Is Your Client's Network WIDE OPEN!!!

For openers place a router with NAT between the modem and the LAN then install ZONE Alarm.

If you know your reasons for approaching the co is concern for there network, and some $$ in your pocket, then its not unethical. The question is, how to tell them that you were snooping and not sound like you were ?up to something?.

I think I would approach the company with the info you have and tell them how you found it. Most people don?t know how this stuff works, and may be happy that you told them. For those that look at you with suspicion, say ?just thought you should know? and leave it at that.

I would definately approach the companies! Just tell the truth with the potential clients and be able to prove it. I have had experience with Nimda and people running IIS. I would find out everything about the company via Whois and such tools andthen make the call asking for the appropriate person in charge of their network security. Usually they do not have one. Here is the hole for entry! Talk to the owner/CEO/or anyone who is the boss. Give it to them straight and tell them that you can access their network because they have a back door open! Send a print job to their printer as an ad! Any of these will work!

Although what you are trying to do is not unethical, it still may require a delicate touch. Although your goal may be to add to your client base, you may not want to necessarily mention that fact when you contact the company in question. Dependingon the personalities (and technical knowledge) of the people you contact and the types of information you got access to, it is entirely possible that the company managment may view your contact with them as an attempt to extort money ('I gained access to some very sensitive and interesting information about your company. For a price I can fix the security hole (and by the way, keep that information private)!).

If I might suggest an approach:
Identify yourself and your company. Identify your current client, and in a general sense, the type of work you are doing for them. Identify what you were doing that lead you to determine the security hole in their network. If the company appears unconcerned, provide a few further tidbits (this is the type of info I was able to gain access to) and tell them you thought they should know. If they then start to show some concern or ask how to fix the problem, you can give them your sales pitch. If they continue to show no concern, mention that they already have a network administrator, or just say thanks for the info, don't press the issue. Tell them 'Good Luck' and chalk up the experience to community service.