3 ms·
The problem is that it is still entirely illegal to do this kind of hacking without any permission. The fact that a lot of companies have embraced bug bounties
by lamontcg 3y ago
The problem is that it is still entirely illegal to do this kind of hacking without any permission.
The fact that a lot of companies have embraced bug bounties and encourage this kind of stuff against them unfortunately teaches "kids" that this kind of thing is perfectly legal/moral/ethical/etc.
As this story shows though you're really rolling the dice, even though it worked out in this case.
> Discussions in forums / BBS's would be around if it was safe to disclose at all. Suggestions of anonymous email accounts and that sort of thing.
This is probably still a better idea if you don't have the cooperation of the target of the hack via some stated bug bounty program. But that doesn't help the security researcher "make a name" for themselves.
And you're basically admitting to the fact that you trespassed, even if all you did was the equivalent of walking through an unlocked door and verifying that you could look inside their refrigerator.
The fact that it may play out in the court of public opinion that you were helping to expose the lies of a corporation doesn't change the fact than in the actual courts you are guilty of a crime.
- Buttons840 3y agoYeah, when it comes to cyber-security, we put our national security at risk so companies can avoid being embarrassed. (See my rant in another comment.)
- asynchronous 3y agoAs much as I hate using regulation as a hammer to fix things, if we did make software companies legally required to a level of security, then vulnerability testing like this could be prosecuted similar to SEC or OSHA violations and would work quite nicely
- Buttons840 3y agoProtecting white-hat hackers could be seen as a reduction in "regulation", since it permits the good guys to do good things. It allows people to do more, but some people will be not be legally shielded from embarrassment and accountability anymore. In the current status quo, everyone except the good guys gets free reign: companies can stop legal scrutiny of their security, black-hats run wild and answer to no one, and the white-hats wring their hands "please sir, may I check for myself that the services I depend on are secure?" to which the companies respond "ha ha, no, but trust us, it's secure."