News for hackers. Stuff that matters.

A comment on I found a security issue on a competitor, got fired and served a summons. Parent comment

Re:I found a security issue on a competitor, got fired and s... by tptacek on Wednesday March 16, 2022 @11:03PM (#30707184)
This happens a lot! It's gotten people in trouble even in situations like bug bounty programs, where some amount of testing is authorized --- there's a delicate set of norms about stopping your exploration when you find a problem. In a situation where there's no prior authorization --- as is likely the case here --- violating whatever implicit norms exist can easily get you in legal trouble.

At the very least, if you stumble across something that spits out a plaintext credit card number, stop right there and don't do another damn thing with the target. Don't see which credit card numbers you can see, don't change the `/100` in your URL to `/101`, just stop.

[ Parent | on HN ]
Re:I found a security issue on a competitor, got fired and s... by borski on Thursday March 17, 2022 @03:50AM (#30708618)
...and report it, apologizing for going too far in the first place but explaining how you got there and that you want to cooperate in any way to help them fix it.

And please, don't tell them you'll give them the bug if they pay you or give you a t-shirt - this is blackmail, most likely (IANAL), and sure to get you in trouble. (but it happens)

[ Parent | on HN ]
Re:I found a security issue on a competitor, got fired and s... by ballenf on Thursday March 17, 2022 @08:53AM (#30710602)
The crazy thing is how unintuitive the law is here. If we were calling customer support and asked "can you tell the card number of [John Doe/customer 314/etc]" without ever claiming to be that person, wouldn't we put 100% of the blame on the company for answering that question? (If the caller there used the number, that'd be a different story.)

Most devs outside security would just assume that unless you're doing something encryption-related or at least trying multiple passwords, you're not hacking. You're just asking nicely for information.

It is amazing how little technical knowledge you need to violate the CFAA.

[ Parent | on HN ]
Re:I found a security issue on a competitor, got fired and s... by aaaaaaaaata on Thursday March 17, 2022 @08:48AM (#30710551)
Oh, the URL change...so many drug test results.
[ Parent | on HN ]