6 ms·

(DEVIL'S ADVOCATE) Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable?

• angelbar 13y ago
  They don't need help to see that some guy is fumbling their physical locks, a website can be attacked without been seeing. Let me put that in another way, if a guest lean close to a lock and then look around to report that there is a defective lock or prone to fail I will be grateful. (But not if he pickit)
• staticshock 13y ago
  With a physical lock, you'd have to pick the lock each time you wanted access, and avoid being seen. The bar for repetitive attacks on the web is much lower, because you only need to write the "lock picking" script once, and then you can use it indefinitely, disseminate it, etc. A poorly protected website is more akin a house with no lock on it at all, and reporting that "this house has no lock" is not a criminal act.
  • algorias 13y ago
    (Devils Advocate) What about this: seeing the house has no lock, opening the door, going inside, counting the money in the owners wallet, putting it back, then reporting that "Anyone could steal $300 from that guy".
    • hrjet 13y ago
      If I were that guy I would be very happy that someone informed me about the vulnerability of my wallet. I would definitely thank them and invite them for tea. Reporting them to police would be the last thing on my mind.
• seabee 13y ago
  > Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police. Sometimes these discoveries aren't intentional. Let's say I lean against a door and it's not locked. Well, I never meant to open it up, but since I can't prove I didn't intend to, and since the business can't distinguish people with honorable intentions vs. those without, why risk telling them? If you tar the helpful with the same brush as the crooks then you shall always learn the hard way from your mistakes.
  • nhangen 13y ago
    The articled states that the kid used SQL injection techniques to access the site and gauge the vulnerability.
    • stcredzero 13y ago
      Did he do anything that wasn't simply a GET/POST/PUT?
    • scarmig 13y ago
      It's perfectly possible to accidentally stumble across SQL injection. E.g. my street address growing up was 1901 Mayor's Road.
      • politician 13y ago
        Yeah, I had a hard time with my street address: 5987 O'Drop Table users; Go
    • evacuationdrill 13y ago
      The article supposed that's what he did, and it probably is.
• unethical_ban 13y ago
  Always beware of physical -> digital analogies. When the whole world has the ability to walk by your door, windows, and alarm system and pick at it without being seen, then you probably should be grateful when some of them let you know the back door is open.
  • stcredzero 13y ago
    Yes, but there's still a world of difference between walking by a door and stopping to pick the lock.
• heywire 13y ago
  Every time I hear about another case like this, I struggle with how I feel about it. I think it really depends on how he discovered the issue, and how far he took those findings. Let's say he just happened put a quote in a field and noticed that it broke the response from the site. That is a good indicator that a SQL injection might be possible. If he stops at that point and reports his findings, I don't see an issue with that. In my mind, it is like being at a friend's house, where you have permission to be, but noticing that their safe is wide open with their valuables visible to all. Or maybe being in a store and noticing that they've left the cash drawer wide open. However, if he continued to probe and see if he could get data using a SQL injection vulnerability, I feel that is more like walking up to the safe and jiggling the handle, or checking to see if that cash drawer is locked. I don't think your friend or the store owner would be very happy, and the site admins probably wouldn't be too happy about it either.
• MichaelGG 13y ago
  More like you're depositing checks into an ATM machine, then notice there's a keypad to open and you guess 1234 and to your surprise, you've found a lot of people's info. Or if you saw that it had a lock but the hinge was expose and pretty loose, and hey, you flicked it with you finger and it fell off. Physical-virtual analogies are difficult.