Hacker News Reader

Comment by watty | Hacker News Reader

(DEVIL'S ADVOCATE)

Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police.

Websites, like locks, aren't bullet proof. How many web applications out there don't have a security flaw somewhere? Doing penetration tests on unwilling victims is risky. Trying to break wifi, company intranets, people's computers, etc. It's best to pentest as a professional, with willing victims or wait for a "pentest" contest.

View on HN

> Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police.

Sometimes these discoveries aren't intentional. Let's say I lean against a door and it's not locked. Well, I never meant to open it up, but since I can't prove I didn't intend to, and since the business can't distinguish people with honorable intentions vs. those without, why risk telling them?

If you tar the helpful with the same brush as the crooks then you shall always learn the hard way from your mistakes.

The articled states that the kid used SQL injection techniques to access the site and gauge the vulnerability.

Did he do anything that wasn't simply a GET/POST/PUT?

It's perfectly possible to accidentally stumble across SQL injection.

E.g. my street address growing up was 1901 Mayor's Road.

Yeah, I had a hard time with my street address: 5987 O'Drop Table users; Go

The article supposed that's what he did, and it probably is.

Always beware of physical -> digital analogies. When the whole world has the ability to walk by your door, windows, and alarm system and pick at it without being seen, then you probably should be grateful when some of them let you know the back door is open.

Yes, but there's still a world of difference between walking by a door and stopping to pick the lock.

With a physical lock, you'd have to pick the lock each time you wanted access, and avoid being seen. The bar for repetitive attacks on the web is much lower, because you only need to write the "lock picking" script once, and then you can use it indefinitely, disseminate it, etc.

A poorly protected website is more akin a house with no lock on it at all, and reporting that "this house has no lock" is not a criminal act.

(Devils Advocate)

What about this: seeing the house has no lock, opening the door, going inside, counting the money in the owners wallet, putting it back, then reporting that "Anyone could steal $300 from that guy".

If I were that guy I would be very happy that someone informed me about the vulnerability of my wallet. I would definitely thank them and invite them for tea. Reporting them to police would be the last thing on my mind.

Every time I hear about another case like this, I struggle with how I feel about it. I think it really depends on how he discovered the issue, and how far he took those findings. Let's say he just happened put a quote in a field and noticed that it broke the response from the site. That is a good indicator that a SQL injection might be possible. If he stops at that point and reports his findings, I don't see an issue with that. In my mind, it is like being at a friend's house, where you have permission to be, but noticing that their safe is wide open with their valuables visible to all. Or maybe being in a store and noticing that they've left the cash drawer wide open. However, if he continued to probe and see if he could get data using a SQL injection vulnerability, I feel that is more like walking up to the safe and jiggling the handle, or checking to see if that cash drawer is locked. I don't think your friend or the store owner would be very happy, and the site admins probably wouldn't be too happy about it either.

They don't need help to see that some guy is fumbling their physical locks, a website can be attacked without been seeing.

Let me put that in another way, if a guest lean close to a lock and then look around to report that there is a defective lock or prone to fail I will be grateful. (But not if he pickit)

More like you're depositing checks into an ATM machine, then notice there's a keypad to open and you guess 1234 and to your surprise, you've found a lot of people's info. Or if you saw that it had a lock but the hinge was expose and pretty loose, and hey, you flicked it with you finger and it fell off.

Physical-virtual analogies are difficult.

Reply on news.ycombinator.com