2

My university(and many others in my country - South Korea) takes course registration online. The thing is, the competition to get good classes is extreme, and it's on a first come first served basis. Good ones fill up within 1~2 seconds.
There's a javascript console exploit I have found out(for non-IT experts, this is just client side. That is, I am not "hacking" nor doing anything destructive) that allows me to register for all 7~8 classes in less than 1 second. This is basically undetectable from the school's server admin. There would be 0 problems for me using this method personally.
Now the problem is that I want to sell this method. I'm thinking about selling it like a "private hack" that isn't really an illegal hack but an exploit to 15 people for $150 each. It won't be a malware nor any form of software. It will just be some lines of code for people to put in chrome's console. This will most definitely stir up the hornet's nest, and it will probably be on the radar of my school.
Would there be a way for my university to prosecute me or penalize me for this?

1
  • 1
    "... nor any form of software. It will just be some lines of code for people to put in chrome's console." This is definitely software. poorly packaged perhaps, but software.
    – user4460
    Nov 18 '16 at 17:49
-1

I think that you are misunderstanding the definition of "hacking" under South Korean law:

According to the legal provisions of South Korea, hacking means an act that unauthorized or authorized people use to abuse their authority to break into an information network by using an information processing device such as a computer. Any person that violates this could be sentenced to less than three years' imprisonment or a fine of 30 million won or less.

The fact that your code is purely client side is irrelevant - you are abusing your authority (given by the web browser) to break into an information network - the fact that you are adding information rather than stealing it is irrelevant.

I don't know if the university can prosecute or penalize you for this but the government sure can.

4
  • But note that part you quotes says "to break into". In this case he isn't breaking into anything. If I understand correctly, he's just using automated methods to speed up the registration process, gaining an advantage over everyone else. (PS: I didn't downvote).
    – reed
    Dec 10 '18 at 19:22
  • @reed he put data in and got data out in an unauthorised way - that’s “breaking in”
    – Dale M
    Dec 10 '18 at 20:48
  • Well, I disagree. It sounds like he isn't gaining access to any protected data, he's just registering for courses using tricks to be faster. The process seems similar to cheating in a game, IMO.
    – reed
    Dec 10 '18 at 21:34
  • What he is doing is both unauthorised and and an abuse of the authority he has @reed
    – Dale M
    Dec 10 '18 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.