Reflection --- Discovering vulnerabilities is absolutely legal practice that ICT personnel does daily (in order to find & fix software bugs) on software they work on. Sometimes even "outsiders" seek for vulnerabilities and report them to the vendors (for money or not) or to cyber security firms....or they can even offer them on the market (ethically questionable). However, I believe seeking and discovering vulnerabilities can be seen (and is probably seen as such by persons who do that) as a form of intellectual activity as any other form of intellectual activity that can be offered to the market (consulting for instance). Nobody blames doctors that discover patients' organ vulnerabilities daily. I'm not sure if discovering a vulnerability interferes in any way with intellectual property rights, but it may be completely legal. The problem is that they have dual use...one use - to patch the vulnerability and improve the code...the other - to exploit it for other goals. It is the one who exploits the vulnerability to be blamed, not so much the one who discovered it.

Source author: Vladimir Nikolov vladimir984@yahoo.com