Hacking

I wouldn't recommend "fixing it yourself" because that is a federal offense.

Just drop a note and tell them that you're aware of a major security flaw in their site and that you'll fix it for a nominal fee. I wouldn't ask very much though, especially if it's something that could be fixed with only a few lines of code.

send them a message "1 r teh h4xx0r... ph33r m3... 1 pwnz0r j00!!11"!!1one!!2 i'm sure they'll be glad to waste their money on you.
EDIT: no seriously... if there is such a flaw then i would let them know without actually breaking into the system. you could demonstrate it to them if they want... the disadvantage is that they can fix it without giving you something in return... i'm not sure how you could prevent that..

Quote:

Original post by zer0wolf I wouldn't recommend "fixing it yourself" because that is a federal offense. Just drop a note and tell them that you're aware of a major security flaw in their site and that you'll fix it for a nominal fee. I wouldn't ask very much though, especially if it's something that could be fixed with only a few lines of code.

when I said fix myself I meant that if they gave over the code I would fix it. I am not planning to do anything without their knowledge and BTW is there anything wrong with the fact that I found the hack in the first place?

Tell them:
1) That there is a security vulnerability in their site.
2) You do not intend to exploit this, nor do you intend to tell anyone about it. This is strictly confidential.
3) Explain the consequences if a malicious person also discovers this vulnerability. Include specifics of exactly what a hacker could do.
4) Offer to fix it or simply or simply to tell them how to fix it for a nominal (unspecified) fee.

wow! you must feel special!

i think your lying trying to win our respect.

wel.. YOU LOOSE! bwahahaha!

Quote:

4) Offer to fix it or simply or simply to tell them how to fix it for a nominal (unspecified) fee.

that's the problem what should the fee be?

Quote:

wow! you must feel special! i think your lying trying to win our respect. wel.. YOU LOOSE! bwahahaha!

actually its a relatively well know security problem which Im sure a lot of people here know about.

If you found it by accident, just tell them how to fix it. If you found it on purpose, wtf were you doing?

Unless you're actually doing some work to fix it, you should have a price of $0. If you do fix it yourself, then charge a very low programmer's fee per hour or something like that.

I would tread lightly if I were you. Many companies would be and should be suspicious of anyone offering this type of service. If my supervisor received an unsolicited call or email from someone who "found" a vulnerability in our system and in the same breath offered to fix it for a fee, two things would happen. One, you would never hear back from him. And two he would just turn around and find someone that he knew who could confirm and fix the problem. I'm not really sure how or even if you should approach this company. Of course, I guess it could not hurt to try. Just expect them to be very wary of you.

CodeMunkie is correct, however he did not mention the subgroup that will not only get someone else to correct it, but also A) set the FBI on you for probing their private system in the first place (hacking being a federal offense worth several years in prison) or B) set the police and/or FBI on you for extortion or C) do both A and B at the same time. And yes, there have already been high profile cases of A) this happening and B) convictions being won (for example a certain new publications network and a certain high profile "hacker").

Your best is to keep your mouth shut, and stop trying to be so "helpful" by going around showing people how easily you broke into their system (just put this career in the context of the physical world - you wouldn't exactly take a job breaking into random houses without stealing anything, then knocking on their door the next day and offering them a home security system, right after telling them you broke in already). If you really think this is a career for you should look at a more legitimate business, one which sells its services upfront and does penetration tests with the boards authorization in writing.

What were you doing, breaking into a person's website without their consent? :oS

Do the right thing: Tell them about it, and how to fix it. If they offer you something to fix it for them, maybe consider taking it; however I certainly wouldn't. That would be like breaking into a house and expecting the owner to pay you for your advice on home security.

edit: Beaten to it :oP

Quote:

Original post by Michalson Your best is to keep your mouth shut, and stop trying to be so "helpful" by going around showing people how easily you broke into their system (just put this career in the context of the physical world - you wouldn't exactly take a job breaking into random houses without stealing anything, then knocking on their door the next day and offering them a home security system, right after telling them you broke in already). If you really think this is a career for you should look at a more legitimate business, one which sells its services upfront and does penetration tests with the boards authorization in writing.

I happend to stumble upon this hack - I don't go around sites checking thier security. This would be more comparable to me going by someones car at night and noticing that he leaves his keys in the door, and then telling him so the next day and suggesting a safer place to hold the keys.

is what I did illegal? if for example the forum here has some sort of securtity problem and I make a post to see if it actually works and then immediately (upon seeing that it works) delete it and tell them to fix the problem is there anything illegal about that?

I didn't do anything to the website although I could have and someone malicious can cause a lot of damage.

Them finding out about it like this is good for them

You all assume that he actively tried to break their site and that he succeeded.

I've seen a lot of security flaws on websites without even trying (heck, that microsoft SP2 thingy, while not really 'security-related' per see is a good example.)

My advice would be to write them a professional-looking email describing the flaw, the consequences it could have and say that you are willing to fix it for a fee. Give your full name and infos to show you are serious and do not intend on exploiting it.

The correct metaphor in this situation is more often than not the same thing as calling your neighbor on his cell phone because he left his front door open during a 3 weeks trip.

Edit: As has been said, be sure your email sounds in NO WAY like extortion.

Quote:

Original post by xMcBaiNx My advice would be to write them a professional-looking email describing the flaw, the consequences it could have and say that you are willing to fix it for a fee.

the problem is I want to get money for telling them about the flaw not the actual fixing. As I said fixing it is trivial. I think it would better at first not to give details.

Quote:

Original post by Jakarta Quote: Original post by xMcBaiNx My advice would be to write them a professional-looking email describing the flaw, the consequences it could have and say that you are willing to fix it for a fee. the problem is I want to get money for telling them about the flaw not the actual fixing. As I said fixing it is trivial. I think it would better at first not to give details.

Maybe only tell them the consequences and offer them to tell them the cause if the flaw isn't all that obvious...

But then again if it isn't all that obvious, that pretty much mean you searched actively for it...

Quote:

Original post by Jakarta is what I did illegal?

No. But it won't stop them from going ahead and suing you anyway.

My friend got sued by a bank in a similar incident where he discovered how to transfer unlimited amounts of money to his account via their internet banking interface. He didn't exploit them, but he still got sued. He actually got a lawyer from the EFF.

Quote:

Original post by Jakarta Quote: Original post by xMcBaiNx My advice would be to write them a professional-looking email describing the flaw, the consequences it could have and say that you are willing to fix it for a fee. the problem is I want to get money for telling them about the flaw not the actual fixing.

Stop being a greedy bastard and just tell them about it (or forget about it). If nothing else, it's the only route that guarentees you won't get sued. Try to get money out of them and bad things will happen.

Its clear you want to do the profitable thing rather than the right thing. If I was them, I'd see you not as someone offering a favour, but someone holding their website to ransom... you wouldn't want them to panic and call the authorities would you? Then they'd probably have to employ a security consultant to find the problem and end up out of pocket. Everybody loses, but you lose worst.

But thats just my opinion, I mean no offence.

i guess really many companies will simply adress FBI to you AND will not fix anything. Someone there tried to do that, and now is in prison, and i guess sw wasn't fixed... People [mis]understand hacking as "breaking the lock", not as "finding a bug that is already there". And anyway, in any case, don't call it security flaw. Call it "bug".

so i woulda simply
1:keep mouth shut.(probably)
2:send a bug report.(in case i don't mind FBI coming)

And i have noticed flaws in some sites i use (usually something stuid, like typoo in text field causes SQL errors(that is, potential query injection), or something similar).

btw, i have once found a possible flaw in this forum rating system and posted it and nothing bad happened. But it wan't hacking, and i haven't asked for fee...

edit: and to make my post more clear, i think it's near-to absolutely inpossible they will pay something to you. The only thing you can get is FBI, because they're probably very stupid.

Quote:

Original post by Jakarta I happend to stumble upon this hack - I don't go around sites checking thier security. This would be more comparable to me going by someones car at night and noticing that he leaves his keys in the door, and then telling him so the next day and suggesting a safer place to hold the keys. is what I did illegal? if for example the forum here has some sort of securtity problem and I make a post to see if it actually works and then immediately (upon seeing that it works) delete it and tell them to fix the problem is there anything illegal about that? I didn't do anything to the website although I could have and someone malicious can cause a lot of damage. Them finding out about it like this is good for them

No one can tell you if it's illegal or not. It all depends on how two lawyers and a judge interact. At the very least, being charged with either hacking or extortion would be bad enough (unlike a civil suit, you would have no means of getting back the thousands of dollars in legal fees). The simple fact is that dateless computer geeks don't make the laws, they don't choose when to apply the laws, and their personal opinion of whether a crime was or was not commited counts for nothing. For example a recent precedent of interest was when a judge ruled that a lawyer was guilty of computer hacking because he had used an incredibly broad subpoena to get all of a defendents email, instead of just the email relevent to the case (the lawyer of course could barely turn on a computer). Too many people go around with this playground assumption that if they can interrupt the word of the law in a partular fashion, that it automatically becomes binding to their own personal belief. Don't do that, instead think of how the law can and might be interpretted by a real procecutor and judge, or in the case of law suits, company lawyers.