Teen Reported to Police After Finding Security Hole in Website

Funny enough, I did the exact same thing when I was in high school, only we were running Novell on NT4 and I did it in basic and started it from autorun.bat which loaded before the network login screen.

It would let you try one time, tell you you entered the wrong password (saving it to file) and exit, at which point windows would load the novell login screen that looked exactly the same.

Good times.

I was threatened with a ban on computers at high school from my middle school.. because I had copied game demos to other user's accounts. [They gave me their username and password]

I also figured out how to access the middle school's library database without a login. [That wasn't secured, nor did it require a password]

Also, nearly got in trouble with the IT administrators at my high school because I found out how to send Novell messages.

I was a very bored kid.

> These attitudes haven't changed much since 1990 at least.

Why would they?

A blatant oversight is a sign of incompetence and by making such incompetence public, you're threatening their job security. Why would anyone react positively?

You're better off making the disclosure anonymously.

Witches were burned at the stake, basic human reactions have not evolved since dark ages. So basic premise of somewhat trivialistic movie "Hackers" the one with Jonny Lee Miller holds right - rest of the world is sheep(and it will get worse as we migrate from general purpose computing to specialized devices). Most of the world is made up of unwashed masses that consider computing something that resembles magic - you only scare and confuse them talking all the smart things that they do not really understand or grasp.

I'll conjure up respected Arthur C. Clarke - Third law: Any sufficiently advanced technology is indistinguishable from magic. Put scared people and magic together and you got bonfires going. This why hackers rot in jail for longer than murderous psychopaths.

But then again I was more of a black hat for most of my life than white.

my 2c

> Apparently if I had denied it they would've got the police involved, but I was honest and upfront when they asked me.

The problem is that this is usually a terrible gamble to make. I'm glad it worked out for you, but my general advice for anybody else would be not to talk to the administrators, the same way you should never talk to the police.

You never know if they're going to involve the police anyway after you spill the beans, and if they do, you'd rather they do it without already having a confession from you.

> I had found access to the remote server [...]. I was able to find the [...] Management Console and use a teachers [...] password [...] create a hidden admin user [...]. Through this I could [...] control every PC in the school.

And this is why we can't have nice things. Admins at The Age (in this case) see someone trying to "report" a vulnerability and instantly jump to the conclusion that the user is someone like you, who has already compromised and exploited the system and at this point just wants to gloat on top of it all.

Surely there is a spectrum between white and black hat hacking. But this is over the line, sorry. Once you start trying to guess passwords and modifying state to add backdoors (seriously!?), you have to reasonably expect the rest of us to try to resist and suppress you, by law enforcement if necessary.

After such a motivating action from the govt., they'll simply sell the vulnerabilities for some BTC to someone else.

It's a Government site, there's really no up-side to future issues being sold.

The problem is that this property transfers to other websites. I'd much rather a 16 year old report problems with my website to me, but if she doesn't because of fears that I will call the police as other webmasters have, I'm worse off as a result.

This is bad news for everyone who runs a website.

And every time that happens a bunch of apologists appear shouting "Why didn't they inform the site operators first? That is really irresponsible"

And then some poor teen believes it and thinks "maybe it's wise to inform the site first" and subsequently goes to jail for doing the 'responsible' thing. And so the cycle continues.

There are similar laws in many other jurisdictions.

I think there should be a digital whistleblower law to protect people who report such things in good faith. It should include a clause to make it negligence to ignore such a valid report.

Send an anonymous email or other notification to them? I agree it's scary to be penalized for "hacking" the system (in their eyes), but I also think these things can't be left alone. It'd be cool if you found a way to let them know.

You could send a postcard through regular mail to the head of IT's house, I think that would get the point across haha. They might be able to find you by checking access logs after the fact though, I don't think there is any riskless way to disclose.

You beat me to it. The weev paragraph was a total non sequitur; he wasn't arrested for pointing out their lax security, he went down for attempting to profit from it.

With a physical lock, you'd have to pick the lock each time you wanted access, and avoid being seen. The bar for repetitive attacks on the web is much lower, because you only need to write the "lock picking" script once, and then you can use it indefinitely, disseminate it, etc.

A poorly protected website is more akin a house with no lock on it at all, and reporting that "this house has no lock" is not a criminal act.

> Am I allowed to go to businesses and try to pick the locks, look inside, and then report to the business owner that their lock was pickable? Well... yes, but I'd probably be reported to police.

Sometimes these discoveries aren't intentional. Let's say I lean against a door and it's not locked. Well, I never meant to open it up, but since I can't prove I didn't intend to, and since the business can't distinguish people with honorable intentions vs. those without, why risk telling them?

If you tar the helpful with the same brush as the crooks then you shall always learn the hard way from your mistakes.

Always beware of physical -> digital analogies. When the whole world has the ability to walk by your door, windows, and alarm system and pick at it without being seen, then you probably should be grateful when some of them let you know the back door is open.

They don't need help to see that some guy is fumbling their physical locks, a website can be attacked without been seeing.

Let me put that in another way, if a guest lean close to a lock and then look around to report that there is a defective lock or prone to fail I will be grateful. (But not if he pickit)

Every time I hear about another case like this, I struggle with how I feel about it. I think it really depends on how he discovered the issue, and how far he took those findings. Let's say he just happened put a quote in a field and noticed that it broke the response from the site. That is a good indicator that a SQL injection might be possible. If he stops at that point and reports his findings, I don't see an issue with that. In my mind, it is like being at a friend's house, where you have permission to be, but noticing that their safe is wide open with their valuables visible to all. Or maybe being in a store and noticing that they've left the cash drawer wide open. However, if he continued to probe and see if he could get data using a SQL injection vulnerability, I feel that is more like walking up to the safe and jiggling the handle, or checking to see if that cash drawer is locked. I don't think your friend or the store owner would be very happy, and the site admins probably wouldn't be too happy about it either.

More like you're depositing checks into an ATM machine, then notice there's a keypad to open and you guess 1234 and to your surprise, you've found a lot of people's info. Or if you saw that it had a lock but the hinge was expose and pretty loose, and hey, you flicked it with you finger and it fell off.

Physical-virtual analogies are difficult.

Where do you see that the paper gave them the kid's info? All I see is he contacted them directly, and no indication that the followup from the paper is where they got his info.

By that logic why would he even bother reporting it and have security experts poking around the logs and potentially find traces of his download.

Personally i would have sold it to the highest bidder. Being "white hat" gets you in trouble more often than not.

Il stick to "gray hat" thank you very much. If i ever choose to disclose any vulnerability to the owners i will not reveal my identity and after arbitrary amount of time say... (1 month) if it's still present sell it to the highest bidder let them deal with the consequences.

You have to be strict when teaching people and this is no different. If you let them set the rules they could choose and unreasonable length of time like 1 year before they allow you to disclose anything.

You are the one in the position of power never let them take that away from you. By revealing you identity you give away all your power.

If you're not a threat people don't take you seriously.

I'm not sure timing matters, ever. Why should it? Large organizations will pay millions of dollars for canned 'assessments' that create far more noise and operational problems than reports like this - yet the knee here reaction to responsible disclosure is "well you didn't send it to us on the third Sunday of the month after a blue moon". Get a clue. If someone responsibly discloses then suck it up, fix it and when you don't expect to hit the front page of the local news. That's how reality works today, and as stated in the article, if this young researcher has found it it's either already known or the sands of time were close to running out on malicious use case.

I believe that if an organization wants to incriminate responsible disclosure then they have to have a public ToS stating any disclosure is subject to just that. Then they will dissuade any free help in a public fashion and left to their own devices. In that case there should be non-retaliation protection available via the state to anonymously submit without fear of being penalized.

If there was a big hole in the side of a bank and it was illegal to talk about it do you just accept it and move on? Do you continue to bank there? There's inherent risk with providing Internet based services. Deal with it instead of being ignorant about it.

I agree it was a bad day to email PTV, but in another article I read on it he was simply trying to find out some info on Myki (the current travel card). Unfortunately I can't find it though.

Assumptions are the mother of all fuckups.

Would you cut off your own hand or leg? They definitely will not.

It should never be a crime to report something to the police.

It should be the police's responsibility to make a decision about whether reports should be followed up or not. We should hold the police, prosecutors and the courts culpable for making reasonable judgements here, not random uninformed members of the public.

This is a bit different and would be like the neighbor opening the door and waking into your bedroom to tell you.

My doormat says "GO AWAY", the old school robots.txt.

Your analogy doesn't hold. There are few spiders trying every door and window of every house. The risk profile (attack surface area) is much smaller in the physical world.

If a service publishes a port, many someone's will probe it, legitimately or not.

Where your analogy does hold is courtesy. If one of my neighbors sees my door open, does a walk thru to check things out (I might be bleeding out in the basement), finds nothing, then I absolutely do want her/him to clue me in.

Ditto my website(s).

That's trespsassing, isn't it?

Physical metaphors DO NOT WORK in this scenario. This is not a house or a car or commercial warehouse or anything else... it's a website. There are far too many relevant differences between physical locations and web sites for metaphorical reasoning to work.