German developer guilty of 'hacking' for exposing hardcoded credentials in app
A German court has fined a developer for “hacking” after he used hardcoded database credentials embedded in a commercial app to diagnose a logging issue and then reported that the same credentials exposed data from many other customers. Commenters debate whether this constitutes unlawful digital trespass or reasonable use of credentials effectively handed to the customer, while strongly criticizing the vendor’s security practices and decision to press charges. Many fear that broad computer crime laws like Germany’s §202a/§202c StGB create a chilling effect on good‑faith vulnerability reporting, ultimately leaving systems less secure.
What the developer did (as discussed)
- Tasked by a customer to debug excessive logging in vendor software.
- Opened the client binary (reportedly just in a text editor) and found hardcoded MySQL credentials.
- Assumed the remote DB was single-tenant for that customer; used those credentials to connect.
- On seeing data for many customers, he allegedly disconnected quickly and reported the issue.
- Some comments add that he also derived hashes of user data (possibly via DB functions) for later notification and used tools like phpMyAdmin; others say details are unclear.
German legal context (§202a / §202c StGB)
- §202a criminalizes gaining access to data that is “specially protected” against unauthorized access, regardless of purpose.
- §202c criminalizes obtaining or providing passwords/tools intended to commit such offenses.
- Earlier, the same lower court had dismissed the case, arguing that a default password in a freely downloadable client wasn’t “effective protection”; a higher court forced a new trial with a different judge.
- Conviction currently carries a ~€3000 fine plus legal costs; not yet final and may be appealed.
Moral vs legal debate
- Many see this as punishing a de facto good-faith disclosure and blame vendor negligence (single shared password, stored in cleartext).
- Others stress that once he extracted credentials and manually queried a third-party server, that became “digital trespass,” independent of intent or vendor carelessness.
- Disagreement over whether the customer’s right to their own data implies a right to connect via arbitrary tools, not just the vendor app.
Chilling effect and practical advice
- Widespread concern that such rulings deter responsible disclosure; safer to stay silent or report only anonymously.
- Several say they already avoid reporting bugs for fear of prosecution, across Germany, UK, US, and Netherlands analogues.
- Some argue this incentives selling vulns or data instead of helping vendors.
Analogies and meaning of “hacking”
- Long debate using keys, doors, storage units, hotel rooms, and APIs to reason about authorization.
- Many criticize calling this “hacking” at all; others note that law cares about unauthorized access, not technical sophistication.
- Discussion of how “hacking” has shifted from playful tinkering to media/criminal framing.
Broader context: Germany, policy, and security research
- Comments link this to Germany’s restrictive computer-crime laws, weak digital security culture, and brain drain of infosec talent.
- Some argue for Good Samaritan–style protections and more effective lobbying (EFF mentioned) to reform such laws.