Over the years I've gained a large amount of experience in Programming (my main occupation) and server admin, and as a result have a fairly decent backing in security practices. I'm also pretty good at spotting security flaws in software (including but not limited to SQLi), and have built up a list of sites that could definately use some looking at.

My question is, what are the legalities of me contacting these sites saying something along the lines of "I've looked at your site and it appears vulnerable - customer data could be compromoised - would you like me to fix it?". Could me finding out that the site is infact vulnerable be construed as an attack itself? If the prospective client so wished, could they take me to court over this?

When I find a vulnerable site, all I do is confirm and make a note of the vulnerability. I'm not in it for personal gain (getting paid for FIXING it would be nice!), just curiosity. Is this a viable way to go about finding clients for this kind of work, or would you recommend a more 'legitimate' way?

Any suggestions/advice would be greatly appreciated :)

closed as off topic by Ward, Iain, MadHatter, Chopper3 Sep 19 '11 at 8:54

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

  • i would hope they took a positive attitude as at the end of the day, a hacker wouldnt tell them about the issue they would just exploit it doing them more damage – anthonysomerset Sep 19 '11 at 8:01
  • 1
    Migrate this on over to security.stackexchange.com - it fits in well with a number of discussions over there. – Rory Alsop Sep 19 '11 at 8:38
  • In fact this one may be a dupe: security.stackexchange.com/q/4165/485 – Rory Alsop Sep 19 '11 at 9:42
  • That other one was not me, but yeah, the question is pretty similar. – Seidr Sep 20 '11 at 13:15

I would never hire you, working for a mid-size enterprise people contact me all the time to offer services and sell kit. Security scanning, software license management, hardware, managed network services etc etc. But I never use a company that cold call me out of the blue and try to get a foot in the door. It's simply a practice I'd advice against.

However I would take your email seriously and would contact a security contractor of my own choosing to have a look and see if they can find a problem.

Even if you said it was "for personal gain" I would suspect you'd either try to get contracting days or something else was not right. I by no means question your skills, just the practice comes of as very dubious.

I'd even suspect some companies would send your email to legal and either try to sue you or possibly even put a gag order on the vulnerability you have found to stop you sharing the information with anyone else.

Bottom line, don't do it.

  • Indeed. Reporting security bugs and not expecting anything in return has caused me enough trouble to strongly advise against trying to sell yourself in the process. It's too easy to perceive as blackmail or a threat, no matter what phrasing you use. Maybe if you contact a very technical person first, they'll just thank you and fix it, but many sort of managers will invoke Legal or the police. – Alex Holst Sep 19 '11 at 8:36
  • Thanks, I agree with your point of view. Cold-callers at my company are very rarely (if ever) dealt with - why would someone that provides something close to a threat (your site is vulnerable, you need to fix it, hire me) be given any more attention? I'll look into notifying the sites regarding the vulnerabilities, but will not offer my services. – Seidr Sep 19 '11 at 8:48
  • Agree with this answer almost verbatim. I'll look into the reported issue and open a bug report if needed, and the original email will get tossed. Never start a biz relationship based on a cold-call/email - I get several of these each day, all playing the same few angles, 99% of which are obviously irrelevant. – gharper Sep 21 '11 at 4:05

From doing this professionally for over 15 years, I would say - be very careful! Even if you have a contract in place before looking at the application, some companies are still quite litigious. The legalese I need in place before I touch an app is an annoying but necessary requirement.

If your identification of the vulnerability is through entirely passive activities, ie before trying 'confirmation' then you may be in a relatively safe place from a legal standpoint (however I am not a lawyer).

The more mature organisations do have reporting contacts where you can notify of issues, and some even offer a bounty (eg Google, Facebook etc) but the majority are nowhere near this level.

If you have taken any active steps to confirm a vulnerability then from a target's perspective you look just like a real attacker and they are likely to be well within their rights to use law enforcement and the courts to prevent you doing anything further.

From the perspective of gaining new work, it would also put you in a bad place with enterprise level organisations. You are likely to end up on their black list through not going through usual contractual and procurement procedures.

Not the answer you're looking for? Browse other questions tagged or ask your own question.