Ask Slashdot: To Hack Or Not To Hack? 517
seeread writes "I discovered how to hack into and secure user accounts of a rising mobile payment start-up. Account info includes credit card details and usage. The company has big name financial backing and an IRL presence, but very few in-house developers, and they don't seem terribly concerned about security. Good samaritan that I am for now, I sent them an e-mail explaining the lapse on their part, but the responses I have received thus far are confused, aloof and unconvinced. So, I am wondering: what is the appropriate next step? Should I do a proof of concept? Should I go to the investors, or should I post about it somewhere? The representatives haven't been too receptive, despite the fact that their brand seems to be at risk, not to mention all of those users' credit cards. I almost feel like it's my responsibility to blow them out of the water if they have made it this far while compromising such trusted data. And although I would love to be in the paper, this hack is just too easy for it to be respectable, though I am sure the FBI could still be interested in all those credit card numbers."
PCI (Score:5, Insightful)
If they don't want to listen, go to Visa and MasterCard. They won't sit on their asses about exposed credit card data.
Re:First thing first (Score:2, Insightful)
Blow it up. People's privacy is at risk.
You're just asking (Score:5, Insightful)
For a 5 year tour of the federal penitentiary system, aren't you?
there is a saying, in my language (Score:4, Insightful)
translated:
do you know how to steal? (implied yes as an answer)
do you know how to *hide*?
Go to the investors (Score:5, Insightful)
Oh boy... (Score:5, Insightful)
Walk away. You notified the appropriate people. After that, it no longer has anything to do with you, and can only go pear-shaped from here.
Re:Language matters (Score:5, Insightful)
Retain a lawyer. (Score:5, Insightful)
You already made the wrong first step (Score:4, Insightful)
Now just forget about it and hope no one hacks them before they forget about you.
NONONO RED FLAGS!!! (Score:5, Insightful)
Cannot stress this enough. Jeeze.
Here are your options: Call them, email them. Thats it. Move on with your life if they ignore you. There's nothing that says they can't be incompetent if they want to, but there is something that says you can't break into their systems. (yes, even if they're not secured).
Re:PCI (Score:5, Insightful)
If you hadn't already exposed yourself to the owner, I'd write a how-to and send it to them anonymously, and later send the credit cards an ANONYMOUS tip.
Why anonymous? Hacking, even for white-hat reasons, is illegal in most jurisdictions. Even accidental hacking.
Now that you've exposed yourself to them it would be too easy for them to piece it together who turned them in for a nice PCI audit. It would be all too easy of them to send your emails to a computer crime division and get you busted, especially if they have any friends with influence there. Just avoid using their product and quietly tell your friends not to do the same.
The only time I have ever even considered informing a company of a security hole is on an occasion when I'd previously worked for them, personally knew the owner, and knew that the owner respected my ability.
For the love of Christ... (Score:1, Insightful)
First off, QUIT FUCKING TRESSPASSING.
I don't care if you're not doing it for money (though, you sound like you might do it for fame). It's wrong.
The company didn't ask you to do a security audit. It's not a public organization where you can claim some sort of "ownership" or such. It's a Private Place. They're responsible for their own security, not some random passerby. You have no business doing what you did, and that's it. If they blow security, they're on the hook for the consequences. We have very well established methods for doing that kind of reinforcement.
Dress it up how you want to, you're still a criminal - legally, morally, and ethically, it's none of your business, you shouldn't have done it in the first place, and quit doing it in general. Grow the Fuck Up.
Just drop it, period, and go find something else do spend your energies on. And, find another crowd of people to hang out with - those ones you're in with now aren't a good influence (obviously).
-Erik
Journalism works (Score:5, Insightful)
If you want to get the word out anonymously, approach a journalist. Journalists have a vested interest in breaking the next scandalous new story, especially those who are new and making a name for themselves. They also have a vested interest in protecting their sources, though you might still want to report it through an anonymous email account.
Don't ask Slashdot, Ask Ed Felten (Score:5, Insightful)
Ed Felten himself may not be the best person to contact, actually, since he's currently working for the FTC, but then again he may be worth sending an email to.
My point is this: ask someone who is respected in the security field and has years of experience. If not Felten, try and contact Moxie Marlinspike, perhaps.
It sounds like you are young and have very little experience with this kind of stuff. Do not make the mistake of thinking that anyone is going to thank you for your efforts. The company with the bad security may be run by a bunch of technological idiots who will see you as the threat. When the FBI comes calling, they will be more interested in seeing what criminal charges they can bring against you.
But don't be scared into inaction. Instead seek advice from experts who have been in the same position as you. They may have contacts and could help you present the exploit information in a way that is
1) legal
2) professionally done
3) likely to get taken seriously by the developers at the affected company.
Good luck! As long as you keep certain cautions in mind, you may have just stumbled onto a career in security!
Re:First thing first (Score:4, Insightful)
Someone left their front door open, lets go torch the house before someone steals something of value.
Oh shut up... (Score:5, Insightful)
Language evolves. You can fight the tide or swim with it. I know which way gets you drowned first.
Re:Language matters (Score:4, Insightful)
Reading Aaron Barr from HBGary talk to anonymous and then talk to his "programmer" about all his sweet "hacks" nearly killed me.
The 95 Hackers film has become reality. I can't shake em, he's right behind me! Crash overdrive! Acid Burn!
Ooh, plus there's Swordfish "dropped a logic bomb through the trapdoor" and the wonderful CSI "programmed a GUI interface in Visual Basic to track the IP".
We really need to start educating the non-technical public on some technical things. Treating computers and technology as a whole as a black box ends up in all KINDS of misunderstandings and misinterpretations.
Walk Away and Forget About It (Score:5, Insightful)
Slashdot has had many stories of well-meaning hackers trying to save companies from themselves, only to wind up being the target of federal and/or state prosecutors rather than being considered a good Samaritan.
Here's my advice:
1) Stop violating federal and state laws. You've just confessed to the world that you are committing federal and state felonies. Stop being a criminal.
2) Walk away while you still can, and maybe you'll still have a life to live free of federal and/or state prosecution.
Re:For the love of Christ... (Score:5, Insightful)
You're being a bit harsh on the guy. A lot of people started their IT careers in the computer underground, myself included. If it were not for LA 2600 meetings and the first few Defcons, I would not have developed the skills and background that landed me my first job as a sysadmin fifteen years ago. More recently (within the last year), the head auditor for my company told me that my background reassured him because he knew that I had a better perspective on computer security and the threat landscape than most "professionals" who picked up all of their knowledge in a classroom.
WRT the OP, it was dumb for him to go to the company. As everyone else stated, he exposed himself to some liability. Any information that he provides to the company could be used to build a case against him for computer trespass, unauthorized access, etc.
To call the OP morally and ethically criminal is overboard. He did not do any damage to them and did not profit from his activities. It was a real world learning exercise. It was not the brightest move in the world, but doing a security audit on a random computer system does not make someone morally bankrupt. If he had taken the data and sold it for profit, or even just posted it for fame and notoriety, that would be a different story. Instead he naively did "the right thing" without fully understanding the liability it exposed him to.
Re:PCI (Score:5, Insightful)
While you make a good point that Visa and MC won't sit on their asses about data, that is only from a PCI perspective. And realistically its trivially easy to maintain PCI compliance and have an insecure product.
What I would recommend however is work through a professional service like Secunia: https://secunia.com/company/blog_news/news/271 [secunia.com]. They can lend credibility to your claim and they provide what I personally would describe as an ethical approach to remediation. I would strongly not recommend any further testing on your part unless you are prepared to deal with legal consequences. Not that I agree with companies going after researchers, but it does happen.
Good luck.
let the card companies know (Score:5, Insightful)
"If you discover a vulnerable payment application and have specific information as to the payment application vendor, application version, where sensitive cardholder data is stored and vendor contact information, please notify Visa via email at cisp@visa.com."
Re:Full disclosure is the most ethical path. (Score:5, Insightful)
It's not only the most ethical, it's the only way this company will actually do anything. I'd also suggest to do this anonymously. Corporations have a habit of striking back blindly in random directions whenever they feel threatened, and this will most certainly threaten them. It wouldn't surprise me in the least if they tried to smack you down with restraining orders, defamation suits, or whatever the lawyers think will hurt you the most. If you release the information anonymously (and be very careful how you go about this), then there's nobody to slap down with restraining orders.
Re:Walk Away and Forget About It (Score:4, Insightful)
Stop violating federal and state laws. You've just confessed to the world that you are committing federal and state felonies. Stop being a criminal.
At what point do you become a criminal? By looking at the URL bar and seeing an SQL statement, which can be used for SQL injection attacks? For changing a few characters in the URL bar and seeing that they're sending you other people's credit card numbers? I agree that he should just fuck em and ignore it.
Re:First thing first (Score:5, Insightful)
My advice - do nothing further. You discovered the flaw and told them about it, the onus is on them to make sure that their systems are secure. Just make sure that you don't leave a trail for other, less scrupulous people to follow...you certainly wouldn't want a future breach and malicious use of this flaw to point to you as the one who discovered it!
Re:PCI (Score:5, Insightful)
That will be considered a threat no matter how you word it. Expect to go to jail.
How about your house? (Score:4, Insightful)
Would you mind if I broke into your house? Not to take anything, mind you, but just to check your security?
Re:First thing first (Score:2, Insightful)
Re:First thing first (Score:4, Insightful)
They are being reckless with people's personal information. Painfully reckless it sounds like, since they are ignoring clear warnings that they have vulnerabilities.
Look at what happened to Sony re: Playstation Network - and they didn't even lose anyone's billing information.
The negligence is already occurring, the damage is just waiting to happen.
EFF (Score:5, Insightful)
Shouldn't he contact the Electronic Frontier Foundation? Isn't its purpose to provide advice in this cases?
Re:First thing first (Score:5, Insightful)
Re:this is not news (Score:5, Insightful)
This is some idiot asking for advice on an absolutely terrible scheme which has been explained before
Isn't that what Ask Slashdot is all about?
Re:Nope, this isn't the Wild West anymore... (Score:4, Insightful)
I think you're just getting old. ;)
What the OP did is no different than what you or I did. The environment is different due to the criminal statues on the books and the willingness of the authorities to prosecute them. Other than that, it is just a kid / young adult pushing the boundries and seeing what they can get away with.
Given that the OP had the good sense to post here and ask for guidance shows that they have their head on mostly straight. The phone phreaking that you did was more objectionable than what the OP did. You stole services. The OP just found a flaw, reported it and then realized that the vendor had no interest in taking the problem seriously. By doing that, they are exposing their customers to fraud.
I agree with you about needing to emphasize ethics. I think the OP has shown ethics and a conscious awareness of responsible disclosure. Back in the day, the exploit would have been all over various underground forums, and everyone and their mom would be poking around the site.
Re:First thing first (Score:5, Insightful)
Right - I didn't mean "do something nefarious". I meant, go to the media or some authority agency under a white flag, anonymously, whatever, and get some exposure for it.
By "blow it up" I was thinking, if this company has had a few chances to act and has chosen to ignore the problem, take the next step in generating publicity.
No such thing as being a "good guy" anymore (Score:4, Insightful)
And not just in the tech world. You can be sued if you do CPR and crack someone's ribs if you're not certified. You can be prosecuted for going on someone's property if you hear screaming coming from the house. You can be prosecuted if you shoot an invader in your house (at least in the UK).
There's no use in being a "good guy" anymore. Just trying to help someone will get you in trouble anymore. If you're a guy and talk to a kid you don't know, everyone gives you strange looks. A while back a kid was trying to put books into one of those big metal boxes libraries have for returns, but couldn't quite reach the handle to open it. I opened it for him, and his mom, who was sitting in the car at the curb gets out and starts trotting at us. Books go in, he starts walking back, and she is giving me the evil eye while she grabs the kid and nearly drags him back to the car. All the while I'm holding my own books.
So why the fuck would I try and help anyone I don't know?
Re:PCI (Score:3, Insightful)
Now, every day, you're going to get every script kiddie in the internet trying to poke holes in your network. In fact, if they get in, thats fine. They're allowed to look at everything your'e doing (trade secrets) and they can copy user data, since this is legal. You're going to be in hot water with your customers, fast.
Also, you're getting DDoS'd now because of all these people hitting your computer at random times for fun, to "test" against that "vulnerability". Good luck dealing with that too.
Yes, in a perfect world everybody would always have iron-clad security. But if you think that is remotely how this world works, you're missing so many details which are fundamental. Not everybody needs to be like that.
What about a mom & pop store that has a small website for a few customers? Now, EVERYBODY EVERYWHERE has to ALWAYS have 100% perfect security. Its that or just DO NOT offer computer services. There is no inbetween allowed.
That is the world you are advocating. Instead of, let people be free, let people do what they want. If a company wants to spend X money on X level of security, they can do that. If you find them to be not concerned enough about security for your tastes, go to company Y which spends Y to get Y security. Thats how it goes, its a money balancing game. The more you spend on advertising, the less you spend on products. The more you spend on development, the less you spend on something else. If more people like a certain company's policy, they'll make more profit, and then they can afford more security.
But to just say that you ALWAYS, ALWAYS have to be up-to-date with 100% security or you can't own a computer is laughable. If that was the standard, there would be, what, a handful of websites on the internet? Google and a few banks? Comeon. Think it through.
Re:First thing first (Score:1, Insightful)
Re:NONONO RED FLAGS!!! (Score:5, Insightful)
No, the dumbest thing ever is the legal system which punishes whistleblowers. Wait, no, that's the 2nd dumbest thing ever. The absolute dumbest thing ever are the people who support a legal system that punishes whistleblowers.
Re:First thing first (Score:4, Insightful)
If his own account is secure and he has noticed that he could have accessed it without credentials?
Actually accessing his own account without credentials could also be breaking himself against the law.
Building a proof of concept legally is probably not possible, even if he builds it on his own network, on his own machine.
The laws are screwed until we can figure out how to get people to understand that computer memory is just fancy paper and CPUs are just fancy pens with fancy erasers.
I need to change my sig. Apple is now only a co-conspirator.
The site is www.thelevelup.com (Score:5, Insightful)
How long do you think it will be now before the blackhats start looking at the payment handling processes of 'a rising mobile payment start-up' with 'big-name financial backing' ?
I don't think there are too many companies that match your description..
No need to search to hard for the company. Our illustrious OP, aka Mr. Christopher Reed (http://seeread.info/) was naive enough to post this on twitter (http://twitter.com/#!/seereadnow).
"@TheLevelUp I think I found a trivial way to hack user accounts. Please get in touch to resolve."
At least he can point to the twitter feed as evidence that he was trying to contact them. This /. article where he considers "blowing them out of the water" would undoubtedly work against him though.
Re:First thing first (Score:2, Insightful)
there are plenty of insecure servers out there, we don't need heroes to come along and save us from them.
Seriously.
So if I build a computer at home, and I install an old, unpatched OS for fun, somebody is legally allowed to hack me? The implications of this would be devastating. Even if they aren't vulnerable, businesses could be DDoS'd without recourse on the grounds "we're testing you for vulnerabilities". People simply do not think things through fully.
You assholes and everyone else that respond that way...
do know how to make the distinction between a private
individual having a potentially hackable computer exposed
to the internet...
vs
A FUCKING COMPANY THAT IS IN CONTROL OF OTHER
PEOPLE'S MONEY AND IS ACTING LIKE THEY DON'T CARE,
NOW THAT THEY HAVE BEEN INFORMED... THAT THEY
ARE NOT SECURE!
So... you do know how to make that distinction... right?
-@|