5 ms·
It sounds like he spent two months extracting data through a flaw that's existed for years and then bragged about it after it got closed to his egregious usage.
by ribosometronome 7y ago
It sounds like he spent two months extracting data through a flaw that's existed for years and then bragged about it after it got closed to his egregious usage.
Is this considered normal or ethical behavior for a security researcher?
- thepangolino 7y agoThey literally ruined it for everyone else for the publicity. Typical of PR obsessed white hat script kiddies.
- sp332 7y agoThere's nothing white-hat about this. He accessed as much private data as possible, and didn't report the vulnerability to Twitter or to affected users.
- MiroF 7y agothis is grey hat at best
- Buge 7y agoWhat was ruined? And who ruined it?
- dredmorbius 7y agoAccess to what had until then been an 0day. Ibrahim Balic "ruined" it, though public bragging (which is not responsible disclosure).
- Buge 7y agoRuining access to a 0day sounds like a good thing to me. I don't want people to have access to 0days. Some people dislike the term "responsible disclosure" and believe it's not a moral imperative: https://hn.algolia.com/?query=author:tptacek%20responsible%20disclosure&sort=byDate&prefix&page=0&dateRange=all&type=comment https://hn.algolia.com/?query=author:tptacek%20responsible%2... Of course what Ibrahim did wasn't full disclosure either, so he shouldn't be fully congratulated. But bragging about it was better than keeping silent about it in this case.
- bluesign 7y agotbh there is nothing ethical or legal about this, actually has to have legal consequences and maybe prison time.
- tessting 7y agoaccessing an API? I question how ethical what he did is, but I don't see how it is illegal. I think it's a lot like scraping, which LinkedIn failed to sue people for.
- wpietri 7y agoI doubt it's currently illegal, but I don't think it's impossible to make it illegal. Accessing the API enough to prove a flaw and report it is one thing. Getting 17 million PII records over the space of 60 days is orders of magnitude beyond that. Especially given that things like GDPR and and the CCPA are drawing clear boundaries around private data and how companies can use it, it shouldn't be impossible to make laws that regulate how third parties access and use that data. I'd also hope that Twitter faces regulatory penalties and perhaps civil liability depending on the harm done.
- bluesign 7y agoThis should be textbook description of brute force. This is no different than SSH into some machine and try password combinations, or try to login someones email with bruteforce. Although rate limiting etc is necessary, I think brute forcing someones email account should be illegal.
- Buge 7y ago> it got closed to his egregious usage. Hopefully it wasn't just closed to him, but closed to everyone else too. > Is this considered normal or ethical behavior for a security researcher? weev did something similar (scraped 100k phone numbers from Apple, then shared them with a journalist) and was convicted and sentenced to 41 months in prison for it.