I know several people who were in a situation like this.
Let's say, you were trying out random sites for basic XSS/SQL Injection vulnerabilities, and you've found one that could be easily compromised. You email the admin/webmaster, but they don't reply.
What would you do?
Ignore it to avoid getting into legal trouble and avoid any products of that company on the ground of lack of care and professionalism would be one choice,
Posting it into TheDailyWTF Sidebar could also come to mind, but in todays world, that may cause legal backlash or at least annoyance.
If it is a standalone website and not a product people can purchase/use then you've done all you can do. If it was a product or community website there are a few mailing lists you can submit a writeup to such as Bugtraq.
Unless these companies were paying you to do it, I'd say you're already across the line. Why exactly would one be doing this?
It depends, what is the nature of the site? If the sites customers are exposed to Identity Theft or similar horrific things, it is your duty to report the issue to outside authorities. The question is, how?
I would suggest contacting The Consumerist and demonstrating your exploit to them. They will bring enough media attention to the issue that the company will be forced to do something about it.
If on the other hand, it's a silly web forum for turtle lovers... well, if they don't care, move on to bigger and better things.
Sit on it.
I've been on the receiving end of such emails, and while we didn't reply to the original author, it did make us (the devs) and the management sit up be a bit more security aware, and the stuff did get fixed.
If not, what else can you do? Stay out of it... Someone will hack the site one day and maybe they'll start to care, but they won't be pointing the finger at you.
This one is easy:
And if you're doing it now:
You may find your helpfulness being repaid by facing criminal charges.
(sorry to shout, but even someone with the purest of motives can get caught up in lot of grief that might take months or years to unravel. I used to track down systems crackers at my old job, and once we determined an IP address/phone number/physical address we turned it over to the police to sort out.)
I would not assume that a lack of a response meant that no action was being taken. If I was on the receiving end of that email, I would have two concerns. The obvious one is identifying and fixing the vulnerability in the code. The other concern is who is this guy and why is he trying to crack my site?
Would you walk down your street and try every door knob to verify that everyone had locked their door? Someone just trying random sites for security holes sounds suspicious just by the nature of his actions.
The last thing I would do would be to email him back. That would just encourage more cracking attempts. I don't know if I would turn over the email and IP address to the police. I think it would depend on the content of the email and what information I could find out about the sender. If the person who sent the email was a security specialist who had found out about a vulnerability by testing or by hearing about from someone else, I would reply back. The Sears security breach that Ben Edelman contacted Sears about is a good example of when acknowledgment should be sent.
Now if you had come across a vulnerability by normal usage of the site, then I think an acknowledgment of your email would be a common courtesy.
You also have to consider the severity of the vulnerability and how long it would take to fix it. If a consumer's privacy is being violated, it should be addressed immediately. If it's not a critical problem, the company will need to schedule time to investigate and address the issue.
If the problem was a serious breach of privacy and immediate action wasn't taken, I would go up the chain of command at that company. If it's a serious issue and you can communicate that effectively, someone at some level will take notice. If that fails, I would take it a consumer advocate group like the Consumerist or a well known security expert like Ben Edelman.
Make sure you keep a record of your e-mail message(s). You might need it in court.
Not withstanding what's said above regarding your culpability in hi-lighting the exploit, but...
If the site is a commercial company, and if they have an online payment system (credit cards orders) then try emailing either the sales department or the "contact us" email address with your concerns. This should elicit at least some response (if clueless) from the organisation that you can build on.
If you still get no answer, then contacting the relevant consumer protection agency or their trade association. Ultimately, you can also contact a "white hat" security site (Secunica?) if you feel that the customer data is being put at risk.
I usually look for a way to contact developers or QA personnel and tell them instead. This is easier done when you're active in the developer community.
Sometimes admins/webmasters/whatever are actually helpdesk/marketing people who have little or no understanding of the vulnerability, or are otherwise loaded with so much work that they don't realize the gravity of such bugs.
If the website/product was developed on-top of a specific third party framework or library which may be at fault, I would report it to the third party, eg: Microsoft. If it's a bank, or a government website/applicaiton, there may be an appropriate government agency other than that which is hosting the application/site that you can report it to, eg: US-CERT.
Otherwise, finding a vulnerability in a framework/library I would report it to:
Your duty if the organization hosting the application fails to respond is to warn vulnerable users as best you can, and sharing the security risk and or implementations to exploit it only to the hosting organization, and reputable security researchers.
I once found myself in a similar situation. I emailed the company behind the site about the vulnerability, but got no response for several days. A few hours after going public (on my blog and forum) without disclosing the nature of the vulnerability it got fixed. The company went on to deny anything had ever went wrong.
Was it worth it? I'm certain it was, especially given the nature of the service that site has been providing (chances are you're a user).
First off, I would notify them anonymously. Many people don't take criticism well, especially when it comes to security.
Secondly, I would ask myself how crucial the security issue is. If it's some random website, don't worry about it. Just let them be. They will either discover and fix the problem themselves, be exploited, or live in blissful ignorance of the situation. For most sites, it's not a big deal, and if they do get their database dropped they can always restore from a backup.
If it's your bank on the other hand, they have a responsibility to you as a customer, and you have every right to openly confront them about the issue. Just be polite and ask to be notified on how they plan to deal with it. Don't threaten to disclose the vulnerability; that will only piss them off. If they don't respond, contact the Better Business Bureau or the appropriate regulatory agency.
Why would you be
trying out random sites for basic XSS/SQL Injection vulnerabilities
in the first place?