1

Background: I remember when I was still in college here in the Philippines, one of the member of the school thesis committee tries to hack my system by injecting some kind of code (I am not sure but I think this is SQL injection). Now that I am working I realized that it is illegal to just hack and get inside of the system. This hacking includes breaking into the security of the system then extracting the datas (some are dummies only and some are original). He said that he do this to prove that our system has not enough security and therefore concluded that it is not safe to use, due to this my team has been subjected to re-defense. Also, there are no proper discussions whether he has the authority to get inside the system, I also don't know the privileges of the panelist.

Please take note that the computer we are using is ours (students) then the panelist are obliged to test the system for certain minutes only (maybe 5 minutes). Also, we didn't use any ISP because it is only a system together with it's database and therefore can be use offline.

During that time we've been subjected to re-defense simply because our system is not secured.

Question: Does hacking the system just to prove that it lacks security and therefore not safe to use, still ethical? Considering that we are on a thesis-defense and are still a learner. Our knowledge cannot be compared to a professional that is expert in system developing.

  • 1
    @david: Agreed. We are not lawyers and cannot advise you on legal questions. If you ask whether this is ethical, that would be on topic. – Nate Eldredge Sep 15 '14 at 11:54
  • 5
    This question appears to be off-topic because it is about law. – Nate Eldredge Sep 15 '14 at 11:55
  • Reopening, since OP edited per Nate's suggestion. – ff524 Sep 17 '14 at 6:05
  • Update as of September 17, 2014 - I chose Nahkki's answer because of the following reason: 1. It specifically tells something about the policies of software testing which I find helpful when answering questions like this. 2. The approach is for student and inside the academy. – Cary Bondoc Sep 17 '14 at 6:21
10

Rather than discussing whether or not this is legal(which, as has been pointed out, is beyond the scope of the Academia board and would depend on your local laws) let's discuss whether it was right or expected or not.

As mentioned by Nicholas, this, to some extent, depends on what you actually did. And, as I see it, this can be broken down into two categories.

If your work involved a database that is not manipulated by outsiders at any point then attempting to 'hack' it would be inappropriate. By this I mean if the database was secondary to the research you were presenting. An example might be a database of Face images used to train or test facial recognition algorithms. In such a case the database iteself is not the product or research being presented. It should be stable and reasonably secure(depending on the data it contains of course) but should not be the focus of 'testing' or inquiry in a defense.

However if your work involved a database that is manipulated by the user or researcher, particularly as a primary focus of the research/work then yes, 'hacking' this database is a reasonable thing for someone to try to do. If the work presented is a complete project, a proposed solution to a real world problem or in another situation where, yes, you are proposing that the system you created could be placed in the real world then attempting to 'hack' the system is not only reasonable but expected.

Let's take a moment, though, to discuss what 'hack' might mean in this situation. You mentioned a SQL Injection. For some folks 'hacking' brings to mind serious people wearing sunglasses indoors yelling "Hack the MAINFRAME!" as they use telephones, bits of wire and evil to do nasty things to computers. But, especially in this particular case, this 'hacking' would have been something as innocent as entering something into a data field. In the early days of speed cameras some clever motorists found a way to do such an attack. The cameras 'read' the license plates and automatically submitted speeding tickets. Clever if unethical motorists could put a sql string on their bumper, the camera would 'read' the string and, since the string wasn't properly sanitized, it would cause nasty things like deleting the entire database. SQL Injections are something that you should not be confused about what there are at graduation, that you are both unsure if that's what the instructor did AND indignant that they would do so would be a signal to me that you did need to re-defend your thesis. SQL (or just plain code) injection attacks are almost laughably easy to minimize, someone being able to 'hack' your database in the few minutes you described is a serious quality concern for a graduate in computer science perhaps especially in graduate level work(you are unclear about your level at the time of this issue).

Finally allow me to point out that all respectable software companies hire people whose job it is to attempt to hack into their own servers, software and, yes, databases. Additionally white hat hackers often attempt to hack software and environments and report it to said companies(black hat hackers will skip the reporting and go straight to exploiting.) No one wants to hear that their baby is ugly or that their code has a problem. I'm hearing a lot of indignation in your question related to that and I understand it but I'm going to respectfully advise you to both get over it and welcome such things - that is how you will become better at development.

  • 1
    I'm not sure that image you saw on Google with the car having the SQL string on the plates is something that actually worked:p – Nik Kyriakides May 10 '15 at 15:16
  • It seems totally proper to me to ask for a re-defense on the basis that you did not secure your data properly. Members of the committee would be held responsible for the safety of the data, if you were in a place where law applied. So the only person committing illegalities here would be you, OP. Please examine your situation, inject a little humility into your attitude, and realize that you're actually lucky that someone cared enough to examine the whole of your work before you caused real harm – user104070 Apr 3 at 21:04
26

It sounds like as part of the defense, you gave the examiners access to the system for purposes of evaluating it.

If you gave consent for them to evaluate the system, and didn't place any restrictions on what they can do with it, I don't see any problem with what they did.

You are correct that is generally illegal to just "hack" into a system, but that refers to gaining unauthorized access to a system. That doesn't seem to be what happened here.

4

It depends on whether it is a reasonable expectation that your evaluators would test your work in this way. You don't give the details of what you have created, so it is hard to assess whether the assessor's actions were reasonable.

If you had created a database with an interface that could be accessible publicly, and that the majority of your work was on the creation and/or operation of that interface, then I think that security issues are indeed important, and an acid test of your work would be to attempt to hack in.

However, if the majority of your work was on looking at the inter-relationships between elements of the database - i.e. you were looking for correlations between database parameters - and not on the interface, then I don't think that the security of your system warrants a hacking attempt to test its security. In this case, a lack of security is indeed a concern, and one which you might have to address in a defence, but not one which justifies an attack on the system to test it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.