So I have a small web app I made. I didn’t really advertise much because there’s a lot of things I wanna fix in it and I don’t have the time. But I did tell a few classmates about it.
Last few days I noticed it had been running slowly. Until one day it just stopped working. I checked the server logs and there was a background worker trying and failing to insert some data into the db on loop because of a bug I didn’t notice. The data it was trying to insert was spam so I knew this was an intentional thing. I took the server down and in the process accidentally deleted all the logs. Oops.
So I go and check the database and the user who inserted the spam data used their actual email. I google it, find their GitHub, their twitter, and their fiverr which has their actual name and picture. I search their name in my university system and find them. It’s someone I don’t know. Someone who heard from a classmate I told about it.
Fixed the bug now, banned the account, removed the spam. I guess you could say they did me a favor catching the bug but they could’ve just told me about it lol.
The only question left is: should I contact them? Send them a subtle 'I know what you did" message on the uni portal?
Perhaps it’s something that I’m missing. What do you mean when you say their email is confirmed?
Usually when this happens, it’s a result of someone taking advantage of an application vulnerability, e.g. sql injection. Sometimes it’s more serious, like a script uploaded and a privilege escalation to execute it. The email value written to your database could be anything.
Not to condescend, but this is a good learning experience. If they were able to write to your db, they could likely also read from it, dump the whole thing and harvest the data.
They did not gain access to the db. They just inserted some garbage data that due to a bug in my code caused a background worker to try to insert some invalid data to the db and fail on loop, hogging network resources until eventually the main server couldn’t serve anymore.
When I say their email is confirmed, I mean the email they used to sign up is presumably one they have access to because they clicked on the confirmation link with a token sent to their email. The data they inserted is tied to that account with a foreign key.
No SQL injection or anything like that was done. It was more them triggering a bug more than anything. But it’s still clearly intentional because the data they inserted is spam about forex trading with no spaces (which is what caused the error, long story). My code is open source so presumably they knew that would happen.
Gotcha. Then maybe it is time for them to have a conversation with the friendly network administrator. You might have lost your logs, but university network appliances usually log alot.