3 ms·

I think the thing to be careful of here is the method(s) one uses to reveal a vulnerability. Think of a brick-and-mortar analogy. You queue up at airport secur

by plg 12y ago

I think the thing to be careful of here is the method(s) one uses to reveal a vulnerability. Think of a brick-and-mortar analogy. You queue up at airport security, you go through, and you notice that their procedures are such that one COULD bring a banned item through and potentially not get spotted. You inform the appropriate authorities that you think there might be a weakness, and you say how and why. This is probably not going to get you in trouble. Another scenario: You go through security and make a mental note (as above) of a potential vulnerability. You (as above) report it to the appropriate authorities. Now some time in the future you are going through airport security and you wonder to yourself "I wonder if they fixed it". So you decide to test it out. You bring a banned item through. You get caught. You are in trouble but you say in response "but I was the guy who informed you of the vulnerability and I was just checking to see if it was fixed". Good luck with that. My feeling is that if you notice a potential (or actual) vulnerability as part of a everyday, normal use case of a website, or a web service, or network, then fine, you can report it, and you likely won't get into trouble. On the other hand if you additionally decide to test the system in such a way that could be misconstrued as an attack, then you will probably get into trouble. Another analogy: you walk into Macy's and on your way in you notice that the security system they are using is outdated, and you know it is vulnerable --- (made up silly example) you know that if you break in while holding a tuna sandwich, the alarm will not go off. So that night after the store is closed and locked, you break in, while holding a tuna sandwich, and you take a pair of $300 shoes. The next day you go to the store and you say "look guys, I was able to break into your store and steal these $300 shoes." You think they will thank you? or will they call the police?

pitnips 12y ago
I like your first analogy. Your second analogy, on the other and, seems to me to justify the action. I think Macy's would thank you rather than call the police, but that's just my opinion.
- plg 12y ago
  maybe they would thank you. Imagine though the day after, they had noticed security camera footage of a masked intruder wandering the store, and then taking merchandise out the door. They can't identify the intruder. They call the police. There is an investigation. They spend $$$ on a new security system. People are fired. Then some time later you wander in with a smile on your face and tell them how you were the one who cracked their system. I can see a scenario where they are furious with you and call the police, telling them that you have just confessed to a crime. Then police then say, hey buddy you committed a crime, you confessed to it, and now you are trying to say you did it "for a good reason". Good luck with that.
  - tzakrajs 12y ago
    Bad analogy in this case because the school had no idea that their FTP server was even attacked in the first place. Better analogy to what happened: Imagine you steal the $300 shoes with your new fangled trick and the mall security do not notice at all. You come back the next morning with the $300 shoes in-tow and then they call the police.

by plg 12y ago

pitnips 12y ago

I like your first analogy. Your second analogy, on the other and, seems to me to justify the action. I think Macy's would thank you rather than call the police, but that's just my opinion.

plg 12y ago
maybe they would thank you. Imagine though the day after, they had noticed security camera footage of a masked intruder wandering the store, and then taking merchandise out the door. They can't identify the intruder. They call the police. There is an investigation. They spend $$$ on a new security system. People are fired. Then some time later you wander in with a smile on your face and tell them how you were the one who cracked their system. I can see a scenario where they are furious with you and call the police, telling them that you have just confessed to a crime. Then police then say, hey buddy you committed a crime, you confessed to it, and now you are trying to say you did it "for a good reason". Good luck with that.
- tzakrajs 12y ago
  Bad analogy in this case because the school had no idea that their FTP server was even attacked in the first place. Better analogy to what happened: Imagine you steal the $300 shoes with your new fangled trick and the mall security do not notice at all. You come back the next morning with the $300 shoes in-tow and then they call the police.