en.wikipedia.org/wiki/Extortion http://en.wikipedia.org/wiki/Extortion > Extortion, outwresting, and/or exaction is a criminal offense which occurs when a person unlawfully obtains either money, property or services from a person(s), entity, or institution, through coercion. Where is the coercion? Is there a threat here to do something? I can't see it. In fact, the opposite - the damage is already done. The coercion would exist only if there was a threat to do something bad from the extorter, which really, I can't see at all.

This is extortion, plain and simple.

by mahmud 16y ago

This is extortion, plain and simple.

if you read grumo's comment http://news.ycombinator.com/item?id=2160916 http://news.ycombinator.com/item?id=2160916 you'll see it's not quite that simple [edited to fix name. sorry 'bout that, been a long day]

grumo 16y ago
Thanks cubicle67, it is "grumo" instead, no worries.

JoachimSchipper 16y ago

From Markus' account, it sure looks like that; but note that a "chris russo" says, in the comments, that he's only given a proof of concept and that the web server logs will show that he didn't make a full dump. Of course, sending a PoC with an offer to fix the security does have a "nice website you have there, it'd be a shame if something happened to it" vibe to it; still, it's factually different from trying to extort money from a company by dangling a dump of their customer database.

jacquesm 16y ago
That's a technicality in my opinion. If the website owner would ask you to fix it that would be one thing, to hack them and then to 'offer to fix it' (presumably for a fee) is across the line. It's a fine one but it's definitely there. Hacked a site? Send them a message about it, give them time to respond and time to fix. If they don't respond after a reasonable time has passed go public with it, don't try to translate it in to paid work.
- JoachimSchipper 16y ago
  Trying to turn a PoC into paid work is indeed sketchy; but I do understand that security researchers/whitehat hackers would like to get paid for their work. It would be good if more companies set up bug bounties, and even better if they'd set the reward a bit closer to (reputed) black-market prices.
mahmud 16y ago
How come Russo was not shocked to hear the Russian threat story? It sure seems very suspicious NOT to refute that little nugget, no?

nopassrecover 16y ago

Telling someone they should lock their door, and that you could do it for them (but not necessarily that noone else could, I mean what kind of developer can't fix a SQL injection attack in a couple of hours max?) doesn't seem like extortion to me. Now, if the claims about a stolen data dump held as collateral and threatening media reports are true, it borders on extortion.

motherwell 16y ago

http://en.wikipedia.org/wiki/Extortion http://en.wikipedia.org/wiki/Extortion > Extortion, outwresting, and/or exaction is a criminal offense which occurs when a person unlawfully obtains either money, property or services from a person(s), entity, or institution, through coercion. Where is the coercion? Is there a threat here to do something? I can't see it. In fact, the opposite - the damage is already done. The coercion would exist only if there was a threat to do something bad from the extorter, which really, I can't see at all.