I found a security issue on a competitor, got fired and served a summons

https://accidhacker.wordpress.com/2022/03/16/i-found-a-security-issue-on-a-competitor-got-fired-and-served-a-summons/

by accidhacker • 4 years ago

359 365 4 years ago

accidhacker.wordpress.com

giantg22• 4 years ago

Clearly life hasn't moved on. The other shoe can drop at any time.

"and have a lawyer working on all this drama."

WinterMount223• 4 years ago

Very neat idiom. Is it really used and understood by people in real life?

giantg22• 4 years ago

I've heard it a few times and understood it.

sonicggg2• 4 years ago

Yeah, and it's not like lawyers do this as a charity. This is already a financial burden.

Ansil849• 4 years ago

If there is now a pending card fraud case that you are now involved in, how did you manage to get another job? Like you said, this kind of thing is a carrier killer. Does your current employer know about it?

bsuvc3• 4 years ago

… and have a lawyer working on all this drama.
But I mostly kept this story to myself and felt it was time to share, even if anonymously.

I’m sure your lawyer would beg to differ that it is “time to share” if you still have a criminal and/or civil case pending.

I’m not sure why you’re publicizing what you have been accused of and providing the level of detail you have provided.

And is a Wordpress-hosted blog truly anonymous?

Anyway, I guess you are here for questions, so here is one: Do you feel like you made an ethical mistake attempting to find security holes in the competitor, or do you think your former employer overreacted and was wrong to fire you?

roastedpeacock2• 4 years ago

And is a Wordpress-hosted blog truly anonymous?

Would not be surprised if someone figured out how to register a free Wordpress account to the point where any disclosed information is a dead-end trail to any corporate investigators. Takes a dedicated discipline and tradecraft.

If I was in the shoes of OP I certainly would not be discussing anything related to my case until either its conclusion or with all publications reviewed by lawyers.

Then again I have not been in this situation but have seen how things can go south when certain advice is ignored.

Benjammer4• 4 years ago

I mean, it’s par for the course with someone who thinks it’s just a no-big-deal, “personal interest,” to MITM a bank’s mobile app in order to start poking around in their production servers, without prior consent from the bank.

more_corn• 4 years ago

If this description gets submitted as evidence, the case will be dismissed. The way it is described is 100% legit pen testing with public data and endpoints and no malicious use of vulnerabilities found. If this is actually what happened the case will get thrown out.

Is it ethically wrong to check a public product to see if it follows basic security protocols? Especially if you’re an expert having created those security controls previously? Obviously not.

Is it ethically wrong to ask your employer before submitting findings to a competitor? Maybe? But only because you have an obligation to disclose regardless of what your employer says, but a judge isn’t going to be mad about following chain of command. It probably helped the bug report get p0 attention from the security team.

The fact of the matter is if the vulnerabilities were real and it sounds like they were, it’s fantastic news that the vulnerable company was able to fix them before the errors were exploited widely.

Benjammer4• 4 years ago

I’m sure the lawyers could figure out how to argue that the MITM attack this person did is some kind of illegal identity fraud.

aahortwwy5• 4 years ago

The way it is described is 100% legit pen testing with public data and endpoints and no malicious use of vulnerabilities found.

"legit pen testing" requires consent from the owners of the system being tested.

EarlKing• 4 years ago

...and that is why you never try to help businessmen. EVER. You just laugh and move on. At best you tell people privately not to do business with them, but you NEVER stick your neck out. There is absolutely no way this wasn't going to end in a lawsuit. Don't be this guy. Seriously. No matter how much of a duty you think you have to report security matters you find this episode vividly illustrates the fact that no good deed goes unpunished.

And people wonder why even in the future nothing works.

devwastaken• 4 years ago

This is why you leak anonymously and let the wolves take care of it as nature intended.

dikaio2• 4 years ago

Issue is, he will be stored in logs traversing through accounts not his.

hnthrowaway03152• 4 years ago

I'm not sure an unprepared one can leak anonymously and safely.

mike006324• 4 years ago

... or report the vulnerability anonymously?

sneak2• 4 years ago

It's not a leak to publish your own original research.

pabs32• 4 years ago

... or report it anonymously to a higher authority like the CERT for your location.

Aachen19• 4 years ago

Your IP is still in the access logs. The advice is good and we do this sometimes when not wanting to spend work time to deal with corporate politics around the reporting (though frankly the back-and-forth with the CERT is often a game of its own), but it wouldn't have helped in this case.

ironmagma• 4 years ago

There is absolutely no way this wasn't going to end in a lawsuit.

That’s what you call an inaccurate cynical view.

Aachen19• 4 years ago

Not sure why this is (edit: was) downvoted. I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work. With perhaps the substantial difference that I don't work for a bank and my employer would not fire me over such hearsay accusations from a competitor. We find security problems all the time, not always on purpose. I'd disclose it myself if I found it during non-work time, but it doesn't really matter either way. Since OP doesn't do security professionally, involving the CISO sounds like a good call honestly.

Using anonymisation proxies just makes it all the more suspicious, by using a normal connection and disclosing any findings it's quite clear you're using your real name, have no malintent, nobody needs to try and dig for your identity...

wyldfire2• 4 years ago

From what little I know of the world, this kind of litigiousness is more peculiar to the US than the rest of the world (or maybe at least the ones who usually speak English?).

GauntletWizard• 4 years ago

Yes, in the EU he would simply be serving time, with little to no lawyer involvement from the companies - the government would have taken care of the whole thing.

77pt773• 4 years ago

It's not.

Germany is way worse.

throwawaysleep4• 4 years ago

I feel that in so many cases as a developer, the best thing for me to do is to let things fail.

Scrum incentivizes waiting for bug reports from production.

Low tenures for employment mean there is no reason to care much about maintainability or security.

The pay difference between excellence and mediocrity is 2%.

What a world we live in.

actionfromafar• 4 years ago

Which one gets 2% more?

brailsafe2• 4 years ago

I wouldn't even restrict this to security matters; don't stick your neck out for your employer at all for any reason, unless the risk has already been taken or you're a shareholder. The nature of capitalism and employment is one of control and risk management. Unless you're guaranteed to be rewarded (very well), don't do anything beyond your basic responsibilities. More than that costs extra. You either have control, or you don't, and as a normal employee, you don't. This is how I learnt not to care about doing very high-quality work, because it costs me disproportionally more than it costs my employer, and it usually doesn't matter if they're big enough.

asdfasgasdgasdg4• 4 years ago

TBH I definitely wouldn't want my employees going around and hacking competitors in their free time. Too much potential liability. I can see giving a star performer a chance if it's their first time doing it and if they'd already come clean about it to the other party, but otherwise I'd probably cut my losses.

It's one thing if it's a designated, well-vetted free for all, like Project Zero, with clear legal approval. It's another thing for a regular employee to be hacking competitors -- that begins to look like industrial espionage. And even GPZ doesn't hack banks.

kortex3• 4 years ago

Eh, I agree it was kind of a dumb move, but there's no reason he shouldn't be able to have a snoop around. This wasn't "hacking" in the exploit sense. Web scraping, poking and prodding at APIs (yes even "private" ones), indexing a user ID, looking at source code, injecting your own code (e.g. modifying client js), redirecting some requests, none of these are hacking or exploitation, they are literally how the technologies of TCP/IP, HTTP, the web, and web browsers are meant to work.

I'm not sure where the line of "trying to break security" it, but none of the above count. Even accidentally blasting some endpoint with automated garbage. Intent matters.

mike006324• 4 years ago

Well... his man-in-the-middle was a false attestation of identity to gain unauthorized access. That is pretty much the definition of hacking. The app would have otherwise encrypted the traffic and they wouldn't have been able to 'poke around'.

tptacek29• 4 years ago

There is a reason he shouldn't be able to have a snoop around: it's a violation of federal law. Don't test other people's websites without permission (and even then, be careful).

I worry that people read a lot about vulnerability research conducted on iPhones or Chrome or whatever and assume that it's open season on any kind of application, but the rules for apps running on other people's servers are very different.

treis2• 4 years ago

there's no reason he shouldn't be able to have a snoop around

Copyright, anti-trust, patent, civil and criminal liability beg to differ. It's just a bad idea to snoop around the technical implementation of your competitor's product. Nobody should do it without the explicit prior permission of their employer.

roastedpeacock2• 4 years ago

The kinds of assignments involved with GPZ also shy away from server-side applications ran by other companies.

Maybe doing approved bug-bounty research in a competitors webapp is a safer proposition.

unethical_ban• 4 years ago

You're probably correct from a liability perspective, but from a hiring perspective in that space, you probably want the kind of personality that is driven to do such things working for you.

tsimionescu8• 4 years ago

If by "such things" you mean trying to see how your competitor implements their product, no, that is certainly not the kind of personality you want to work for you (assuming you are not some unethical hack like Uber, of course).

guelo• 4 years ago

Imagine not wanting curious people on your staff.

asdfasgasdgasdg4• 4 years ago

Curiosity is very important, but it is not the most important quality a person can have in all contexts. Wisdom comes to mind as one that is more important sometimes.

belval2• 4 years ago

You can be curious without being reckless.

mypalmike3• 4 years ago

Do you want staff to be curious enough to... Let's see... Run queries on your customer database to find out their friends' account balances?

Benjammer4• 4 years ago

If this (not infosec) person was doing this type of security probing during work hours using work equipment, I could see them being fired even if they are hacking on the company’s own product.

You’re not paid as a competitive intelligence analyst and security researcher, regardless of your “personal interests,” you’re paid to work on a product to make the company more money.

Furthermore, if you start unpacking the mobile app of a bank and doing actual pen testing analysis in the wild hitting their prod servers, even accidentally, you seriously need to understand the situation you are putting yourself in, regardless of where you work.

aldebran4• 4 years ago

This is the part I’m stunned about. So many in this thread don’t see the liability of unpacking a competitors app and poking around their APIs.

Forget CC fraud. This opens up liability for IP theft. Even if the other company doesn’t win the case it is going to create a shitstorm that might potentially give them free PR. “Look our new product is so good their devs are reverse engineering our innovation to copy us”

Forget what this person found out. Going and unpacking the app and using private APIs itself was a dumb move regardless of what happened after. People can be idealistic and talk about intent but it really is a bad move that opens all kinds of liabilities.

paganel• 4 years ago

if you start unpacking the mobile app of a bank and doing actual pen testing analysis in the wild hitting their prod servers, even accidentally

That sounds pretty damn incriminating, not sure how the OP thought he could get away with it. The article is not available anymore but at first I had thought that he might have poked around with the help of Chrome inspect tools on their competitors' web app, saw a call or two being made to their backend API and then randomly changed the ID in the query being made or something like that and see what the response would be. But unpacking the mobile app to see what API backend calls are being made is on a whole another level.

To be fair, nowadays I would not even choose to do the first thing, i.e. playing around with making backend API calls based on what I can see through Chrome inspect tools, I've read about too many cases of people getting in legal trouble about it to now know better. I might have done it 5 or 7 years ago, but definitely not now.

ummonk2• 4 years ago

Yeah aside from the hacking there are potential copyright issues if he’s digging too deep in reverse engineering the competitor’s app.

Aachen19• 4 years ago

Also when none of it ever leaves their own computer? It seemed to me like they were poking around for curiosity, not to publish any dirty laundry substantial enough to be a reverse engineering or copyright issue.

Aachen19• 4 years ago

I definitely wouldn't want my employees going around and hacking competitors in their free time.

Where do you work? Just so I know where not to apply.

justin_oaks• 4 years ago

Hey now, they said they wouldn't want their employees doing it, not that they'd forbid employees doing what they will with their free time.

jahewson3• 4 years ago

This is both a conflict of interest and could bring the employer into disrepute. Many employment contract rightfully forbid such actions, free time or not.

mypalmike3• 4 years ago

Please name a company where you would expect such behavior to be encouraged. Genuinely curious.

meetups3232• 4 years ago

If I went to my manager telling them I was hacking a competitor's infrastructure and accessing competitor PII & proprietary IP, I'd fully expect to be fired on the spot. And they're the most laissez faire manager I know.

Aeolun5• 4 years ago

Depends on how you raise it right? “I was trying to research how X built their app, to see if there was anything we could or should do in there, and I think I found a huge security vulnerability.”

jonathankoren6• 4 years ago

I can see giving a star performer a chance

No. A million times no. You do not use double standards. It kills morale, because it's immoral. Anyway, a top performer, should know when to walk away and contact security and legal.

If I found this. I would immediately have contacted my manager, and our security team, and see if our security would advise legal. Then we'd immediately contact OtherCo's security team.

If you find a security flaw, you have to immediately report. You DO NOT "explore" someone else's machine. It goes sideways too easily, and people always want to get the cops involved. Your number one duty is to protect yourself.

robocat• 4 years ago

Your number one duty is to protect yourself.

Which may involve not informing your own manager or security team, depending on context?

I wonder if he would have been caught if he hadn’t told his own company?

asdfasgasdgasdg4• 4 years ago

I'm not saying I'd give them a chance to hack. I'm saying there's a chance I wouldn't have fired a star performer immediately on hearing they had been hacking. If it was someone I could afford to part with, I would, without a warning. The behavior in this blog post shows extremely poor judgment.

precommunicator• 4 years ago

And what makes you think you have or should have any control over what your employees doing in their free time?

5ESS• 4 years ago

As the saying goes, no good deed goes unpunished.

galaxyLogic• 4 years ago

I think it's great that you shared your story with the world. We can learn something from this. I guess it is that security researchers can easily be accused of all sorts of things.

It is true that exposing a vulnerability in somebody's product can make them mad, since it can harm them. Especially with banks, they are not the most ethical entities out there. Good luck. I wonder if more people would like to offer their advise on what you should have done instead.

plebianRube• 4 years ago

It's been my experience as well that exposing vulnerabilities, especially financial makes enemies, not friends.

So basically we learn do the minimum possible, to not do the right thing so as not to get fired, and ignore gaping holes leaving them for someone else to risk their neck on, all so we can pay bills for 50 years and then hopefully retire.

What a life.

eek2121• 4 years ago

Unsure why this is being shared with potential criminal and civil charges being involved.

Also, if true, you likely have enough evidence for a stellar lawsuit against the company once all is said and done. You may also have enough evidence for a second lawsuit against your employer depending on exact circumstances. Hopefully your lawyer is knowledgeable enough to navigate these issues.

In the future, don't involve your employer with security disclosures. Ensure you document everything and email or write the company in question to give them time to fix their issues. What they did is wrong, however you should have reported it to them in a reasonable amount of time. Not that you are required to, but rather, to cover your own butt and prevent this exact type of scenario.

wyldfire2• 4 years ago

Also, if true, you likely have enough evidence for a stellar lawsuit against the company once all is said and done.

To what end? If your adversary has attorneys on staff it will be a bigger gamble for you to bring a suit against them.

gm2• 4 years ago

Employment law attorneys work on contingency, so no expense to you. You start on the wrongful termination suit, get evidence, and then go after the other company based on what you discover from your previous employer.

dredmorbius2• 4 years ago

Original author seems to have had a change of heart, or valuable legal advice. The blog post has been removed and the Twitter profile locked.

Archives of the first, at least, still exist.

sroussey• 4 years ago

What’s the company with the flaw that is suing?

kyleee3• 4 years ago

is it Stripe?

hnthrowaway03152• 4 years ago

The story reminds all of us that anything related to banking should be taken very seriously and unless well prepared a technical person should stay out of the business described in the story.

Let the dinosaurs have their own ways, good or bad.

krater235• 4 years ago

The technical person should just anonymize his accesses and make the most damage he can. Lets financial loss find his way into the brains of the dinosaurs.

blaisio• 4 years ago

Op should really delete this blog post. It has a lot of details that could be used against them in court.

throwaway889900• 4 years ago

It's already on HN now and the Wayback Machine is a thing. Once it's on the internet, it's pretty much there forever.

fsckboy• 4 years ago

you mean destroy evidence to hinder the prosecution?

jimbob45• 4 years ago

Surely this will have a happy ending, right? He specifically didn’t name and shame but he certainly could and that sort of dirt could lose a financial company some serious customers. I imagine they’ll pay him for his silence.

daniel-thompson• 4 years ago

Or simply offer to make the lawsuit go away for his silence.

77pt773• 4 years ago

This will end in criminal charges.

Mark my words.

If it gets to trial the judge won't understand anything and all he'll hear is hacking. Same for jury if one is involved.

Most likely a plea with probation and now he has a criminal record (possibly felony).

dannyobrien• 4 years ago

I'm willing to bet $100 that it will not end up with criminal charges. We'd need to set some sort of time-limit, if you're prepared to take the bet. How about six months?

bsuvc3• 4 years ago

I think you could be right.

This isn’t some “right click view source” nonsense.

OP put in some decent amount of effort into compromising the bank’s system. A judge and jury will not understand this, even if they are a computer literate power user, and even if they work in IT in a non-security role.

I also assume that OP is telling their side of the story in the most favorable way possible, and could be omitting some details.

erosenbe04• 4 years ago

Not likely. Prosecutor has a giant stack of these type of cases and takes the ones that are slam-dunk frauds or where there is some political capital to be gained. This doesn't sound like one of those.

krater235• 4 years ago

No he is just still hardly naive and thing he can win without to shaming both enterprizes for the shit they done.

dikaio2• 4 years ago

I would really like to know what bank this is.

dqv2• 4 years ago

The bank that fired them? Or the not-bank that is presumably taking legal action? I can only speculate that Whistlr means a hip company we all know about that has been doing all sorts of things in the paying-for-things space. This hip company has rather recently started doing card issuance.

bastawhiz• 4 years ago

Why would you bring this to your manager instead of trying to find a way to report it directly to the competitor, anonymously or not? If a bug bounty seems like a conflict of interest, refuse it. From the perspective of the competitor, this was an unreported security vulnerability. Of course they were going to find out; if I logged in one morning and the DB table that's supposed to be nearly empty suddenly wasn't nearly empty anymore, that's alarming!

So much here is just an absolute wild failure of judgement.

aahortwwy5• 4 years ago

Couldn’t help myself but do one more request changing the ID. Brought another card number and name.

Most likely illegal.

Don't do this.

noasaservice• 4 years ago

Go on the dark web, sell the exploit, and move on.

Companies, this is what the rest of us recommend when YOU don't have a responsible disclosure program with $$$.

avalys• 4 years ago

So, it sounds like, this guy worked for CorpCo, found a security issue with OtherCo's app, and explored their APIs (maybe from CorpCo's network?), including accessing at least one CC number that was not his.

Someone else later discovered the same issue with OtherCo and stole a bunch more card numbers, and used them to commit fraud.

OtherCo looked through their logs, saw the initial exploration coming from this guy at CorpCo, assumed he was also responsible for the subsequent fraud, and contacted CorpCo which ultimately fired him. The fraud was substantial enough for OtherCo to convince authorities to pursue criminal charges.

It's a sad story - but it's not unreasonable behavior from all involved.

Aachen19• 4 years ago

it's not unreasonable behavior from all involved.

Isn't it? I understand OtherCo uses legal means to investigate more effectively, a judge might order ISP logs to be turned over or so, but CorpCo knows this person, knows they disclosed what they saw from the start. It sounds pretty unreasonable to fire someone over hearsay, especially when it's unlikely to be true (what dumbass does card fraud and tells their employer—a bank—and requests they disclose it to OtherCo?).

And even from OtherCo, they're acting like it's the 70s and they've never heard of responsible disclosure. I understand their logic a bit more for the aforementioned reason, but still, reasonable is not the first word that came to mind.

tcook_sucks_xie• 4 years ago

Eh it's worth looking into, it's not a stretch to think that someone could find a bug without trying to conceal themselves.. then return later from a more anonymous client to exploit the bug further

it's not proof of guilt but a reasonable trail to follow up on

3np• 4 years ago

I do find it unreasonable to assume that OP would have been the only one finding and exploiting such a blatant vulnerability.

jollybean• 4 years ago

If the retention of the employee is seen as a liability, then that's it, he's out.

Very unfair from employees perspective, but 'self interest rational' from the Corp.

If it's perceived that the employee 'went to far' in their 'discovery' of the competitive API, and that could possibly constitute a crime, then it's basically a 'no brainer', they're going to have to let him go.

Since the staffer did actually report it right away, hopefully he will have his own political cover, and can communicate that to future employers, who should 'get it' - though some won't.

It's unfair but these things happen when an incident blows up into something where the stakes are much higher. 'Fairness' at the microlevel goes out the door towards ostensibly bigger objectives.

650REDHAIR2• 4 years ago

Yeah, next time report it to the feds/state.

Get protected status as a whistleblower.

sneak2• 4 years ago

No, do not talk to the police. Anything they need to hear before charging you can be published publicly on the web. Anything they need to hear after charging you will be communicated to them in writing by your defense attorney.

jahewson3• 4 years ago

I don’t see how it’d count as a whistleblower if it concerns a company that has no relation to your employer.

tptacek29• 4 years ago

There is no protected whistleblower status available for finding web bugs.

paxys7• 4 years ago

You missed the part where he immediately reported the vulnerability to his manager, security team and execs and got the assurance that it was being handled. If after that he is still thrown under the bus and fired, it's clear that someone at his own company dropped the ball and put the blame on him. I wouldn't be surprised if the actual fraud was committed by one of these people as well, using the very hack that he found and disclosed.

jahewson3• 4 years ago

Agreed that anyone who knew about the flaw should be as suspect as the employee in question. But what was this guy doing pentesting a competitor instead of performing his job duties - that’s grounds for being fired right there. Even with an “ok” outcome he’d have arguably caused harm to his employer.

ivraatiems2• 4 years ago

Finding a vulnerability is one thing. Using it is another. This person overstepped pretty severely and I'm not shocked at all that they got fired.

And honestly, writing this post at all continues to show bad judgment. I don't think this person understands where white-hat boundaries are, or how to deal with being accused of a crime.

Please reconsider if you think doing something like this to your competitors - or anyone - without some kind of program of consent on their part (like the previously mentioned Project Zero) is a good idea.

stjohnswarts3• 4 years ago

Save those emails folks... Never take a hand shake or a voice confirmation on something that could get you in trouble.

de6u99er• 4 years ago

That's an important point, which will make white hats think twice if they are going to report stuff like this in the future or keep it to themselves and deny anything that might circle back.

mkdirp• 4 years ago

it's clear that someone at his own company dropped the ball and put the blame on him

Hard disagree. Why is he reporting it to his own company? It's in his company's best interest for a competitor to have a security issue. He should have gone directly to the competitor's security team. Could have potentially gone anonymous. Could have gone through another person. A reputable security researcher. Lots of other things he could have done, but didn't.

mmaunder2• 4 years ago

Also could land them substantial prison time under CFAA Re accessing a computer system beyond what was authorized. The above link seems to redirect to a default site now. I’m guessing they yanked the post.

Back before crime it was ok to explore all over town and on private property. When the kidnappings and burglaries started, all that changed. And I’m so very sorry about this because the old days were truly magical.

tptacek29• 4 years ago

If they didn't do anything with the information, as seems likely (why assume otherwise, people? we're not detectives!) then no, it's unlikely to result in substantial prison time. The thing to watch out for in these benign cases is doing things that trigger substantial forensic investigations, which easily run into 6 figures. If you don't cause that kind of damage, and you don't in any way attempt to profit from the activity, then there isn't actually much in CFAA that will drive sentences up.

(I'm not a lawyer, but for obvious career reasons I nerd way the hell out on CFAA stuff).

ufmace• 4 years ago

It's also not completely crazy to wonder if this guy discovered the flaw like this, reported it in a way he knew would never actually get to OtherCo, then exploited it himself through a more anonymous channel for real. Then wrote it up like this and made himself sound super-extra-innocent when he found it.

vaxman• 4 years ago

Agreed. This is the most likely scenario. His blog post is literary trash and full of unconvincing self-rationalizations of his every move prior to being caught, while also digging a hole for himself by articulating what kind of industry-insider knowledge was required to exploit that vulnerability. There is, however, a small chance that he is telling the truth, but it’s not enough to get him off the hook in a civil case (at least in the US) because the standard of proof is much lower. Dude’s handle on Twitter is “AccidHacker” and he may claim that’s short for “Accidental Hacker”, but that’s also not believable, from a literal/legal perspective anyway —more likely something an actual hacker would post lamenting how they wound up in such a life.

Aachen19• 4 years ago

Which jurisdiction is this in? I'm fairly sure this wouldn't fly here, afaik you can't be fired if you are doing your job properly, you didn't do something like steal from your employer, and the company isn't in trouble and can't afford you anymore. This is just hearsay, plus they already knew the claim was nonsense because you up front disclosed the issue.

I'm not even sure which company I fault more here, OP's or the one with the security issue.

paxys7• 4 years ago

I'm pretty sure running destructive pen tests on a competitor using work resources without any prior authorization from either company counts as doing your job improperly.

Aachen19• 4 years ago

using work resources

Did OP do that? I thought he said he did it in private time, so I assumed using private resources (the post is deleted now). Using work resources does change the situation, though if it's just about client-side systems and not IP space then it makes very little difference in practice. Especially if your employer lets you use hardware for private purposes (this is apparently very common for company phones and laptops in NL/BE/DE; personally I like to have clear boundaries there...), but we don't know if that was the case here iirc.

destructive pen tests

That's not really what happened though, if I remember the post correctly. Running a GET without authorization header whatsoever on a beta application and getting back production data with secret payment tokens in it... you can't make that stuff up.

tptacek29• 4 years ago

Not sure where "here" is for you, but in the United States, you can be fired for having a bad haircut. Conducting unauthorized security testing on a company competitor will absolutely get you fired.

Aachen19• 4 years ago

Not sure where "here" is for you, but in the United States

...which is exactly why I was asking which jurisdiction OP is in. Kind of annoying when that information is omitted. I work in Germany but am from the Netherlands; both cultures and the resulting laws are quite similar anyway.

Conducting unauthorized security testing on a company competitor will absolutely get you fired.

In the US, maybe. If all US companies are like OP's. For a data point from Europe, I actually asked my employer because it seems people here (mostly from the US afaik) thought I had too much confidence in my employer in other comments. I commented here with what I asked and their reply: https://news.ycombinator.com/item?id=30710078

It's also a bit different to look into a product meant for the general public (that's how I understood OP's situation to be), or if you actively seek out to hack a competitor's infrastructure and mess with them (not what OP was doing from my understanding).

sergiotapia• 4 years ago

Leak anonymously and let nature take it's course. Never put your fate in the hands of beancounters.

dspillett• 4 years ago

Many moons ago we were scanning ourselves to test changes to our infrastructure, and when testing externally scanned /24 instead of the /29 range we had. We found two wide open SQL servers, listening in public addresses with blank sa passwords (the default on install at the time, oh those innocent days...). Out of curiosity we had a quick look and found one if them contained credit card details. We backed out very quickly... Not wanting to leave such a hole open but also not wanting to risk accusations of hacking we worked out who the companies were by other clues and forged emails warning then about the issue (sending them via a wide open SMTP server, again innocent times!). We never checked to see if anything changed.

brailsafe2• 4 years ago

It doesn't sound all that unlike if you were to be doing IT work for your company on your bosses computer, accidentally click on the folder, and woops, you just discovered a lot of photos of a particular sub-class of people. Do you not say anything, and potentially leave yourself liable, or do you say something, and risk the fallout from that?

lupire• 4 years ago

Maybe someone committed card fraud, maybe an employee, and is pinning it on OP. Or vice versa.

The write up is pretty confusing and doesn't read like an expert.

akmr726• 4 years ago

if you had any written documentation when reporting (at your ex-employer), it might have played out differently i feel (they would have been on hook for any legal notice)

WheelsAtLarge• 4 years ago

Shooting the messenger, seems to be a common practice when it comes to security issues. We only hear about those situations where someone has gotten nailed because they reported an issue but the fact that it happens at all is a problem.

I think part of the problem is that fixing a security issue is expensive and usually involves company management that has very little experience with code development so they think the person that reported the issue is a black hat hacker. It also makes life difficult for everyone involved.

A solution is to have a neutral in-between organization that can better understand how to deal with the problem without having to blame the person that reported it.

shahbaby• 4 years ago

That natural independent organization will know even less about the code base than management and will likely just add more dead weight to the problem.

dlsa• 4 years ago

Shooting the messenger is cheaper and maintains the appearance of security which is apparently much more important. The emperor's clothes are particularly fine today, are they not?

kyleee3• 4 years ago

They are indeed the finest garments I've had the pleasure of witnessing

sanguy• 4 years ago

Banks, credit card issuers, and many brokerages suck from a tech stack perspective.

During the y2k times I did a lot of contract work porting old COBOL code to be y2k compliant. The number of seriously spooky security things was mind boggling.

Having mocked API's like you found is not a surprise. The fact they even bothered to use API's was a step in the positive direction versus telnet and ssh tunnels to pipe data around with hard-coded ip's and accounts.

throwawaysleep4• 4 years ago

At one of my jobs, we integrate with a lot of APIs. There are background check companies out there that just have a single API for all user data with no restrictions. If you want to check a person's past employment, you get their social security number.

Shit like this is why we keep such outrageous behavior quiet.

pingsl• 4 years ago

You were very likely not the only one who found this security issue. But you were probably the only one who disclosed this issue to the bank.

This is ironic, but it is how business people deal with issues.

ummonk2• 4 years ago

And of course he doesn’t name and shame them so they have no penalty for this despicable behavior.

sonicggg2• 4 years ago

Wow, the author is very naive. Did you really think anything good would come out of you telling this to your employer? Your do not owe them anything you do in your spare time, unless there's some contractual obligation. Companies are just looking after themselves, and will quickly throw you under the bus. I am very paranoid with that.

I used to explore APIs and do this sort of digging for fun, even though I was employed. My approach was the following. If the company had a decent bug bounty program, I'd be happy to report it there, it's the safest way for anyone to do that. If there was not, I'd try to sell it to an "alternate buyer", which is less preferred. I never many things worthwhile reporting though.

650REDHAIR2• 4 years ago

FinTech really embraces the “move fast and break shit” mantra.

I’ve seen so many blatant violations in my short stint it would make your head spin.

Happy to never go back…

trhway• 4 years ago

Couldn’t help myself but do one more request changing the ID. Brought another card number and name.

weev. If one doesn't know his story, the one shall do no such web requests. Or at least should know what the Tor is :)

Interesting possibility here - say somebody intentionally left that as a backdoor for a little side hustle of card fraud for themselves and associates or just to sell it and masqueraded it as just sheer security incompetence, and the author just happened to be a convenient patsy of opportunity.

duxup2• 4 years ago

It seems like that a good alternative would be to anonymously contact the other company via email and just leave it at that.

I wouldn’t involve my employer ever.

I’m confused by his employer’s response, he told them everything, they knew, then the other company said something else happened?

So they took the other company’s word and fired him?

I’m not surprised that could happen but a little they would just believe the other company who they already know don’t know what they’re doing.

The story ends abruptly and … seems missing things.

aahortwwy5• 4 years ago

The value of the author's continued employment was less than the cost of fighting accusations of corporate espionage/sabotage from a direct competitor.

duxup2• 4 years ago

The other company thought there was corporate espionage… and they think the company spying on them volunteered the information?

And then they wanted just one rando fired?

Not sure that sense.

rukuu001• 4 years ago

OP - the people involved only want to cover their arses, and they're all using you to do it. This is unjust, but unfortunately it's also normal. Time to stop talking and focus 100% on avoiding conviction by working carefully with your lawyer.

AlexCoventry2• 4 years ago

I'd ask a lawyer about suing the accusers for libel.

eyelidlessness• 4 years ago

That’s a good way to narrow your legal representation to crackpots and scam artists.

hk1337• 4 years ago

It sucks but I can totally see the employers and competitors viewpoints. OP not only cracked open the app but made requests to their server. OP is not involved with the infosec at their employer and has no business cracking open their competitors app. The blowback from this could have been huge for the employer.

notyourwork• 4 years ago

And its gone, 404.

lamontcg2• 4 years ago

I have no idea why you'd expect to have the right to probe around APIs like this and not be accused of malicious hacking.

You don't have authorization, you're working for a competitor, that business decided to throw you to the wolves because its easy for everyone involved to forget you ever said anything since you didn't leave any paper trail.

If I find you sneaking around in my backyard having managed to open a ground floor window I'm going to probably lose my shit and call the cops, and not thank you for discovering a security flaw.

You need to get permission for this kind of shit, and not go around jiggling other people's locks.

And the level of effort here seems fairly high and a lot more than just "view source".

The author probably deserves to lose the ability to be employed at a bank because this was some pretty bad judgment.

ramraj07• 4 years ago

Lol the audacity to say any of this. The only mistake this dude was trying to be nice to either of the two shit companies he worked for. A fintech created a shitty shitty app and released it to the public and you accuse this guy of “jiggling” the lock ? He should have totally released this info on 4chan and let the wolves do their job.

aldebran4• 4 years ago

Unpacking a competitor app and poking around private APIs to reverse engineer implementation is a liability landmine. Ask your company’s lawyer.

Finding and disclosing a security flaw isn’t even needed for this to be a problem. You’re immediately a liability to your company. You’re breaking TOS or whatever agreement the competitor app install or usage has. You’re opening up your employer to an espionage or IP theft lawsuit.

There are many easy ways to do compete analysis that don’t involve these liabilities.

krater235• 4 years ago

Maybe you don't understand what happened here. It's not your lock where he jiggles. He just found out that your bank that states that she secures your money with a good lock in a safed room stores your money on a big pile on the yard without a fence.

olyjohn• 4 years ago

This is less like sneaking around your back yard, and more like going in the front door of a business and looking around, and then finding a bunch of credit card numbers sitting around on the desk behind the counter.

winkeltripel• 4 years ago

You don't have authorization

Yes, you do. Authorization and Authentication are part of the API. If you want to keep a server private, don't give it a public IP and DNS!

krater235• 4 years ago

Exactly! When you throw your data on the street, don't suppose that no one will read it.

lamontcg2• 4 years ago

If you don't lock your doors, it doesn't give anyone else the right to come into your house.

A business can be sitting unoccupied with its doors flung wide open, and that is still tresspassing if you enter without authorization.

"You were too dumb to stop me, so its my right to rifle through your shit" is a nerd law that doesn't exist in the real world.

Don't do this kind of jiggling of door handles without authorization, if you don't want to wind up like OP.

Ask a real lawyer for advice.

They'll almost certainly tell you not to do it.

c1ccccc1• 4 years ago

Based on the text of the post, it seems like OP stopped "probing the API" as soon as they had enough information to know that there was a security hole. So is your proposal that any kind of probing of APIs in general should be considered malicious? Like if someone has an image conversion API and I submit a gif, or a 1x1 image to see what happens, that makes me a malicious hacker?

That position seems wrong to me, and the strained physical-world analogies you give don't justify it. Often, testing something directly is the only way to find out how it actually works. Which is necessary in plenty of non-hacking situations.

bastardoperator• 4 years ago

Who wants to bet this testimony will be exhibit B?

throwaway984393• 4 years ago

Mods: please kill this post, for the sake of the poor person going to court soon.

alphabetting• 4 years ago

404'd. That was quick. Seems like he took advice of some in this thread.

Gentil2• 4 years ago

Directly informing the effected bank and then informing your then employer would've been a better solution? I think it has the highest chance for least negative repercussions. I assume it would still go a bit wild, but have the least negative impact. Obviously I could be wrong.

You need to keep in mind that security disclosures and everything around (legal, why disclose? etc) it is a black box for most folks.

Also OP said after reporting it, "months later" OP was fired. This means anyone in those months anyone could've found what the OP found and abused it. And the effected bank might've not been involved until later? And all those crimes are now on your shoulders. Your then bank employee would get delayed through the politics in your company (even with good intentions). It will happen even for their own security disclosure handling. Let alone for competitors cos so much legal stuff are involved now.

From the effected bank's POV, you are just a bank employee who did some fraud. Mainly cos you didn't inform the effected bank and it's been months. Insider hacks from the same industry is not unheard of.

Like I said, this would've been a different scenario if you informed them ASAP. And I am sure when issues hit the roof your employer would wash their hands off. It is the easiest thing to do. Unless you are very well connected in the office. Otherwise even your employee are not sure about you. They will be asking questions like, why is this person doing this anyways? He is not in security so why was the OP poking around it? etc etc.

Hope this gets sorted out. Interesting case indeed.

netheril96• 4 years ago

Directly informing the effected bank and then informing your then employer would've been a better solution?

We've seen many cases where if you report a security vulnerability to a company, they blame you as a hacker instead of thanking you.

Gentil2• 4 years ago

I assume it would still go a bit wild, but have the least negative impact.

Which is why I added this. It will not be a smooth experience. But the OP will still be in a better position than the current one IMO.

You tell me who looks MORE suspicious.

- A guy who found a vulnerability and reported very soon and hence the effected bank know about it soon.

- Or when the effected bank finds out after A COUPLE OF MONTHS (even a few weeks after) that their competitors employee found a vulnerability and they still haven't heard about it?

Keep in mind the added issue of the employee being from a competitor and that they might have already seen abuse of the vulnerability which might not be done by the OP. But since it is delayed, all of it is in the OP's shoulders.

dredmorbius2• 4 years ago

See tptacek's suggested resource from this thread:

https://news.ycombinator.com/item?id=30707216

Resource: https://clinic.cyber.harvard.edu/files/2020/10/Security_Rese... (PDF)

HN submission: https://news.ycombinator.com/item?id=30710885

krater235• 4 years ago

Thats the reason why you everytime anonymize your accesses, don't tell anyone from your findings that has nothing to do with it and sell the shit in a bug bounty or on the darknet. And if there is no one who will give you money for it, make the most damage you can to make clear that it's a financial risk to deploy insecure software.

jaltekruse• 4 years ago

https://web.archive.org/web/20220317003600/https://accidhack...

shagie• 4 years ago

... as its now off line.

The linked twitter feed at the bottom of the page is also protected/inaccessible.

paxys7• 4 years ago

I really hope for this person's sake that they kept a log of communication with their manager and higher-ups when initially disclosing the vulnerability. After losing access to company systems (after getting fired) I doubt HR is going to be very helpful in fighting their case.

coopreme• 4 years ago

https://archive.ph/2022.03.17-013109/https://accidhacker.wor...

phnofive• 4 years ago

Thanks, poor fellow is too clever for his own good.

I haven’t made any transaction with those card numbers, told anyone specifics on how to get them, nor took any kind of advantage of this data.

Well, he just did. With this sloppy (forgivable if naïve), curiosity driven approach, I wouldn't be surprised ongoing exploitation wasn't simply the result of not cleaning up the test rig. Did he at least clear this with his lawyer before posting? Given the 404, I'm thinking not. Sheesh...

bagels• 4 years ago

I'm sure someone clued this person in in that this blog just gave his adversaries a huge gift in their lawsuit. Not a smart move at all to publicly announce your own guilt in a case you might want to win.

pain_perdu• 4 years ago

underrated comment.

arcwhite3• 4 years ago

Lots of people suggesting that either company was out of line here, but like, CFAA is still a thing (assuming OP is in the USA) and it's still got gnarly teeth. Let alone the possibility of industrial espionage allegations...

If you're going to go hack on a company, make sure you have some legal protection first. Check disclose.io or the company's website (look for a security.txt!) to make sure there's some sort of safe harbor provision, or a pre-existing vulnerability disclosure program or bug bounty program that allows you to do this kind of testing.

If you're not going to do that, then disclose the vulnerability anonymously and cover your ass while you're testing, or just don't.

Meanwhile if you're an American please write your local representative and express your displeasure with the antiquated, overly-simplistic CFAA and ask them to support initiatives to have it replaced or removed.

gameswithgo• 4 years ago

I hope one day you are never a victim reading some asshole talk down to you about why it your fault.

mmaunder2• 4 years ago

CFAA isn’t going away.

If you're not going to do that, then disclose the vulnerability anonymously and cover your ass while you're testing, or just don't.

No. Just don’t. Know that video about not talking to the police because they interrogate people all day long and you’re an amateur in a pro fight? Same thing with infosec. We attribute IOCs to noobs all day long.

You don’t need a criminal record. It’ll ruin many parts of your life. I have friends who can confirm that the record they got in their late teens or early 20s closed many doors. Join a formal bug bounty platform and find legitimate work there.

arcwhite3• 4 years ago

CFAA isn't going away

There's some pretty concerted efforts in play to at least have it updated and tempered, which could have legs. I don't hold much hope it'll go away but I do think some of these efforts to have it replaced could have legs.

No. Just don’t.

Yeah, fair, I mean I'm all too aware of the consequences myself, but within this setting telling a bunch of people "thou shalt not" seems almost more harmful (IMO it's akin to saying "never roll your own crypto" which someone inevitably ends up taking as a challenge)

erosenbe04• 4 years ago

Industrial espionage is not involved here. This is just reverse engineering that escalated into something that might be misconduct.

Espionage would include things like illegally surveilling the competitor's networks, bribing their employees for information and credentials, using malware to create backdoors, social engineering, blackmail, poaching their talent and incentivizing unethical disclosure of trade secrets, and cracking systems that explicitly bar access.

Reverse engineering their product through public IPs is legally acceptable up to CFAA boundaries, which are fuzzy, and it's not clear what kind of exploits were involved in this situation. They may have been relatively benign reverse engineering, or they may have been something associated with civil and criminal penalties.

arcwhite3• 4 years ago

The perception of the possibility of the perception of industrial espionage is usually enough to get a lawyer choked up in cases like this - I wasn't saying there WAS industrial espionage, just that there might have been the possibility of painful allegations thereof...

tptacek29• 4 years ago

From exactly where do you draw the conclusion that "reverse engineering a product through public IPs is legally acceptable up to CFAA boundaries"? What are those "CFAA boundaries"? There is no exception to the CFAA for "reverse engineering"; there is only exceeding your authorization, or not.

There is a lot of authoritative writing about the legality of reverse engineering (long story short: reverse engineering is mostly fine, legally) --- but that writing covers reverse engineering stuff running on your own computer. It categorically does not extend to reverse engineering software running on other people's computers without their permission. You'd easily get into a bunch of trouble assuming otherwise.

A lot of terrifying stuff on this thread! It's good this person already has a lawyer.

tsimionescu8• 4 years ago

You personally reverse engineering an app on your phone has been quite well established as legal.

You releasing a competing product after having personally worked on reverse engineering someone's product is a lot murkier, and easily opens you up to copyright lawsuits, which you'll have a hard time fighting if you do happen to have similar code, since in copyright it matters not just if the code was similar, but also whether it's likely that you actually copied it (unlike patent law).

This can and has been done, but normally you want a very clear firewall between the reverse engineering team and the dev team, with lots of paperwork proving that no-one on the dev team ever saw a line of code from the reverse engineering team - they were only told concepts and ideas, which are not copyrightable. This is how the first free Unix was created, for example.

YPPH• 4 years ago

I'm not able to load the page.

"AccidHacker" "Coming Soon"

Is this happening for anyone else? Perhaps it has been deleted?

berkut2• 4 years ago

Yep, same here...

wizerno• 4 years ago

https://archive.ph/2022.03.17-013109/https://accidhacker.wor...

jhgb• 4 years ago

https://archive.ph/gNEv9

mark-r• 4 years ago

Likely to be deleted I think. If I was their lawyer I'd insist on taking it down immediately.

ipaddr3• 4 years ago

I was reading the article finished left and went back and thought let me check something.. it's gone.

jimrandomh• 4 years ago

tl;dr: Programmer doing competitive analysis on a competitor's new financial product discovers that it has poor security. Unsure of the how to correctly report vulnerabilities to the competitor, he raised the question to management inside his own company. His company's management, presumably not being infosec people, gets confused and the vulnerability report is lost in the corporate shuffle. Later, someone else rediscovers the same vulnerability and uses it to steal. The competitor that wrote the vulnerable app also botches the investigation, and blames the programmer, since his account appears in weird log-file entries from back when he was investigating.

I'd say the main mistake here was, after finding the vulnerability, handing off the reporting responsibility to people who couldn't handle that responsibility rather than handling it personally.

charcircuit• 4 years ago

The moral of the story is that you should use Tor / a proxy and remain anonymous if you are planning on hacking someone else.

cato_the_elder• 4 years ago

On one hand we have this poor guy, and on the other hand we have Aubrey Cottle, the guy who leaked personal details of about 100,000 individuals and openly bragged about it on TikTok. [1]

Anarcho-tyranny is truly the mot juste.

[1] https://thegrayzone.com/2022/02/18/hacking-canadian-trucker-...

DoItToMe81• 4 years ago

This guy has a history of claiming to have performed every hack under the sun for the last fifteen years. He's probably not being prosecuted because this info is very public, he's a well documented bullshitter.

I saw it happen personally with a bunch of GNAA related hacks. He had befriended the people who actually did them, and within a year or two of finding out more details, was using them to claim he had either masterminded and planned them all or performed them all, alternating between the two based on whatever was 'cooler' in the situation.

spoonjim• 4 years ago

If you are not making money from security you shouldn’t mess around with it at all. Too much downside and too little upside. Let the criminals ransomware the hospitals until society grows up and learns that they need security research.

jpgvm• 4 years ago

No good deed goes unpunished.

I learnt this lesson in high school when I disclosed serious security vulnerabilities in the schools IT systems and statewide VPN and firewall/censorship solution. I was effectively expelled (in technicality "asked to leave").

Unless someone is paying you just don't bother. Even if they are paying you stick to the systems in the brief.

BeefWellington• 4 years ago

The two parts where this person (I'm guessing you, OP) went wrong:

    A company that wasn’t any kind of direct competitor announced they’d start issuing credit cards (then turning into direct competitors), and I started to became more and more curious about what they were building as I knew some (pretty good) people working there.

    After reading that they had launched some card stuff on their production app, I downloaded it and looked for card-related assets (it was something really simple, unzipping a .ipa file and looking for images/texts)

Step one here essentially throws away any plausible deniability you have that you weren't trying to do competitive analysis. You became toxic the moment you took it upon yourself to do this without any kind of protection in place.

Setting aside the data access issues, at a bare minimum your employer couldn't any longer guarantee that code you wrote wouldn't just get them sued.

    The mock I used specified a card ID… the app then requested the number for that.

    Something that I, logged in as a user without any credit cards, should be denied access to. But… There it was. And… in plaintext.

    Having worked on some projects regarding credit cards and such I first thought they were running some kind of test environment on production, as this was a pilot that only employees (of a small team of them) should have access to.

    “Maybe it’s even a static file being served on this route”. Couldn’t help myself but do one more request changing the ID. Brought another card number and name.

After seeing the plaintext data in step one is where you could have plausibly stopped and maintained some semblance of deniability. It may have still shaken out the same way but it's an easier sell. Continuing to then browse other card data will get you automatically in trouble.

Regarding the rest of your outcome, I have two reads.

Assuming you're truthful, it's entirely possible someone else noticed the exact same issue at the same time and exploited this maliciously and it's going to be incredibly difficult for you to convince people it wasn't you, given you already have the track record of doing this same thing.

Assuming you're being deceitful here, there's a few warning signs along the path of the story.

Firstly, you write from the perspective of someone who believes themselves to be superior to the developers of the app you exploited. On the one hand, given what you found, I kind of get it, some of that seems like pretty basic security failings. On the other hand, in my experience this is what people who turn out to be guilty of the thing they're being charged/sued over tend to do as a way of explaining things.

Secondly, that you are communicating this at all suggests you're trying to prove you were "technically right" to do these things. Courts aren't going to care about that. Your lawyer was generally right to advise you against these things. This is now out there and will likely be used against you in a court of law.

I'm passing no judgements on whether or not it is right that you face this kind of litigation for reporting security issues; I work in security doing exactly this kind of work and the thing that often saves me is documentation, documentation, documentation. Agreements, in writing, signed by all parties, etc. Even that doesn't work sometimes.

educaysean2• 4 years ago

I can't speak for whether the OP is in violation of any laws or not. I am, however, very curious about the identity of this competitor bank. Yeah, I get why they might be suspicious of OP given his initial access, but my god that company sounds like it's being run by a bunch of incompetent hotheads. They have seem to have absolutely no idea how to investigate a security breach let alone run a finance company.

Note to OP: if things don't go your way with the lawsuit, do the society a favor and let the world know who these guys are so we can all steer clear.

worthless-trash• 4 years ago

This is the greatest fear that legal at my company has. Especially when we -share- source with a number of competitors.

godmode2019• 4 years ago

If a company has a endpoint that is not secured by a password then it's public.

You ask the server permission to access the data, just like you knock on someone's door to come inside.

If they open it up, or return you data then you can only assume they are allowing you access.

When you start guessing passwords or reusing tokens or trying to access something with a different token, that's a bit different.

Lock your door if you want to keep the things inside safe.

seebs• 4 years ago

Remember, crime is just surprise pentesting with an ad hoc payment model.

But also remember, surprise pentesting with an ad hoc payment model is crime.

molsongolden• 4 years ago

Surprised to see so much “that’s what happens when you poke around” in this thread after we just had the jvns guide to dumping undocumented APIs on the front page this week without any “breach of CFAA” comments.

hda22• 4 years ago

Seeing that we as a society haven't fixed this problem yet tells me that we deserve the countless security breaches we get. I will continue to let any vulnerability I discover go unreported until the government grants immunity to those who report them.

I want to help others, but not at the risk of destroying my life.

borski13• 4 years ago

Please report them; they're helpful. But there's a huge difference between finding a vulnerability, stopping, and reporting it, and finding one and continuing to dig.

If you report it immediately, often you'll even get asked to dig further; but doing it on your own without authorization is the problem.

hda22• 4 years ago

People got into trouble for reporting issues without any further digging. I'm not stupid enough to take the risk. Want good samaritans? Fix your laws first.

pengaru• 4 years ago

This guy is not very bright.

smokey_circles• 4 years ago

Useful reminder for the armchair lawyering: the only person's who's opinion of the law carries any weight is a judge. Lawyers make arguments to sway that opinion.

The opinion as fact stating here is incredible. The law is the law because that's what the law says it is. This was a stupid thing to do. There's just no arguing that.

ThePowerOfFuet• 4 years ago

TFA seems to be gone now, but here's a mirror: https://web.archive.org/web/20220317003600/https://accidhack...

commandlinefan• 4 years ago

Was this post taken down? I get a generic “coming soon” page when I click through it.

I found a security issue on a competitor, got fired and served a summons

Related Stories