Post #4369753

Unfortunately, there is no happy end to this story. Reminder: a consultant was hired to figure out an issue with an application made by Modern Solution. He found hardcoded database credentials in the application (via the advanced hacking tool called text viewer), connected to the database and realized that it stored the data of all customers – not merely that of his employer. He reported the vulnerability to Modern Solution who decided to press hacking charges against him. The German Federal Court of Justice declined to look at the case, meaning that the previous instance’s decision stands: he is guilty. As the previous instance explained, that’s because he didn’t stop when he realized that he had access to other people’s data but decided to document the extent of the issue with screenshots. Unfortunately, finding security vulnerabilities without the vendor’s consent (meaning e.g. bug bounties or being hired explicitly) is a legal minefield. That’s why I prefer looking at stuff running locally on my device, and if I ever have to hit a server I try to avoid any deviations from requests which could occur “naturally.” It doesn’t matter how harmless your request was meant be. If you hit a bug that deletes the data of a million customers: good luck proving your innocence. You can of course claim that the vendor’s bug is to blame, but the vendor can explain how this could have never happened during regular use of the system and your unauthorized penetration test is at fault. Different countries have different rules placing the boundary between “regular use” and “hacking.” German law is rather restrictive here, and without a Federal Court ruling no improvements are coming. In fact, not even staying on your hardware is sufficient to be on the safe side, in some cases you might become liable here as well (thank you, movie industry). Either way, this means that the next time you find hardcoded credentials in an application (database, Firebase, cloud storage bucket), your choices are rather limited. You can observe how the application uses these credentials, and once you have sufficient reason to suspect that these credentials allow access to more data than your own you report this bug to the vendor. Of course without any proof the vendor will downplay the issue. If you are lucky (which is unlikely) they will at least fix it. Using the credentials yourself to “look around” now definitely constitutes “hacking” under the German law – there is a password, hence there is a protection being circumvented. So getting proof and staying on the legal side isn’t possible at the same time. In the meantime people who will abuse the vulnerability can verify it in two minutes. And enjoy the vulnerability staying around for a long time, since the vendor who built this certainly won’t fix it without a nudge from outside.