Ethical Hacker Guidelines:

Automated vulnerability scanners may not be used.

Information found on potentially vulnerable systems/networks may never be deleted or modified. Information may be added if it is necessary to demonstrate a vulnerability, but added information should be easily identifiable as bogus.

Unless you are reasonably sure what side effects an action might cause, don't do it.

Potential security problems should be reported as soon as you are convinced they exist.

When contacting system owners/operators, use your real name and a valid method to contact you (e.g. email address).

If asked, answer all questions from the system owner/operators about the vulnerability, how you discovered it, and how to secure it (if known.) However, you do not need to educate the clueless, provide follow-up testing, or reveal any other information about yourself.

If asked, do not reveal the vulnerability to any third party, even after it has been fixed.

Never accept money, goods or services, job offers, french fries, or *anything of value* from affected system owner/operators in return for your actions.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/70/11498#11498