4 ms·

I just fired off an e-mail to point out that they have a potentially serious security problem and they should get it fixed ASAP. I see this as a civic duty, an

by mixmax 16y ago

I just fired off an e-mail to point out that they have a potentially serious security problem and they should get it fixed ASAP. I see this as a civic duty, and think that this is the kind of action you're required to perform if you see a serious problem. Writing an e-mail takes ten seconds, but the potential damage could well cost serious money.

derleth 16y ago
If you're lucky, you aren't in the UK so they won't be able to arrest you instantly on the hacking charges. If you're very lucky, the place you are in won't honor their demands for extradition on the hacking charges.
- mixmax 16y ago
  No offense, but I think you're a tad paranoid. If I was a mechanic and I saw someone at a gasstation driving a car that was obviously dangerous because of some kind of bad fixup I would tell him. This is no different, and I don't expect anyone to sue me for that. Here's the mail I sent: Hi there, It appears that you have some pretty severe security problems on your site. This is a heads up so you can get it fixed. I would recommend doing so ASAP. Your site has been posted to hacker news (which is a friendly programming site for start-up people and nerds) as an example of bad security practices. The link is here: http://news.ycombinator.com/item?id=2383857 http://news.ycombinator.com/item?id=2383857 It has also been posted to Reddit, which might be more of a problem since that site has a lot of 14 year old bored teens hanging around that know just enough about programming to do a lot of damage... Link: http://www.reddit.com/r/programming/comments/gdviz/how_not_to_guard_against_sql_injections_view/ http://www.reddit.com/r/programming/comments/gdviz/how_not_t... It appears that your site is easy to compromise, which might lead to anything from defacement to someone stealing all your content, usernames, passwords, etc. I have nothing to do with these postings, I just don't like to see innocent sites get in trouble, hence this mail. Feel free to contact me if you need anything or have questions. Hope you get it fixed before someone breaks it. Yours, Max
  - Stormbringer 16y ago
    I've got $10 riding on "they see the word Hacker in 'Hacker News' and start freaking out". :D Oh, I understand the word hacker in all its culturally and context relevant forms, and you understand the word hacker, but they do not understand the word hacker. :-(
    - mixmax 16y ago
      That's why we have to tell them. If we, as hackers of the sort that inhabit hacker news, have a post like this on the frontpage and noone cares to actually write them and tell them they have a security problem that may cause them serious damage we don't deserve better.
      - dwwoelfel 16y ago
        Perhaps an anonymous email would have been safer. Edit: But your email is very amiable and clear, so I think you're probably safe.
    - AndyKelley 16y ago
      I think he deftly smoothed that potential problem over with the statement in parenthesis, as well as mentioning how it was posted in reddit.
  - TallGuyShort 16y ago
    You're right, getting sued for pointing this out would be absurd. But where you're wrong, is that just might've happened. There are more ridiculous lawsuits out there. There was a story on here a couple of years ago where a US Government real estate web site was using JavaScript for their authentication, with the password stored in plain text. When it was pointed out to them via email, they responded with allegations of computer fraud and threatened to file charges. Obviously they weren't 100% serious and I'm sure nothing official came of it - but yes, people this stupid are that ridiculous.
  - flexd 16y ago
    I sent a email when i saw it too.
- DisposaBoy 16y ago
  This comment is way too cynical for confort and to be honest I think it's pretty baseless. 1. There is a potential risk of SQL injection here - as far as I see, it's more likely that there is in-fact none. 2. You imply you're living in the UK, if there was an issue who do you think would suffer? Do you think the PM, etc. etc. pays for services like this their own money... 3. This idea that you might get arrested for informing them about something like this is just plain silly - it's ridiculous. What exactly can you possibly be charged with here?
gaius 16y ago
This is the government we're talking about... Whoever wrote this won't get sacked for gross negligence, which is what this is, as much as say, operating machinery without a safety cover, and is probably paid waaaay more than anyone with comparable "skills" in the private sector.
- eftpotrm 16y ago
  Actually, speaking as a Brit working in IT who has supplied various public sector organisations in the past, I think it's rather more likely that this would have been written by an outside agency to contract. And I wouldn't expect they were paid waaaay more from that experience either.
csomar 16y ago
I once hacked into a Twitter Mass following tool. It was written with the .net stack and not obfuscated, so I was able to get the whole project source code. I sent an email to the stuff out there. I typed "I just hacked your software. It's insecure and not obfuscated. Tell the devs". The guy replied accusing me of hacking the software and told me that he is going to sue me. I just replied "F*ck you and your team. I was just playing around with no intent to make any damage for your company; but now I'll release a cracked version and distribute it". I hadn't released a cracked version, though.

by mixmax 16y ago

derleth 16y ago

If you're lucky, you aren't in the UK so they won't be able to arrest you instantly on the hacking charges. If you're very lucky, the place you are in won't honor their demands for extradition on the hacking charges.

mixmax 16y ago
No offense, but I think you're a tad paranoid. If I was a mechanic and I saw someone at a gasstation driving a car that was obviously dangerous because of some kind of bad fixup I would tell him. This is no different, and I don't expect anyone to sue me for that. Here's the mail I sent: Hi there, It appears that you have some pretty severe security problems on your site. This is a heads up so you can get it fixed. I would recommend doing so ASAP. Your site has been posted to hacker news (which is a friendly programming site for start-up people and nerds) as an example of bad security practices. The link is here: http://news.ycombinator.com/item?id=2383857 http://news.ycombinator.com/item?id=2383857 It has also been posted to Reddit, which might be more of a problem since that site has a lot of 14 year old bored teens hanging around that know just enough about programming to do a lot of damage... Link: http://www.reddit.com/r/programming/comments/gdviz/how_not_to_guard_against_sql_injections_view/ http://www.reddit.com/r/programming/comments/gdviz/how_not_t... It appears that your site is easy to compromise, which might lead to anything from defacement to someone stealing all your content, usernames, passwords, etc. I have nothing to do with these postings, I just don't like to see innocent sites get in trouble, hence this mail. Feel free to contact me if you need anything or have questions. Hope you get it fixed before someone breaks it. Yours, Max
- Stormbringer 16y ago
  I've got $10 riding on "they see the word Hacker in 'Hacker News' and start freaking out". :D Oh, I understand the word hacker in all its culturally and context relevant forms, and you understand the word hacker, but they do not understand the word hacker. :-(
  - mixmax 16y ago
    That's why we have to tell them. If we, as hackers of the sort that inhabit hacker news, have a post like this on the frontpage and noone cares to actually write them and tell them they have a security problem that may cause them serious damage we don't deserve better.
    - dwwoelfel 16y ago
      Perhaps an anonymous email would have been safer. Edit: But your email is very amiable and clear, so I think you're probably safe.
  - AndyKelley 16y ago
    I think he deftly smoothed that potential problem over with the statement in parenthesis, as well as mentioning how it was posted in reddit.
- TallGuyShort 16y ago
  You're right, getting sued for pointing this out would be absurd. But where you're wrong, is that just might've happened. There are more ridiculous lawsuits out there. There was a story on here a couple of years ago where a US Government real estate web site was using JavaScript for their authentication, with the password stored in plain text. When it was pointed out to them via email, they responded with allegations of computer fraud and threatened to file charges. Obviously they weren't 100% serious and I'm sure nothing official came of it - but yes, people this stupid are that ridiculous.
- flexd 16y ago
  I sent a email when i saw it too.
DisposaBoy 16y ago
This comment is way too cynical for confort and to be honest I think it's pretty baseless. 1. There is a potential risk of SQL injection here - as far as I see, it's more likely that there is in-fact none. 2. You imply you're living in the UK, if there was an issue who do you think would suffer? Do you think the PM, etc. etc. pays for services like this their own money... 3. This idea that you might get arrested for informing them about something like this is just plain silly - it's ridiculous. What exactly can you possibly be charged with here?

gaius 16y ago

This is the government we're talking about... Whoever wrote this won't get sacked for gross negligence, which is what this is, as much as say, operating machinery without a safety cover, and is probably paid waaaay more than anyone with comparable "skills" in the private sector.

eftpotrm 16y ago
Actually, speaking as a Brit working in IT who has supplied various public sector organisations in the past, I think it's rather more likely that this would have been written by an outside agency to contract. And I wouldn't expect they were paid waaaay more from that experience either.

csomar 16y ago

I once hacked into a Twitter Mass following tool. It was written with the .net stack and not obfuscated, so I was able to get the whole project source code. I sent an email to the stuff out there. I typed "I just hacked your software. It's insecure and not obfuscated. Tell the devs". The guy replied accusing me of hacking the software and told me that he is going to sue me. I just replied "F*ck you and your team. I was just playing around with no intent to make any damage for your company; but now I'll release a cracked version and distribute it". I hadn't released a cracked version, though.