3

Let's assume that I have a found a bug in a company's website/software which – if exploited – bypasses their paywall and allows me to use their website/software without any payments.

I then inform the company about what this bug is capable of (when exploited), and ask them for money in exchange for the information on where the bug is and how I could exploit it. Can the company take legal action against me?

| improve this question | |
5

Is it illegal to ask a company for money in exchange for information on a bug in their software/website?

That in itself is legal. Indeed, the company would incur unjust enrichment if it coerced you to disclose your discovery for free.

Only if you threatened the company to divulge to others your discovery unless the company pays you, it would be illegal and trigger charges such as extortion (likewise, legislations outlaw the unjustified delivery of programs or instructions for hacking a software/network/etc., although this goes beyond your actual question).

Can the company take legal action against me?

That seems doubtful, futile, and it could backfire (please note I have not done any research on legal precedents about this).

Although the terms and conditions of the website or the End User License Agreement (EULA) of software might prohibit you to reverse engineer (RE)/decompile/etc. the application, anti-RE clauses are unenforceable and the remedies therefor are indeterminate because the sole act of conducting reverse engineering does not subject the company (or third parties) to any losses.

The company's decision to take legal action for your discovery could backfire from two standpoints. First, it calls attention to the fact that the software at issue is defective and unsafe. And second, the bug is likely to be detected by someone else anyway, thereby potentially compromising customers' systems.

| improve this answer | |
  • 2
    Thanks a lot! This situation is actually real and I was scared to ask them for money at first. I haven't threatened them and will not release any info to the public if my request isn't fulfilled. I just hope that they don't take this as extortion. I'm just a broke kid who just graduated high school. – Frixoe Mar 28 '19 at 12:52
  • 2
    @Frixoe Your approach as you describe it cannot be reasonably taken as "extortion". Companies typically hire IT security professionals hoping these will be competent and make the system(s) safer. Here the difference is that you already did that job successfully, which shows greater productivity than some hired employee who might never find that bug. – Iñaki Viggers Mar 28 '19 at 13:06
  • 1
    A interesting question would be: what if he "threatened" to sell it to a company like Zerodium instead? Zerodium will in turn sell it to unknown customers, also to government agencies. Can that be a threat or be seen as extortion, since Zerodium seems to be a legitimate company even though its practices are often seen as unethical? – reed Mar 29 '19 at 19:19
  • 1
    @reed That is risky because it might still amount to the OP conveying to the software proprietor that the vulnerability will be disclosed elsewhere if the proprietor refuses to pay the OP. But transacting with a company in the legitimate business of IT security is fine because the OP's judicious and prudent disclosure disproves both an intent to defraud (see MCL 750.450c(1)) and the "unlawfulness" of access (MCL 750.450c(3)) that the written instructions therefor would enable. – Iñaki Viggers Mar 30 '19 at 0:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.