I agree with triznut. He should have got permission first. This reminds me of the "COPS" episode where this lady approaches a police officer and says "I just bought this crack (cocaine) from that house right there. Now go arrest them. Guess who got arrested? She did. Ethical person, ethical intentions, but wrong approach. I support ethical hacking and give props to this guy for trying to help. However, once he found a loophole instead of probing further he could have stopped and tried to make the administration aware at that point. The university is probably trying to protect itself from lawsuits in case ID theft pops up on those entities that were compromised. And of course, no one enjoys being proven inadequate.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/newsbriefs/819/2616#2616