5 ms·

I remember when I was a teenager I found a huge security flaw in a website: they allowed to include any PHP file passed as a query string parameter, and that fi

I remember when I was a teenager I found a huge security flaw in a website: they allowed to include any PHP file passed as a query string parameter, and that file could be a remote one too. They didn't listen to me and I found that offensive, so I used the flaw to get access, and leave a message on their FTP server. I didn't destroy nor steal any data. They responded by reporting the incident to the police.

j-a-a-p 3y ago
Valuable lesson for a teenager to discover how people really are. I hope the police was more reasonable!
- mgaunard 3y ago
  The police allowed them to contact my ISP to get my name and location, not that I was hiding or anything. Apart from that they just logged the incident and there was no follow-up.
  - deleted 3y ago
    [deleted]
waihtis 3y ago
No criticism because teenagers do dumb things, but for anyone else it should be assumed that if you break into a system without permission, benignly or not, you run the risk of getting prosecuted for it.
- geek_at 3y ago
  Oh yes. In 2011 I got raided by the police because I clicked a link someone sent me over IRC [1]. You don't even need to be destructive to become a target for prosecution sometimes. Being stupid or incautious is enough. [1] https://blog.haschek.at/2015-that-not-so-awesome-time-the-police/ https://blog.haschek.at/2015-that-not-so-awesome-time-the-po...
  - waihtis 3y ago
    I vaguely recall this case. I sure hope police have become more cyber literate in the past 10 years, but yeah this is the virtual equivalent of leaving fingerprints on the crime scene.
  - onionisafruit 3y ago
    After reading your story, the image at the bottom stands out. I never thought about the fact that you can’t really trust that what is returned to you is the same as what they took. No telling if they added any malware to those drives intentionally or not.
  - __s 3y ago
    > Don't click on links from random people on the internet! Ironic since I ended up on your blog after clicking on link you posted
  - valvar 3y ago
    Is there no way to contest such a warrant? What about compensation for the loss of utility caused by the confiscation?
- fm2606 3y ago
  Threat of prosecution can come even without breaking in. Vengeful and ignorant people will always be a thing. [1] Missouri's governor threatened legal action against a reporter who found SSN were being leaked on a public web page accessible simply by clicking "View Source". The reporter "followed standard protocols for disclosing and reporting on the vulnerability, the governor is treating him as if he attacked the site or was trying to access the teacher’s private information for nefarious purposes" . This pisses me off on so many different levels. The reporter told proper authorities and gave them time to fix it before he made the information public but MO's jack-wagon of a governor tried to pin blame on the reporter. [1] https://www.theverge.com/2021/10/14/22726866/missouri-governor-department-elementary-secondary-education-ssn-vulnerability-disclosure https://www.theverge.com/2021/10/14/22726866/missouri-govern...
  - AlecSchueler 3y ago
    Threat of prosecution is of course always present, but the chance of that prosecution making it past the courts is significantly altered by actually committing the acts you might be accused of.
  - autoexec 3y ago
    That should have been a carer ending move. According to wikipedia that jackass Mike Parson can't run again and will be replaced (https://en.wikipedia.org/wiki/2024_Missouri_gubernatorial_election https://en.wikipedia.org/wiki/2024_Missouri_gubernatorial_el...). I don't have much faith in Missouri to do better with their next election, but I'd be thrilled to be surprised.
thriftwy 3y ago
A good lesson to never do that - just use VPN to login to IRC to some hacking channel and report the issue there. Of course you should also do the white hat part in anonymized fashion.
- ajdude 3y ago
  This is the correct way to handle it. Publish the exploit after you've gave them the warning, but don't execute it yourself.
Cthulhu_ 3y ago
It's the danger of good intents but still breaking the law. If a house is unlocked and you go in to prove it's unlocked, maybe leave a helpful note, you're still breaking in. Report and move on.
- plugin-baby 3y ago
  > If a house is unlocked and you go in to prove it's unlocked, maybe leave a helpful note, you're still breaking in. What jurisdiction? I would think this was just trespass.
  - pilchard123 3y ago
    IIRC some jurisdictions consider any force at all - such as pushing an already-open door further open - to be sufficient to make it B&E rather than simply trespassing.
    - plugin-baby 3y ago
      Force isn’t even required in some places, apparently! This page expands on the differences in a few countries: https://en.m.wikipedia.org/wiki/Burglary https://en.m.wikipedia.org/wiki/Burglary Canada > Breaking and entering is defined as breaking into a place with intent to commit another indictable offence England & Wales > A person is guilty of burglary if they enter any building or part of a building as a trespasser with intent to steal, inflict grievous bodily harm or do unlawful damage to the building or anything in it. New Zealand > burglary is a statute offence under section 231 of the Crimes Act 1961. Originally this was a codification of the common law offence, though from October 2004 the break element was removed from the definition and entry into the building (or ship), or a part of it, now only needed to be unauthorised.
      - scotty79 3y ago
        It seems that in many places intent to commit another crime is a key.
grotorea 3y ago
Nice welcome to the grey hat experience.

j-a-a-p 3y ago

Valuable lesson for a teenager to discover how people really are. I hope the police was more reasonable!

mgaunard 3y ago
The police allowed them to contact my ISP to get my name and location, not that I was hiding or anything. Apart from that they just logged the incident and there was no follow-up.
- deleted 3y ago
  [deleted]

waihtis 3y ago

No criticism because teenagers do dumb things, but for anyone else it should be assumed that if you break into a system without permission, benignly or not, you run the risk of getting prosecuted for it.

geek_at 3y ago
Oh yes. In 2011 I got raided by the police because I clicked a link someone sent me over IRC [1]. You don't even need to be destructive to become a target for prosecution sometimes. Being stupid or incautious is enough. [1] https://blog.haschek.at/2015-that-not-so-awesome-time-the-police/ https://blog.haschek.at/2015-that-not-so-awesome-time-the-po...
- waihtis 3y ago
  I vaguely recall this case. I sure hope police have become more cyber literate in the past 10 years, but yeah this is the virtual equivalent of leaving fingerprints on the crime scene.
- onionisafruit 3y ago
  After reading your story, the image at the bottom stands out. I never thought about the fact that you can’t really trust that what is returned to you is the same as what they took. No telling if they added any malware to those drives intentionally or not.
- __s 3y ago
  > Don't click on links from random people on the internet! Ironic since I ended up on your blog after clicking on link you posted
- valvar 3y ago
  Is there no way to contest such a warrant? What about compensation for the loss of utility caused by the confiscation?
fm2606 3y ago
Threat of prosecution can come even without breaking in. Vengeful and ignorant people will always be a thing. [1] Missouri's governor threatened legal action against a reporter who found SSN were being leaked on a public web page accessible simply by clicking "View Source". The reporter "followed standard protocols for disclosing and reporting on the vulnerability, the governor is treating him as if he attacked the site or was trying to access the teacher’s private information for nefarious purposes" . This pisses me off on so many different levels. The reporter told proper authorities and gave them time to fix it before he made the information public but MO's jack-wagon of a governor tried to pin blame on the reporter. [1] https://www.theverge.com/2021/10/14/22726866/missouri-governor-department-elementary-secondary-education-ssn-vulnerability-disclosure https://www.theverge.com/2021/10/14/22726866/missouri-govern...
- AlecSchueler 3y ago
  Threat of prosecution is of course always present, but the chance of that prosecution making it past the courts is significantly altered by actually committing the acts you might be accused of.
- autoexec 3y ago
  That should have been a carer ending move. According to wikipedia that jackass Mike Parson can't run again and will be replaced (https://en.wikipedia.org/wiki/2024_Missouri_gubernatorial_election https://en.wikipedia.org/wiki/2024_Missouri_gubernatorial_el...). I don't have much faith in Missouri to do better with their next election, but I'd be thrilled to be surprised.

thriftwy 3y ago

A good lesson to never do that - just use VPN to login to IRC to some hacking channel and report the issue there. Of course you should also do the white hat part in anonymized fashion.

ajdude 3y ago
This is the correct way to handle it. Publish the exploit after you've gave them the warning, but don't execute it yourself.

Cthulhu_ 3y ago

It's the danger of good intents but still breaking the law. If a house is unlocked and you go in to prove it's unlocked, maybe leave a helpful note, you're still breaking in. Report and move on.

plugin-baby 3y ago
> If a house is unlocked and you go in to prove it's unlocked, maybe leave a helpful note, you're still breaking in. What jurisdiction? I would think this was just trespass.
- pilchard123 3y ago
  IIRC some jurisdictions consider any force at all - such as pushing an already-open door further open - to be sufficient to make it B&E rather than simply trespassing.
  - plugin-baby 3y ago
    Force isn’t even required in some places, apparently! This page expands on the differences in a few countries: https://en.m.wikipedia.org/wiki/Burglary https://en.m.wikipedia.org/wiki/Burglary Canada > Breaking and entering is defined as breaking into a place with intent to commit another indictable offence England & Wales > A person is guilty of burglary if they enter any building or part of a building as a trespasser with intent to steal, inflict grievous bodily harm or do unlawful damage to the building or anything in it. New Zealand > burglary is a statute offence under section 231 of the Crimes Act 1961. Originally this was a codification of the common law offence, though from October 2004 the break element was removed from the definition and entry into the building (or ship), or a part of it, now only needed to be unauthorised.
    - scotty79 3y ago
      It seems that in many places intent to commit another crime is a key.

grotorea 3y ago

Nice welcome to the grey hat experience.