Slashdot Mirror
HS Students Steal SSNs to Prove They Can
thatshortkid writes "Local news in Chicago is reporting about two Hinsdale Central High School students who breached their school's computer system and retrieved all of their peers' (plus staff's) Social Security Numbers. They claim they have destroyed the information and haven't given it out, but the SSA and FTC have been alerted for good measure. While they claim their motive was to prove that the breach could take place and no malice was involved, they face possible school disciplinary action and criminal charges."
From the article, it appears they didn't reveal the security flaws, they got caught. Besides, breaking into systems without permission just to show they are insecure isn't necessary. I've never had anybody who I reported a security problem to just pooh-pooh it, not even when I was a teenager.
What you do then is offer to make a bet. Offer him something nice and juicy, and get it in writing. Never do security testing without written permission.
I would think that people would have learned from the example of Randall Schwartz. You especially don't want to do it with someone who would be publically embarrassed by it because you're at high risk that they will file charges.