Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

There is this prominent US based News network which allows people to post comments and vote on the comments. While monitoring the http traffic using fiddler, I felt their ajax post had an obvious security flaw. In an attempt to check if I was correct I created an simple script that went through a loop of hundred repetitions and up voted one of my answers. To my utter surprise it worked. I cannot undo it now. I didn't cause any harm to them or do anything malicious. If they catch my IP, could I be tried for hacking?

PS:I live in the US.

share|improve this question

closed as off topic by MadHatter, Shane Madden, Michael Hampton, Chris S Feb 6 '13 at 4:37

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Fool Charm, welcome to SF! That said, questions asking for legal advice are explicitly off-topic for the site; see the FAQ, which is linked from the top of every page. Moreover, since you haven't told us where you live, or where the server is, any answer is going to be wrong - because laws vary from jurisdiction to jurisdiction. Please don't take it personally if this question gets closed. –  MadHatter Feb 6 '13 at 4:33
1  
Hacking can mean a lot of things. So sure if you decide to define it that way. As for being "tried" for hacking. Anything can happen, but I don't think they are going waste resources going after someone who fraudulently voted for themselves 100 times. Depending on the nature of the "tests" some companies can try one for interstate wire fraud, but this is pretty vanilla unless you are profiting in some way or rigging a contest of some sort. –  Joshua Enfield Feb 6 '13 at 4:34
    
You may want to visit our sister site Information Security, check out their FAQ and search for related questions. –  Michael Hampton Feb 6 '13 at 4:35
    
Be extremely careful soliciting opinions from uninformed netizens. US Federal law specific "hacking" as unauthorized use of computer resources. Technically it's up to a jury of your ---peers--- idiots to determine if what you did qualifies; but someone familiar with the subject matter would likely conclude it does qualify. To your benefit, federal enforcement agencies have absolutely no interest in pursuing someone on account of what you did. They have "real" criminals to chase and would likely berate anyone trying to report an incident like this. Make it habit and they may change their mind. –  Chris S Feb 6 '13 at 4:42
1  
Ask a lawyer, not us. –  John Gardeniers Feb 6 '13 at 8:27

1 Answer 1

up vote 0 down vote accepted

I doubt they would bother with trying you for hacking. However you have found a flaw in their system and as a result of your curiosity you accidentally made a change that should not have been possible in the first place. If it were me, I would be tempted to email them and explain what I found, show them how I did what I did and leave it with them to implement a fix.

share|improve this answer
    
+1 The vast majority of websites respond positively to reports of security problems in my experience. –  Chris S Feb 6 '13 at 4:43
    
Thank you Dave. –  Fool Charm Feb 7 '13 at 3:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.