The Tsunami “Hacker” Story
By Daniel Miessler on October 12th, 2005: Tagged as General | Philosophy
As many of you know, there is currently a story about a security consultant by the name of Daniel Cuthbert who’s been convicted of illegally accessing a Tsunami relief web page after making a donation.
There are widely varying views on this, but let’s first lay down the facts as we know them. First of all, he tried accessing the system directories on the web server. Secondly, and most importantly, he tried to get the database to cough by doing some SQL injection.
Here’s the thing: at the very least the guy should be convicted of abject stupidity. He may not have had any intentions of doing anything malicious, but as a security consultant he should have known better than to throw single quotes into URLs without permission. This is day 1 security consultant stuff.
His story evidently is that he didn’t get a confirmation email back after making a donation, and that after becoming suspicious he decided to check into it. The problem with that is that he wasn’t paid to audit their security. (Insert analogy about open doors on in a residential neighborhood) He should have known better — plain and simple.
What this guy does not deserve, however, is to have his name ruined. He made a bad choice, but it’s not the sort of thing that should end a career. Give him a fine, a healthy dose of embarrassment, and put an end to it. What he did wasn’t immoral, it was just stupid. Give the guy a break.
