It doesn't come much as a surprise to me that Omnivox has at least a few security flaws. I had to use it during my CEGEP years in Montreal and it's a huge piece of garbage.
Youth expelled from Montreal college after finding security flaw
101–110 of 308 posts
Re: Youth expelled from Montreal college after finding security flaw
#102The administration of Dawson College clearly saw things differently, proceeding to expel Mr. Al-Khabaz for a “serious professional conduct issue.”
He is a student, how can be have a "Professional conduct issue"
Re: Youth expelled from Montreal college after finding security flaw
#103I found something like this at my school. The administration reacted similarly. But fortunately, I was taking djb's Unix Security Holes at the time, and a harshly-worded note from djb to the Computer Center folks ended up getting me a thank you. Next semester, though, I refused to sign the new AUP (which included a clause allowing the computer center staff to seize any computer I was using, even at my off-campus home…
These expulsion stories sound really weird. I mean you pay for all of your studies and still could get axed on a whim? Whereas in my country I get paid to study and have zero chance of being expelled for these kinds of events.
Even countries in Scandanivia will expell people who break college rules. And if you pay for and go on a train in finland and break their rules, you can be kicked off.
It all depends on what rules there are, and how they are enforced/interpreted.
Re: Youth expelled from Montreal college after finding security flaw
#104Unauthorized security testing == Malicious attack
The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt!
I work as a security professional for 7 years, and I recently did a guest lecture on the college discussing the example like this. Most students were not aware where the problem is. Maybe it would help imagining how would story like this look in the physical world: Let's suppose you come back home and find someone picking on your door lock with a lock picking tool. You ask him "what are you doing?" and he says "I'm just checking is your lock safe. I do it for your security." Would you believe him? Or would you call the police immediately, without asking him anything? Let's add to this that security testing tools can sometimes degrade the tested system's performance or sometimes even crash it. In this case, it's not just unauthorized access attempt, but successful denial-of-service attack!
Never, ever, do a security testing of the system without the written permission of the system owner. If you get the permission, you will probably be asked to sign an NDA in return. You will also need to provide some information, like source IP address you're using and emergency contacts that can be used to stop the testing in case of problems (like crashes, etc.). This is the only lawful and ethical way to do these kind of procedures on someone else's system.
I'm not discussing if the penalty is OK in this case. It really doesn't matter if most people here cannot tell what he did wrong in the first place.
Re: Youth expelled from Montreal college after finding security flaw
#105Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…
http://www.acunetix.com/blog/web-security-zone/should-you-te...
what can happen when production Web applications are tested including:
Email floods
Junk data inserted into databases
News feeds filling with random input
Log files filling up
Accounts getting locked out
Internet bandwidth consumption
Scans that take longer to complete
High server and database utilization
Incident response teams and managed security providers having to deal with alerts
Final cleanup needed after the fact
Re: Youth expelled from Montreal college after finding security flaw
#106Re: Youth expelled from Montreal college after finding security flaw
#107So.. here's something that happened to me in my engineering software university.
A friend of me just had a summer internship in a security firm and learned a trick or two. And, looking at the html/javascript code of a page, there was an obvious entry point that gave access to anyonela else account provided you had their student number (i.e. skip the password step).
So my friend showed it to me and I suggested he tell the IT department. Obviously, the next thing we know, he's accused of "Hacking" and get menaced by the IT department.
A couple days later, we check back the website and realize that a trivial encryption is added.. I.e. you have to reverse the student number or something like that. And, obviously, just on the client-side.
A little bit pissed, we decided to take our revenge of being menaced for just being nice. So we create a web page where it explains the story (That we found an entry point, that we told the IT, etc.) and then, we say "Try it!" [] which directly logs you in into their account.
We e-mail that page to the main directors of the school by suggesting a quick fix. And, we make sure to CC the IT departments.
The day after it was fixed and we received a real "thanks" from the authority. I guess the trick is to contact a higher authority rather than directly contacting the IT department.
Re: Youth expelled from Montreal college after finding security flaw
#108Earlier quoted context omitted.
Which country may I ask? Nordic?
Yes, Finland. Maybe it's because all of our schools are public? For example higher ed. providers are funded based on enrollment and rate of graduation. If someone does not graduate, significant chunk (20-30%) of money won't be paid at all. This creates some incentive for the institution to actually guide and see that people don't fall through all kinds of cracks. I guess it's necessary when there is no ordinary payin…
> Maybe it's because all of our schools are public?
There are Asian countries where this model has failed. Perhaps because of population pressure or other social factors. But I truly like the Nordic way of life.
Re: Youth expelled from Montreal college after finding security flaw
#109"This type of software should never be used without prior permission of the system administrator, because it can cause a system to crash." Remind me to never, ever use Omnivox, or any Skytech software, ever.
You probably won't have to, but as a student, you don't have the choices ;) Your courses information, schedule, homework, etc. is all on it.
Re: Youth expelled from Montreal college after finding security flaw
#110Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…
http://www.acunetix.com/blog/web-security-zone/should-you-te... what can happen when production Web applications are tested including: Email floods Junk data inserted into databases News feeds filling with random input Log files filling up Accounts getting locked out Internet bandwidth consumption Scans that take longer to complete High server and database utilization Incident response teams and managed security prov…
Yeah, those things also.. ;)