Hacker News Reader

Comment by mahmud | Hacker News Reader

This is extortion, plain and simple.

From Markus' account, it sure looks like that; but note that a "chris russo" says, in the comments, that he's only given a proof of concept and that the web server logs will show that he didn't make a full dump.

Of course, sending a PoC with an offer to fix the security does have a "nice website you have there, it'd be a shame if something happened to it" vibe to it; still, it's factually different from trying to extort money from a company by dangling a dump of their customer database.

That's a technicality in my opinion. If the website owner would ask you to fix it that would be one thing, to hack them and then to 'offer to fix it' (presumably for a fee) is across the line. It's a fine one but it's definitely there.

Hacked a site?

Send them a message about it, give them time to respond and time to fix. If they don't respond after a reasonable time has passed go public with it, don't try to translate it in to paid work.

Trying to turn a PoC into paid work is indeed sketchy; but I do understand that security researchers/whitehat hackers would like to get paid for their work.

It would be good if more companies set up bug bounties, and even better if they'd set the reward a bit closer to (reputed) black-market prices.

How come Russo was not shocked to hear the Russian threat story? It sure seems very suspicious NOT to refute that little nugget, no?

if you read grumo's comment http://news.ycombinator.com/item?id=2160916 you'll see it's not quite that simple

[edited to fix name. sorry 'bout that, been a long day]

Thanks cubicle67, it is "grumo" instead, no worries.

http://en.wikipedia.org/wiki/Extortion

> Extortion, outwresting, and/or exaction is a criminal offense which occurs when a person unlawfully obtains either money, property or services from a person(s), entity, or institution, through coercion.

Where is the coercion? Is there a threat here to do something? I can't see it. In fact, the opposite - the damage is already done.

The coercion would exist only if there was a threat to do something bad from the extorter, which really, I can't see at all.

Telling someone they should lock their door, and that you could do it for them (but not necessarily that noone else could, I mean what kind of developer can't fix a SQL injection attack in a couple of hours max?) doesn't seem like extortion to me. Now, if the claims about a stolen data dump held as collateral and threatening media reports are true, it borders on extortion.

Reply on news.ycombinator.com