Hamed Helped. Help Hamed.
hamedhelped.com
Hamed Helped. Help Hamed.
1–10 of 52 posts
Re: Hamed Helped. Help Hamed.
#2Wow. This is much worse than I thought. I'm glad there's no conceivable scenario in which this could lead him to be extradited to the USA, like Marc Emery was. http://en.wikipedia.org/wiki/Marc_Emery
Re: Hamed Helped. Help Hamed.
#3What's the truth here? What did Hamed "do"?
Exposing a security flaw doesn't get you expelled. He had to have taken it one or more steps too far. I'd like to see the facts.
Re: Hamed Helped. Help Hamed.
#4What's the truth here? What did Hamed "do"? Exposing a security flaw doesn't get you expelled. He had to have taken it one or more steps too far. I'd like to see the facts.
Re: Hamed Helped. Help Hamed.
#5What's the truth here? What did Hamed "do"? Exposing a security flaw doesn't get you expelled. He had to have taken it one or more steps too far. I'd like to see the facts.
Here's his expulsion letter, stating why he was expelled according to the school.
http://www.documentcloud.org/documents/560325-al-khabaz-expu...
Re: Hamed Helped. Help Hamed.
#6What's the truth here? What did Hamed "do"? Exposing a security flaw doesn't get you expelled. He had to have taken it one or more steps too far. I'd like to see the facts.
http://news.ycombinator.com/item?id=5090007
A few days after reporting the flaw, he got caught using http://www.acunetix.com/ (web vulnerability scanner) on their network. He says he was checking to see if they fixed the flaw. I don't think he was intentionally being malicious, but his explanation doesn't jive with his actions.
I still think it sucks that they expelled him. But I am unable to logically see how he didn't break the rules.
Re: Hamed Helped. Help Hamed.
#7What's the truth here? What did Hamed "do"? Exposing a security flaw doesn't get you expelled. He had to have taken it one or more steps too far. I'd like to see the facts.
http://news.ycombinator.com/item?id=5090007 A few days after reporting the flaw, he got caught using http://www.acunetix.com/ (web vulnerability scanner) on their network. He says he was checking to see if they fixed the flaw. I don't think he was intentionally being malicious, but his explanation doesn't jive with his actions. I still think it sucks that they expelled him. But I am unable to logically see how he did…
I don't understand how using an external attack tool is grounds for anything. If Hamed could use it to search for exploits an attacker could have used it to search for exploits.
Especially if a students' information had been previously exposed and the attacker had access to everyone's personal information / passwords!
-- Edit : after reading his expulsion letter, it seems he supposedly injected SQL on both occasions. One imagines they strictly forbid him from doing so again. Sure, he probably should have asked for a sandbox system if he wanted to do ad hoc security research, but it is still quite a logical leap to actually expel him.
Re: Hamed Helped. Help Hamed.
#8What's the truth here? What did Hamed "do"? Exposing a security flaw doesn't get you expelled. He had to have taken it one or more steps too far. I'd like to see the facts.
Here's his expulsion letter, stating why he was expelled according to the school. http://www.documentcloud.org/documents/560325-al-khabaz-expu...
Translation:
On Sept 21st our site was vulnerable to a simple SQL injection attack. On Sept 22nd you documented this information for us.
On Oct 26th our site was STILL vulnerable to a simple SQL injection attack. On Oct 29th you again documented this information for us.
On Nov 12th we expelled you for our discovering our abysmal security.
Re: Hamed Helped. Help Hamed.
#9Moral of the story: Sanitise your query params.
Re: Hamed Helped. Help Hamed.
#10While Hamed was honorable and didn't try to abuse his exploits, I think it is a stretch to say "Hamed helped". I doubt he tried to get into the data for the purpose of helping make it more secure, it is more likely that he just had the "hacker drive", where he just wanted the challenge of beating a system.