full-disclosure - Re: Student expelled from Montreal college after finding vulnerability that compromised security of 250, 000

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 22 Jan 2013 14:06:28 +1300
From: "Nick FitzGerald" <nick@...us-l.demon.co.uk>
To: Full-Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Student expelled from Montreal college after
	finding vulnerability that compromised security of 250, 000

Jeffrey Walton wrote:

> On Mon, Jan 21, 2013 at 5:42 PM, Philip Whitehouse <philip@...uk.com> wrote:
> > Moreover, he ran it again after reporting it to see if it was still there.
> > Essentially he's doing an unauthorised pen test having alerted them that
> > he'd done one already.
> If his personal information is in the proprietary system, I believe he
> has every right to very the security of the system.

BUT how can he "verify" (I assume that was the word you meant?") proper 
security of _his_ personal details?  He would have to test using 
someone _else's_ access credentials.  That is "unauthorized access" by 
most relevant legislation in most jurisdictions.

Alternately, he could try accessing someone else's data from his login, 
and that is equally clearly unauthorized access.

He and his colleague who originally discovered the flaw may have used 
each other's access credentials to access their own data, or used their 
own credentials to access the other's data _in agreement between 
themselves_ BUT in so doing most likely broke the terms of service of 
the system/their school/etc, _equally_ putting them afoul of most 
unauthorized access legislation.

> Is he allowed to "opt-out" of the system (probably not)? If not, he
> has a responsibility to check.

BUT he has no resposibility to check on anyone _else's_ data and no 
_authority_ to use anyone else's credentials to check on his own.

So, what "responsibility" does he really have?

It sounds like he should have left well alone once he had reported this 
to the university and the vendors.  That he did not have the sense or 
moral compass to recognize that tells us something important about him.

Regards,

Nick FitzGerald

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/