Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Youth expelled from Montreal college after finding security flaw

news.nationalpost.com

Post reply on HN
Print view View original

121–130 of 308 posts

Re: Youth expelled from Montreal college after finding security flaw

#121

Post by aquadrop »

puerto wrote: post #104

Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…

>'Unauthorized security testing == Malicious attack' I don't agree with that. Although I do think that unauthorized testing is unethical and you should get permission first, but treating it the same as successful attack and punishing the same is wrong. The main difference is intention. And Mr. Al-Khabaz notified relevant authorities and did get thanks at first. If we compare this case to your example about locks, I'd say that Mr. Al-Khabaz walked around your house, saw the broken lock on your back door, then came to your front door, knocked and told you about that. Maybe you may wonder why he would walk around your house in the first place and accuse him of being weird, but can you accuse him in breaking in and stealing?

P.S. Since the author of the article is known for partnering with students defending organizations, the whole story can be one sided, and it would be good to judge after hearing another side. E.g. it could be not the first issue, or there's traces of something more than just security inspection.

Re: Youth expelled from Montreal college after finding security flaw

#122

Post by aquadrop »

aaron695 wrote: post #105
puerto wrote: post #104

Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…

http://www.acunetix.com/blog/web-security-zone/should-you-te... what can happen when production Web applications are tested including: Email floods Junk data inserted into databases News feeds filling with random input Log files filling up Accounts getting locked out Internet bandwidth consumption Scans that take longer to complete High server and database utilization Incident response teams and managed security prov…

Still, all those things are caused by bugs in _your_ software. And all of that can be caused by regular users just hitting one of the bugs.

Re: Youth expelled from Montreal college after finding security flaw

#123

Post by aquadrop »

Gigablah wrote: post #48
dbbolton wrote: post #37

The title is misleading. He wasn't actually expelled for finding the flaw; he was expelled because, after reporting the flaw, he ran an exploit program on the school's server without permission, allegedly to see if it had been fixed. Had he only reported it, he would not have been subject to any disciplinary action.

So the fact that the submission title is misleading makes the university's heavy-handedness easier to swallow?

It just means that whole article can contain more misleadings and be one-sided. Journalists... you know.

Re: Youth expelled from Montreal college after finding security flaw

#124

Post by barry-cotter »

doktrin wrote: post #41
droithomme wrote: post #29

Earlier quoted context omitted.

> Do computer science professors not understand the concept of white-hat hacking? Unfortunately, if they were at all competent they wouldn't be teaching at a place like that. CS programs at minor universities are notoriously poor and staffed by whoever they could get, and it's not going to be anyone that can make decent pay working on current technology.

Perhaps CS is an exception, but I was under the impression that jobs in academia (in general) were in woefully short supply. While I'm sure they wouldn't get the cream of the crop, there's reportedly an excess of under-employed & under-paid PhD's and post-docs in a number of STEM fields (again, specifically in academia).

CEGEPs are kind of a combination community college/last year of high school/first year of university. They are teaching institutions, not research ones. US community colleges can demand Master's degrees but not Ph.D.s to teach. Mostly people with Ph.D.s who can't get real academic jobs exit that market, not go CC.

Anyone who is actually teach a CS course at a CC or a CEGEP and who is doing it as a full time job is doing it for non-pecuniary reasons, inclusive of being incompetent but having attained a qualification sufficient to teach.

Re: Youth expelled from Montreal college after finding security flaw

#125

Post by stereo »

puerto wrote: post #104

Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…

It's his own data in the system, which makes this completely different. In your lock picking example, it would be a landlord finding one of their tenants picking their flat's locks.

Re: Youth expelled from Montreal college after finding security flaw

#126

Post by puerto »

stereo wrote: post #125
puerto wrote: post #104

Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…

It's his own data in the system, which makes this completely different. In your lock picking example, it would be a landlord finding one of their tenants picking their flat's locks.

So you think you can do the testing of any system that contains your data without prior permission?

Re: Youth expelled from Montreal college after finding security flaw

#127

Post by puerto »

aquadrop wrote: post #122
aaron695 wrote: post #105

Earlier quoted context omitted.

http://www.acunetix.com/blog/web-security-zone/should-you-te... what can happen when production Web applications are tested including: Email floods Junk data inserted into databases News feeds filling with random input Log files filling up Accounts getting locked out Internet bandwidth consumption Scans that take longer to complete High server and database utilization Incident response teams and managed security prov…

Still, all those things are caused by bugs in _your_ software. And all of that can be caused by regular users just hitting one of the bugs.

I agree. But _any_ kind of hacking exploits some kind of a vulnerability in the system. The presence of the bug doesn't give you right to exploit it.

Re: Youth expelled from Montreal college after finding security flaw

#128

Post by aaron695 »

aquadrop wrote: post #122
aaron695 wrote: post #105

Earlier quoted context omitted.

http://www.acunetix.com/blog/web-security-zone/should-you-te... what can happen when production Web applications are tested including: Email floods Junk data inserted into databases News feeds filling with random input Log files filling up Accounts getting locked out Internet bandwidth consumption Scans that take longer to complete High server and database utilization Incident response teams and managed security prov…

Still, all those things are caused by bugs in _your_ software. And all of that can be caused by regular users just hitting one of the bugs.

No they are not bugs, in any way, shape or form. I think you are missing the technology and ethos of website design here.

Web scanners do massive offensive attacks. They basically DOS attack your site in many ways, trying millions of attack vectors.

Mitigating against vandalism is very hard. It hurts users the more you do. Generally you leave it as open as possible and it is ok, since it's not a security issue per se and most sites can live their lives never having been attacked this way.

There's no money in vandalism and unless you piss off skilled or determined people it won't be abused.

Someone could write a script to cause thousands of $ damage to wikipedia without much trouble. But wiki chose's to leave itself open and take the risk. They don't have a bug. They are trying to do the right thing by users.

Re: Youth expelled from Montreal college after finding security flaw

#129

Post by twentysix »

rdtsc wrote: post #25

I've said this before -- don't bother being a "white hat". The industry and the legal system doesn't have a pigeon hole for that. You'll be labeled as "hacker" (and not in a positive sense of it). Either disclose the vulnerability immediately to get recognition, hoping it is public enough they'll be ashamed of going after you, or or sell and profit from it. You are already treated as a criminal by these large institu…

Its certainly a grey area and covering all your bases legally before embarking on a penetration test would be good idea. Even with all the legal formalities, there needs to be a good level of trust between the client and the auditor for things to go smoothly.

Two days later, Mr. Al-Khabaz decided to run a software program called Acunetix, designed to test for vulnerabilities in websites, to ensure that the issues he and Mija had identified had been corrected.

If you find a security flaw in a system and report it, receiving positive feedback doesn't automatically imply that you have permission to conduct further tests. A web application vulnerability scanner can cause damage to production systems.

Almost anyone can just download a scanner and run a wild test using default settings. But its illegal to do it without prior authorization.

While his intentions were good, I think it was a bit naive of him to take upon himself the responsibility to make sure the flaws were fixed and conduct a test. Even when you have permission to conduct a test you stick to the scope and limits of the agreement. You cant just keep leapfrogging networks as you find holes.

Manually finding holes/bugs accidentally and reporting them is different from running a vulnerability scanner.

I dont think he should have been expelled without giving a chance to explain his story and the way they did it was not ethical. The management over reacted, especially considering there was no damages mentioned in this case.

http://testlab.sit.fraunhofer.de/downloads/Publications/tuer...

http://www.coresecurity.com/content/under-attack

https://en.wikipedia.org/wiki/Randal_L._Schwartz#Intel_case

Re: Youth expelled from Montreal college after finding security flaw

#130

Post by jrockway »

amenonsen wrote: post #117
jrockway wrote: post #43

Earlier quoted context omitted.

I got a B. The homework was to find and write an exploit for 10 security holes in deployed software, but I only found 2. (3 including the one above, which I must have found the week or so after exams. The holes I found were in nasm and in some amateur open-source smtpd.) FWIW, the exams are quite thought-provoking nearly 10 years later, here's a link to them: http://cr.yp.to/2004-494.html

What did you think of the course textbook ("Exploiting Software", Hoglund & McGraw)? Is there a more modern alternative that you (or anyone) can recommend?

The textbook covers subject matter that won't become outdated: reverse engineering, how to craft malicious input, etc.
Post reply on HN