Spectre557 wrote:You got your admin access. So why go opening (and obviously reading) private financial documents after you've already identified the vulnerability?
Great point that I thought to come back and mention. You beat me to it.
This assumes, of course, that the OP even hacked it legitimately via penetration testing (I'd like to know the steps involved; specifics aren't necessary if they become unique or potentially give up the client's identity somehow).
If the Op is right and people are being cheated out of money I don't see how the moral high ground is ignoring it.
I didn't claim the moral high-ground; I very rarely do. What you're talking about though is backstabbing a naive individual who was ignorant enough to entrust valuable assets to this slimy little toad who's now basically trying to flip them.
A few more questions for the OP: what was the fraudulently-allocated money spent on? A yacht? A disease-stricken child's medical expenses? And on what authority were you to determine what expenses are and are not acceptable for an organization you don't intimately know?
What's the annual income of said charity? What percentage of such was misappropriated?
Is said charity BBB accredited?
Per Spectre's comment, after exploiting vulnerabilities which resulted in administrator-level access, why did you take the extra step of combing through specific documents?
What were the terms of the penetration testing agreement? Did you sign a NDA?
-- Mon Sep 06, 2010 2:34 am --
And just so we're clear, this forum isn't even clear on whether or not money was misappropriated. What we do have for sure is someone who of his own admission is in violation of any even semi-coherent penetration testing agreement, most often replete with a NDA.
Noone can say for sure what expenses aren't legitimate, because the OP didn't volunteer that information. We don't know on what basis he concluded they were illegitimate!
Some people who commented shouldn't be so brazen to say at this point that he should disclose anything. It's by no means a sure thing he's even competent to decide what is and isn't acceptable.
Any forensic accountants available for comment?
"I'm going to get into your sister. I'm going to get my hands on your daughter."