At the beginning I'd like to inform that the case refers to US law, which I am completely unfamiliar with.

Cutting to the chase, I've been recently training reverse engineering skills on lately published, closed-source application. I found that there is a serious vulnerability which allows to easily bypass serial code verification.

And now I want to report this to authors, so that they can fix it. Of course the research I've made on this application was solely in order to broaden my knowledge on reverse engineering and I was not going(and I am still not) to publish any kind of crack. I am acting in good faith intention.

So I want to know whether the authors could accuse me of breaking copyrights, etc. if they turned out to be unfriendly?



Since it's a closed-source app, what you've probably done is broken their terms of Service (TOS) agreement for use of the app. Read it; it probably says that reverse engineering is illegal and a violation of applicable laws. Depending on the country you are in, those laws may or may not apply to you.

That said, since you want to be honest and disclose the vulnerability, you can do this (bearing in mind IANAL and it's your choice):

Send an anonymous email from a new "burner" email account (and an account you don't use for anything else after that) and also preferably by using the Tor browser ( https://www.torproject.org/download/download-easy.html.en ) so your IP is hidden and inform them of the security issue and what you see as your ethical response to disclose the vulnerability and that you do not intend to publish source code or the vulnerability. And see what they say.

If they are unhappy with your reverse engineering, they will say so and may not even acknowledge the security issue; but your identity will be hidden, and you will have done your ethical duty.

If they are happy with your disclosure and your skills, they might pay you, as it is fairly common for software companies to pay bounties for security bugs. Or they may hire you.

  • Love those anon downvotes :) Apr 25 '17 at 18:35
  • 3
    Could you outline laws that could be applicable though? Breaking their TOS is not a criminal matter itself. It's a civil matter that generally leads to a company barring you from their service or pursuing damages (if applicable). I imagine the downvote was because you just kind of brush over the part that actually answers the question with vague information and then spend more time advising how they could anonymously report it, which doesn't directly answer the question.
    – animuson
    Apr 25 '17 at 19:35
  • 1
    If it's in the USA, it's simple: They can sue you for any reason, no matter how stupid. And if you approach the wrong people, they will sue you. They would be stupid, but being sued will cost you money, even if they have no legal foot to stand on.
    – gnasher729
    Apr 25 '17 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.