Man arrested in VTech hack that exposed data for millions of kids
arstechnica.com
arstechnica.com
If you find a SQLI vulnerability, you assume you own not just the site but the whole deployment environment. You won. Don't go trying to prove you won. Very few companies, even the ones that post bug bounties, will put up with random people on the Internet owning up their backend servers.
Even on professional pentests, you ask permission to pivot. If it wasn't in the rules of engagement when the test began, chances are the answer is "no". (That's no surprise: there isn't much to be learned by the target from it. A gameover is a gameover.)
So make sure you're protecting your identity when you do stuff like this, oh, and also don't take data from systems that you have no business accessing in the first place, even if it is to prove a point it can still get you into a lot of trouble.
Old enough to drink in a bar, vote in an election, die for his country, and he's a "boy"?
Mind you, the arrested hacker here went way beyond what was necessary to illustrate the vulnerability.
As a software developer, how comfortable are you with criminal liability for security vulnerabilities?
>Whoever... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any protected computer;
The spirit of this law is fine: security is notoriously hard to get right. We have to account for the human component that will inevitably fudge something. Thus companies that give reasonable attempts at securing their data yet still fall short in certain areas are still protected under the law. Conversely, companies that don't care are also protected due to the letter, rather than the spirit, of the law.
"Us enthusiasts don't mean any harm and almost never perform tests that break the software (or network). There's a reason why bounty programs exist."