So I have a small web app I made. I didn’t really advertise much because there’s a lot of things I wanna fix in it and I don’t have the time. But I did tell a few classmates about it.
Last few days I noticed it had been running slowly. Until one day it just stopped working. I checked the server logs and there was a background worker trying and failing to insert some data into the db on loop because of a bug I didn’t notice. The data it was trying to insert was spam so I knew this was an intentional thing. I took the server down and in the process accidentally deleted all the logs. Oops.
So I go and check the database and the user who inserted the spam data used their actual email. I google it, find their GitHub, their twitter, and their fiverr which has their actual name and picture. I search their name in my university system and find them. It’s someone I don’t know. Someone who heard from a classmate I told about it.
Fixed the bug now, banned the account, removed the spam. I guess you could say they did me a favor catching the bug but they could’ve just told me about it lol.
The only question left is: should I contact them? Send them a subtle 'I know what you did" message on the uni portal?
Sign them up for spam emails.
Fight fire with fire.
Sign them up for an email bomb
I’d personally suggest sending an email to one of your profs about noticing potentially malicious network activity that originated from a fellow uni student with your attached proof.
In that same email you could ask them what’s the proper procedure for the circumstance you’re in.
I feel like this is the best option.
OP shouldn’t even TRY to take matters into their own hands.
Document rigorously and then send all documentation to the designated people.
Then document who you sent it to and hold onto backups
so that if they try to turn it around on you, you can dump all their dirty laundry out into the openWhat are you doing here with your thoughtful and well-reasoned replies? This is the internet, we’ll have none of that kind of thing around here! Just because this is absolutely the right course of action doesn’t mean you can be promoting this kind of calm and unsensational behaviour!
The logs were deleted, sounds like there isn’t any proof left.
There is. The db entries are still there, linked to their username and email. I’m not gonna report it obviously. That’d be silly
The db entries are still there, linked to their username and email.
But can you prove those db entries were created by that user?
I’m not gonna report it obviously. That’d be silly
Why would it be silly? Someone attacked your website. Even penetration testers with benign intentions can’t do that without an explicit consent from the owner.
But can you prove those db entries were created by that user?
Good point. The db entries are linked to the user, but I guess one could argue that was changed after the fact. The db logs are still around but that might not be enough.
Why would it be silly?
I don’t know. I just feel like it would be an overreaction. Especially since they technically exploited a bug in my own code.
This person was being an asshole. Let’s be clear. They didn’t inform you of a bug they found. Instead they just wanted to destroy what you made for the fun of it. Let them face some reprecussions for once. At least it’ll teach them to cover their tracks better.
Especially since they technically exploited a bug in my own code.
Yeah that’s called an intrusion, hackers do that and it’s illegal. If you accidentaly leave you house door unlocked is it your fault if someone trashes your house?
Report them, no damage was done and it’s a relatively minor thing so I wouldn’t expect grave consequences, but maybe this person will be more more responsible in the future.
Bring your evidence to the CS Professor. See what they think.
Yeah generally it’s in bad form to mess with other people’s projects without their permission at university. CS Professor probably won’t be impressed.
a) The logs were deleted, so there isn’t much evidence left. b) We don’t even know if this is a university project and not just a side project.
It’s not a university project. I’m obviously not gonna report it to anyone.
The logs were deleted but the database entries remain, tied to their username and confirmed email.
Even if the project wasn’t for university, it’s still yours. And the other student probably broke your schools code of conduct by doing what they did. You should still inform if not the dean of the program, then at least your professor. What’s to say this person isn’t also going around and fucking with other people’s projects?
Might be able to recover the logs with
testdisk. The email and other info might be enough. If you do get your logs back might impress the CS Prof. Shows willingness to figure shit out when things go wrong.To me, what they did shows intent to commit a crime if not the crime itself. Possibly legal offences likely wont be taken lightly.
If your gonna hack shit it better be your own in a lab or have consent from the party involved
How can you determine that someone didn’t use their info as subterfuge? It sounds like most people could find that information and use it. You’ll need a little more evidence.
Personally, I’d ask them if they want to pen test my next application and see how they respond.
What do you mean? If their email is confirmed, then I assume only they have access to it. Is there something I’m missing?
Perhaps it’s something that I’m missing. What do you mean when you say their email is confirmed?
Usually when this happens, it’s a result of someone taking advantage of an application vulnerability, e.g. sql injection. Sometimes it’s more serious, like a script uploaded and a privilege escalation to execute it. The email value written to your database could be anything.
Not to condescend, but this is a good learning experience. If they were able to write to your db, they could likely also read from it, dump the whole thing and harvest the data.
They did not gain access to the db. They just inserted some garbage data that due to a bug in my code caused a background worker to try to insert some invalid data to the db and fail on loop, hogging network resources until eventually the main server couldn’t serve anymore.
When I say their email is confirmed, I mean the email they used to sign up is presumably one they have access to because they clicked on the confirmation link with a token sent to their email. The data they inserted is tied to that account with a foreign key.
No SQL injection or anything like that was done. It was more them triggering a bug more than anything. But it’s still clearly intentional because the data they inserted is spam about forex trading with no spaces (which is what caused the error, long story). My code is open source so presumably they knew that would happen.
Agreed. Mostly because there’s a risk that individual will continue down the offensive security route without guidance and end up a blackhat.
This is what annoys me. I had a Minecraft server and people asked if it was okay if they did a bit of glitch hunting. I said it was fine as long as they told me about it, especially if they accidentally caused damage. They did not, and caused critical systems in the server to break.
Just ask him why he did it and how he found out about it and that he should just notify you instead of exploiting the bug.
Anyone could have used that email to insert spam. Unless you use confirmation emails?
Well, if you don’t, you have nothing. If you do use confirmations, then just tell the police.
If you do use confirmations, then just tell the police.
What is the police going to do?
I do.
Do You have the usual friend that loves punching people? You know… Great friend but drinks and is always getting into bar fights?
the usual friend that loves punching people
Very fucking usual
Do you have friends like that?
deleted by creator
I’m a young and social man, and I have met people that get into fights. I typically don’t hang out with people constantly getting into shit; it’s too much drama.
Removed by mod
It’s a hobby project. I’m an amateur dev I know. I’m not even mad at them, they helped me catch a bug. Cool ur tits
FYI, the comment got removed
Bugs happen, but that person was exploiting them maliciously.
