-2

There is this prominent US based News network which allows people to post comments and vote on the comments. While monitoring the http traffic using fiddler, I felt their ajax post had an obvious security flaw. In an attempt to check if I was correct I created an simple script that went through a loop of hundred repetitions and up voted one of my answers. To my utter surprise it worked. I cannot undo it now. I didn't cause any harm to them or do anything malicious. If they catch my IP, could I be tried for hacking?

PS:I live in the US.

6
  • Fool Charm, welcome to SF! That said, questions asking for legal advice are explicitly off-topic for the site; see the FAQ, which is linked from the top of every page. Moreover, since you haven't told us where you live, or where the server is, any answer is going to be wrong - because laws vary from jurisdiction to jurisdiction. Please don't take it personally if this question gets closed.
    – MadHatter
    Feb 6, 2013 at 4:33
  • 1
    Hacking can mean a lot of things. So sure if you decide to define it that way. As for being "tried" for hacking. Anything can happen, but I don't think they are going waste resources going after someone who fraudulently voted for themselves 100 times. Depending on the nature of the "tests" some companies can try one for interstate wire fraud, but this is pretty vanilla unless you are profiting in some way or rigging a contest of some sort. Feb 6, 2013 at 4:34
  • You may want to visit our sister site Information Security, check out their FAQ and search for related questions. Feb 6, 2013 at 4:35
  • Be extremely careful soliciting opinions from uninformed netizens. US Federal law specific "hacking" as unauthorized use of computer resources. Technically it's up to a jury of your ---peers--- idiots to determine if what you did qualifies; but someone familiar with the subject matter would likely conclude it does qualify. To your benefit, federal enforcement agencies have absolutely no interest in pursuing someone on account of what you did. They have "real" criminals to chase and would likely berate anyone trying to report an incident like this. Make it habit and they may change their mind.
    – Chris S
    Feb 6, 2013 at 4:42
  • 1
    Ask a lawyer, not us. Feb 6, 2013 at 8:27

1 Answer 1

0

I doubt they would bother with trying you for hacking. However you have found a flaw in their system and as a result of your curiosity you accidentally made a change that should not have been possible in the first place. If it were me, I would be tempted to email them and explain what I found, show them how I did what I did and leave it with them to implement a fix.

1
  • +1 The vast majority of websites respond positively to reports of security problems in my experience.
    – Chris S
    Feb 6, 2013 at 4:43

Not the answer you're looking for? Browse other questions tagged .