It sounds like he spent two months extracting data through a flaw that's existed for years and then bragged about it after it got closed to his egregious usage.
Is this considered normal or ethical behavior for a security researcher?
Is this considered normal or ethical behavior for a security researcher?
Hopefully it wasn't just closed to him, but closed to everyone else too.
> Is this considered normal or ethical behavior for a security researcher?
weev did something similar (scraped 100k phone numbers from Apple, then shared them with a journalist) and was convicted and sentenced to 41 months in prison for it.
Especially given that things like GDPR and and the CCPA are drawing clear boundaries around private data and how companies can use it, it shouldn't be impossible to make laws that regulate how third parties access and use that data.
I'd also hope that Twitter faces regulatory penalties and perhaps civil liability depending on the harm done.
This is no different than SSH into some machine and try password combinations, or try to login someones email with bruteforce.
Although rate limiting etc is necessary, I think brute forcing someones email account should be illegal.
Ibrahim Balic "ruined" it, though public bragging (which is not responsible disclosure).
Some people dislike the term "responsible disclosure" and believe it's not a moral imperative:
https://hn.algolia.com/?query=author:tptacek%20responsible%2...
Of course what Ibrahim did wasn't full disclosure either, so he shouldn't be fully congratulated. But bragging about it was better than keeping silent about it in this case.