What is the most disturbing thing you found when hacking?

 When I was in my early teens, I was rather into “security”. This was in the mid-90s, the Internet was in its infancy, and the way we would get online was via dialup into a shell account.

It looked something like this:

In essence, you’d pay to have a remote account on a Unix system that lots of other people also paid to be able to have a remote account on. You had your own folder on the remote machine and a certain drive usage quota, and you could run apps like IRC, Lynx (a text mode web browser), and so on.

My ISP at the time, this was in California, was apparently not particularly concerned about security, and the public password hashes weren’t salted. I cracked a bunch of them with a dictionary attack, and sometimes I’d snoop around other people’s accounts. Completely illegal, but not particularly enforced back then.

One day, I came across a user named “bobg”. That’s the actual account name, I still remember it 20+ years later. He had what looked like an email dump in his home directory, which included some odd emails: it looked liked a conversation about his upcoming visit to Thailand, some references to “the girl”, and some talk about what account he’s supposed to transfer money to.

Getting a bit more curious, I started snooping around more, and found a folder with hundreds of child porn images.

I talked to an Australian friend of mine, who suggested that I should tip off the authorities. The main difficulty was that I didn’t want to get arrested in the process, because the way I came across any of this wasn’t exactly legal.

I had a few anonymous shell accounts that I wasn’t, let’s say, paying for, most of those in countries that weren’t the US, and my friend gave me a few more. I copied the email dump, bounced around the shell accounts until there were five countries between me and the US, and emailed the dump to the FBI, along with bobg’s login information, and a quick explanation of what they were about to see.

I never heard back, but shortly thereafter, bobg’s account ceased all activity, and then disappeared altogether about a year later.

I like to think that I helped put bobg away for a while, as well as whoever he was talking to.

Edit: to all the numerous folks telling me that I should go anonymous or that I’m a bad person: this was more than 20 years ago, I was a juvenile, and I feel good about the fact that I may have helped stop a predator. I believe that I’m completely in the clear from the moral perspective, and, given the statute of limitations, from the legal perspective as well.