He may of been driven by good morals, but his ethics stink! That is why he is being punished. Once he found out the exploit(s) existed, he should of stopped there, and then approach the school for further pen-testing. Whitehats have to deal with the fact that they might be told NO. Better than going to jail and getting kicked out of school and having a dirty little record for the rest of your life. In IT security, it's much better to ask for permission, rather than asking for forgivness. It's not like this is the first case of a college kid getting in trouble for not asking permission to hack. By no means does it scare me off to be a whitehat just because some stupid kid doesn't understand the processes... I know the laws and I recommend that any whitehat know them so you can keep your butt out of the fire.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/newsbriefs/829/2654#2654