IT consultant fined for daring to expose shoddy security

A security researcher in Germany has been fined €3,000 ($3,300, £2,600) for finding and reporting an e-commerce database vulnerability that was exposing almost 700,000 customer records.

Back in June 2021, according to our pals at Heise, an contractor identified elsewhere as Hendrik H. was troubleshooting software for a customer of IT services firm Modern Solution GmbH. He discovered that the Modern Solution code made an MySQL connection to a MariaDB database server operated by the vendor. It turned out the password to access that remote server was stored in plain text in the program file MSConnect.exe, and opening it in a simple text editor would reveal the unencrypted hardcoded credential.

With that easy-to-find password in hand, anyone could log into the remote server and access data belonging to not just that one customer of Modern Solution, but data belonging to all of the vendor's clients stored on that database server. That info is said to have included personal details of those customers' own customers. And we're told that Modern Solution's program files were available for free from the web, so truly anyone could inspect the executables in a text editor for plain-text hardcoded database passwords.

The contractor's findings were discussed in a June 23, 2021 report by Mark Steier, who writes about e-commerce. That same day Modern Solution issued a statement [PDF] – translated from German – summarizing the incident:

The statement indicates that sensitive data about Modern Solution customers was exposed: last names, first names, email addresses, telephone numbers, bank details, passwords, and conversation and call histories. But it claims that only a limited amount of data – names and addresses – about shoppers who made purchases from these retail clients was exposed.

Steier contends that's incorrect and alleged that Modern Solution downplayed the seriousness of the exposed data, which he said included extensive customer data from the online stores operated by Modern Solution's clients.

In September 2021 police in Germany seized the IT consultant's computers following a complaint from Modern Solution that claimed he could only have obtained the password through insider knowledge – he worked previously for a related firm – and the biz claimed he was a competitor.

Hendrik H. was charged with unlawful data access under Section 202a of Germany's Criminal Code, based on the rule that examining data protected by a password can be classified as a crime under the Euro nation's cybersecurity law.

In June, 2023, a Jülich District Court in western Germany sided with the IT consultant because the Modern Solution software was insufficiently protected. But the Aachen regional court directed the district court to hear the complaint. Now, the district court has reversed its initial decision. On January 17, a Jülich District Court fined Hendrik H. and directed him to pay court costs.

"The penalty order is all the more shocking because it is fundamentally wrong," wrote Steier, the blogger who helped bring the exposed database to light, in a post on Wednesday.

"A password that has been saved almost in plain text does not constitute a 'special security' which is required by §202. It's understandable that a judge can't evaluate that, but then an expert would have had to be heard on exactly this question. Unfortunately that didn't happen."

According to reports, the verdict is not yet legally binding as the two parties have a week to appeal, which the IT consultant reportedly intends to do.

In a post to Mastodon, Wladimir Palant, a security researcher, software developer, and co-founder of Germany-based ad filtering biz eyeo, expressed frustration with the court's decision.

"I very much hope that there will be a next instance ruling overturning this decision again," Palant wrote. "But it’s exactly as people feared: no matter how flawed the supposed 'protection,' its mere existence turns security research into criminal hacking under the German law. This has a chilling effect on legitimate research, allowing companies to get away with inadequate security and in the end endangering users." ®