Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Youth expelled from Montreal college after finding security flaw

news.nationalpost.com

Post reply on HN
Print view View original

131–140 of 308 posts

Re: Youth expelled from Montreal college after finding security flaw

#131

Post by puerto »

aquadrop wrote: post #121
puerto wrote: post #104

Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…

>'Unauthorized security testing == Malicious attack' I don't agree with that. Although I do think that unauthorized testing is unethical and you should get permission first, but treating it the same as successful attack and punishing the same is wrong. The main difference is intention. And Mr. Al-Khabaz notified relevant authorities and did get thanks at first. If we compare this case to your example about locks, I'd…

You missed my point. Like I said, I'm not commenting the penalty. In my opinion, it's too hard. But this is only my opinion after hearing (just like you said) just one side of the story.

The main problem with unauthorized testing (putting aside technical problems) is that person who performs it is in _very_ difficult position explaining her intentions. She already did what is considered the _second_ stage in hacker attack. Until she can prove her good intentions, this is rightfully treated as a malicious attack.

This is what my equation means. I think everybody on this forum should be aware of this. Don't get yourself in trouble for not knowing this.

Re: Youth expelled from Montreal college after finding security flaw

#132

Post by jacquesm »

eru wrote: post #66
mathrawka wrote: post #36

Back in 1999 when I was a freshman in university, my school had a server for students to host their websites on and use Pine for email. The server did not give shell access... but then there was a security hole in Pine that would allow you to run chsh. So I did that, and got shell access. I think the worst thing I did (other than running ls in a few directories) was use it to connect to IRC. Since I wasn't really try…

Was MAC spoofing not doable in 1999?

Some guy told me that it depended on the card that you used, some cards apparently had eeproms that you could reprogram without too much trouble.

Re: Youth expelled from Montreal college after finding security flaw

#133

Post by sageikosa »

jrockway wrote: post #49
monsterix wrote: post #28

Earlier quoted context omitted.

Reading stories/incidents like these makes me believe that education as a whole is stapled for reinvention. As they say: competition doesn't kill your business; attitude kills it.

Agreed. The vendor involved with the security problem was quite pleasant to deal with, of course. It was just the bureaucrats that were worried/afraid/stupid/whatever.

Policy IS the policy.

Re: Youth expelled from Montreal college after finding security flaw

#134

Post by Zr40 »

aquadrop wrote: post #123
Gigablah wrote: post #48

Earlier quoted context omitted.

So the fact that the submission title is misleading makes the university's heavy-handedness easier to swallow?

It just means that whole article can contain more misleadings and be one-sided. Journalists... you know.

The article could contain that regardless of whether the title is misleading.

Re: Youth expelled from Montreal college after finding security flaw

#135

Post by laumars »

slapshot wrote: post #118
Xcelerate wrote: post #51

This sort of thing scares me. One time I found a security vulnerability in a popular forum I frequented. I emailed the site owner, and he thanked me and fixed it. Later someone else discovered another weakness and used it to post spam; the site owner emailed me asking about it. My initial thought was that he suspected I was the one doing it, but it turned out he was just trying to see if I could help him. That scared…

> more jail time than robbing a bank This meme of "more jail time than robbing a bank" needs to end. The federal penalty for possessing a firearm while robbing a bank is a mandatory minimum of 5 years and a maximum of life in prison. The mandatory minimum means that a judge could not sentence an armed bank robber for less than 5 years for each bank robbed while holding a gun (you don't even need to show it; just havi…

> "The federal penalty for possessing a firearm while robbing a bank is a mandatory minimum of 5 years and a maximum of life in prison. The mandatory minimum means that a judge could not sentence an armed bank robber for less than 5 years for each bank robbed while holding a gun (you don't even need to show it; just having it is enough).

What's more, you don't even have to have a gun for it to be classed as "armed robbery". In the UK, just the threat of having a fire arm is enough (you could be brandishing a water pistol or even just making a gun gesture behind your unzipped coat).

Re: Youth expelled from Montreal college after finding security flaw

#136

Post by aquadrop »

aaron695 wrote: post #128
aquadrop wrote: post #122

Earlier quoted context omitted.

Still, all those things are caused by bugs in _your_ software. And all of that can be caused by regular users just hitting one of the bugs.

No they are not bugs, in any way, shape or form. I think you are missing the technology and ethos of website design here. Web scanners do massive offensive attacks. They basically DOS attack your site in many ways, trying millions of attack vectors. Mitigating against vandalism is very hard. It hurts users the more you do. Generally you leave it as open as possible and it is ok, since it's not a security issue per se…

> No they are not bugs, in any way, shape or form. Maybe not all, but some of them are.

I think you mentioned different issue here, puerto called unauthorized check 'unethical' and you talk about performance. If Mr. Al-Khabaz used some noninvasive scanner, which didn't bring any serious technical overhead, is it ok by you?

> Someone could write a script to cause thousands of $ damage to wikipedia without much trouble. But wiki chose's to leave itself open and take the risk. They don't have a bug. I don't really understand what do you mean when you say 'open', open to what? But I think wiki has some protection mechanisms, because at their scale if someone could easily bring them down, someone would.

Re: Youth expelled from Montreal college after finding security flaw

#137

Post by ivix »

rwg wrote: post #93

I've already posted my "almost got arrested for using zsh" story, so here's another one: I used to work at a large public university. One day, a grad student brought me his laptop and asked if I would take a look at it because "the Internet [was] really slow." It turned out that his computer was part of a botnet controlled via IRC, and it was being used to attack hosts on the Intertubes. After sniffing the IP address…

I would guess that being a CIO is 80% about management/people skills and 20% about technology. Hopefully that goes some way to explaining why these people did not understand your email.

Re: Youth expelled from Montreal college after finding security flaw

#138

Post by waitwhat »

stereo wrote: post #125
puerto wrote: post #104

Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…

It's his own data in the system, which makes this completely different. In your lock picking example, it would be a landlord finding one of their tenants picking their flat's locks.

Assuming the vulnerability scanner tries some basic login attacks (for example, trying default username/passwords), then it would be analogous to a landlord finding one of their tenants trying to pick their neighbours' locks, and that of the building management office.

Re: Youth expelled from Montreal college after finding security flaw

#139

Post by aquadrop »

puerto wrote: post #131
aquadrop wrote: post #121

Earlier quoted context omitted.

>'Unauthorized security testing == Malicious attack' I don't agree with that. Although I do think that unauthorized testing is unethical and you should get permission first, but treating it the same as successful attack and punishing the same is wrong. The main difference is intention. And Mr. Al-Khabaz notified relevant authorities and did get thanks at first. If we compare this case to your example about locks, I'd…

You missed my point. Like I said, I'm not commenting the penalty. In my opinion, it's too hard. But this is only my opinion after hearing (just like you said) just one side of the story. The main problem with unauthorized testing (putting aside technical problems) is that person who performs it is in _very_ difficult position explaining her intentions. She already did what is considered the _second_ stage in hacker a…

> She already did what is considered the _second_ stage in hacker attack

Considered by who? There's companies which pay you money if you can find bug in their software. And that's open offer, they don't say 'wait, we'll get ready at 8 p.m. friday and then you can check'. What do you think would Google do, if this student used scanner(or something else) on gmail and found bug and then told Google about it?

I still think that intention is key difference here. And as you said 'that person who performs it is in _very_ difficult position explaining her intentions'. That's why you shouldn't do any unauthorized checks, because even if you wanted to tell about your findings to the relevant authorities, you can be caught before that and then you'r screwed. But Mr. Al-Khabaz informed university/company and was initiator of that talk, so it kinda clears him. He was able reasonable explain his intentions and his punishment could be just some warning(of course if there's no any significant moments we don't know about). Also he didn't get any credit for help he did by finding the bug.

Re: Youth expelled from Montreal college after finding security flaw

#140

Post by lclarkmichalek »

VMG wrote: post #72
rdtsc wrote: post #25

I've said this before -- don't bother being a "white hat". The industry and the legal system doesn't have a pigeon hole for that. You'll be labeled as "hacker" (and not in a positive sense of it). Either disclose the vulnerability immediately to get recognition, hoping it is public enough they'll be ashamed of going after you, or or sell and profit from it. You are already treated as a criminal by these large institu…

> You are already treated as a criminal by these large institutions, so if you go in that direction might as well make some money. In the second scenario, you probably are hurting innocent people. So if you have a moral compass, you should maybe bother being an anonymous white hat.

Being anonymous isn't always easy unfortunately
Post reply on HN