Testing/Evaluating/Disclosing an exploit isn't immoral in my mind, nor should it be illegal (in a perfect world).

Disclosing private details of third paries is certainly immoral in my mind, and should be illegal.

According to this logic publishing the exploit, so long as you're censoring output, is fine. If someone uses your exploit to download personal data, it's AT&T who is doing the immoral/hopefully-illegal disclosure. If that someone uses your exploit and then publishes the data or does some other naughty thing with it, book 'em.

You get moral brownie points under this logic if you notify the target after you discover the exploit. It's not required, because disclosure is notification. Nefarious-types aren't going to call up a bank to say "hey, we're stealing all your customer records", nor will they disclose this hole to the world.

Unpopular statement ahead: if you collect personal details, it's your job to secure your systems, and it's your fault if your systems leak them. Of course there's no such thing as 100% secure, but you're the one doing the risk analysis and design.

In this case it doesn't entirely work because it is trivial to recover in the information (so the disclosure/fix is hour sensitive rather than days sensitive)

Also, in Full Disclosure it is accepted ethical practice to notify the affected vendor and give them a reasonable time to fix it (In this case... I'd give them 2 days).

It is also very definitely not ethical to hand the data you got to the media. :)

I don't completely agree, but it's the prevailing point of view (and/or law) at the moment.

The purpose of disclosure is twofold: you want the vendor to fix the bug, but you also want the marketplace to take notice of the existence of the bug.

Knowing that Vendor M was informed of a bug and took 6 months to fix it, whereas Vendor L was informed of a bug and took 1 day to fix it, is useful to me when I'm evaluating an operating system vendor. The best way to have this information out there is to cause a big splash when you release it.

Fundamentally, the assumption is that white and gray hat hackers do not discover every bug out there. If you sit there and do semi-sophisticated static analysis on a lot of software, or fuzzing, you can discover a lot of 0-day vulnerabilities which no one has yet announced.

If end users don't feel pain from security vulnerabilities, they will not prioritize adequate security when they make purchasing decisions. Vendors with a strong security focus should support aggressive full disclosure of all vulnerabilities of all vendors.

weev claims to have received the data from an unknown source.

He then has AT&T informed through a third-party.

After that has happened and AT&T has fixed the vulnerability, he gives the data to a journalist and deletes it.

The journalist then writes about it and includes a small, badly redacted portion of it.

So, in summary weev did not publish the data in any meaningful sense and did make sure that the flaw was fixed before going public. What exactly about this is unethical?

1) "he gives the data to a journalist" 2) "in summary weev did not publish the data in any meaningful sense"

Really!?

Words have meanings. It is useful to know them.

Of course, the vulnerabilities that are fixed by working directly with vendors never end up the topic of news articles, so I'm sure it's not as cut and dry as an outside perspective would indicate.

Take a look at for example Apple's release notes for a security update: dozens of fixes, most reported by external companies and persons, all with proper attribution.

I'm fairly sure that the process does work most of the time.

That said, does the irresponsible disclosure of names attached to e-mail addresses justify what he's gone through, assuming a modicum of truth to his assertions of being denied a legal defense, gag orders, FBI raids, etc? In my personal opinion, his point that URL scraping is not in and of itself a crime is substantially true, and renders the subsequent raid unjustified. Whether that would render the drugs inadmissible or provide him any legal cover from that charge I certainly am not qualified to say.

On that note - could anyone point me towards literature on 'gag orders' in the course of U.S. justice? I'd be curious to read on the history and justification for these.