There should be strong protections for security researchers, and anyone reporting a security flaw should receive the benefit of the doubt. To the extend we fail to do this we are sacrificing national security in exchange for the convenience of companies.
Is your statement a justification for punishing this researcher or sarcasm of the situation? Hard for me to infer.
If the former, then it’s only a matter of time where you are so confused as to why/how your entire nations infrastructure gets completely borked because there was a proliferation of such juvenile vulnerabilities that were illegal to be disclosed to the appropriate authorities.
This researcher deserves better. They tried to make society more safe and were punished :(
One angle is missing in this article: the judge stated that the intention by the lawmaker was to criminalize any kind of hacking when they have introduced the law, so it doesn’t matter how strong the password was or how good it was protected.
Frustratingly, the judge is absolutely right. That was precisely the intention behind the law change back then. I just hope the law will be changed by the government, which (despite all their quarrels) is a much saner one than the one which changed that law.
From the articles I read on this in German and this one it seems to me that there is an easy to miss point: the consultant didn't have any authorization from Modern Solutions to conduct a pentest, he was working for a Modern Solutions customer. When he discovered the hard-coded password, he should have stopped there and reported it.
12 comments
[ 3.2 ms ] story [ 49.1 ms ] threadLook, everything works as expected. The law worked, police stopped the perpetrator, the hack has been prevented, customer data is now safe.
If the former, then it’s only a matter of time where you are so confused as to why/how your entire nations infrastructure gets completely borked because there was a proliferation of such juvenile vulnerabilities that were illegal to be disclosed to the appropriate authorities.
This researcher deserves better. They tried to make society more safe and were punished :(
Frustratingly, the judge is absolutely right. That was precisely the intention behind the law change back then. I just hope the law will be changed by the government, which (despite all their quarrels) is a much saner one than the one which changed that law.