Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Youth expelled from Montreal college after finding security flaw

news.nationalpost.com

Post reply on HN
Print view View original

231–240 of 308 posts

Re: Youth expelled from Montreal college after finding security flaw

#231

Post by lordlicorice »

zx2c4 wrote: post #94
rwg wrote: post #93

I've already posted my "almost got arrested for using zsh" story, so here's another one: I used to work at a large public university. One day, a grad student brought me his laptop and asked if I would take a look at it because "the Internet [was] really slow." It turned out that his computer was part of a botnet controlled via IRC, and it was being used to attack hosts on the Intertubes. After sniffing the IP address…

link to zsh story: http://news.ycombinator.com/item?id=3901634

In high school I had to write a long apology essay in part because my computer teacher testified to the principal that the Windows command line is "a high-security area of the computer that students have no business accessing."

I tried to explain that she was wrong, but you can guess how well that went.

Re: Youth expelled from Montreal college after finding security flaw

#232

Post by Dylan16807 »

crpatino wrote: post #205
fduran wrote: post #158

Earlier quoted context omitted.

Malicious definition: "motivated by wrongful, vicious, or mischievous purposes", so it doesn't look that what he did was malicious. Also, unlawful? please quote the Canadian law that he broke, even in the US IANAL but the law mentions a vague "unauthorized access", has anyone ever been charged or convicted for running a vulnerability scanner like Nessus? Not that I disagree with you: always ask for permission in writ…

I think what the GP meant was something along the lines of "Unauthorized security testing is indistiguishable from Malicious attack", in the sense that you cannot but expect the administrators of the system in question will react in alignment with their own goals. And you really have no control whether they perceive you as an ally or a threat. Orthogonal to this fact is the question of what happens when an authority…

>"Unauthorized security testing is indistiguishable from Malicious attack"

Of course it's distinguishable. Testing comes before attacking, to provide information. The two are otherwise completely unrelated. It'd dead-easy to distinguish between someone poking your fence and someone stealing your jewelery, for example.

Re: Youth expelled from Montreal college after finding security flaw

#233

Post by Karunamon »

tomp wrote: post #157
Karunamon wrote: post #146

This headline is somewhat misleading. The student was expelled, not for finding and disclosing a security flaw (he was actually congratulated and thanked for this), but for later running a pentest software suite without permission to "verify" if the bug had been fixed. That's not to say that the expulsion still doesn't reek of BS, but Ahmed's hands are not completely clean here.

That is probably just their excuse. I think it's quite reasonable to check if someone fixes a security flaw that puts your own information to the risk. It's like trying to open (without the key) the safe at the bank that has your money in it.

Try walking into the safe deposit box area at the bank absent escort or previous notification and see how that works out for you.

Again, the school is on record as giving him kudos for reporting the error - it's perfectly reasonable to assume that someone will not launch offensive penetration testing tools at your site, without notice or permission, just because they have reported the bug in the past.

He could have tested the bug without the pentest software, besides. Just because someone points out a crack in your window doesn't give them carte blanche to try breaking it after you said you fixed it.

Re: Youth expelled from Montreal college after finding security flaw

#234

Post by Ras_ »

rohansingh wrote: post #149
Ras_ wrote: post #98

Earlier quoted context omitted.

Yes, Finland. Maybe it's because all of our schools are public? For example higher ed. providers are funded based on enrollment and rate of graduation. If someone does not graduate, significant chunk (20-30%) of money won't be paid at all. This creates some incentive for the institution to actually guide and see that people don't fall through all kinds of cracks. I guess it's necessary when there is no ordinary payin…

How do you prevent the schools from just lowering graduation requirements in order to artificially boost the percent of graduates and get a better payout?

Since they are either fully government funded or jointly funded with municipalities, there are no incentives to search short term profits by running diploma mills.

Ministry of Education controls the money and conducts yearly performance target negotiations bilaterally with each higher education institution. You actually need a permit from the ministry to run any kind of school. Even our few "private" primary and secondary schools are publicly funded and regulated accordingly.

Independent expert body FINHEEC audits universities quality management schemes regularly. Some European countries use accreditation-based evaluation (for single degree programs) instead of system wide audits. At least one Finnish university has also acquired ISO 9001 cert, but it was seen as more labor intensive and not providing the same benefits (benchmarking, benchlearning) as the required peer-based audits.

Re: Youth expelled from Montreal college after finding security flaw

#235

Post by Dylan16807 »

puerto wrote: post #152
aquadrop wrote: post #139

Earlier quoted context omitted.

> She already did what is considered the _second_ stage in hacker attack Considered by who? There's companies which pay you money if you can find bug in their software. And that's open offer, they don't say 'wait, we'll get ready at 8 p.m. friday and then you can check'. What do you think would Google do, if this student used scanner(or something else) on gmail and found bug and then told Google about it? I still thi…

Scanning is the second phase of the standard hacker attack procedure. Phases of hacking: Phase 1—Reconnaissance Phase 2—Scanning Phase 3—Gaining Access Phase 4—Maintaining Access Phase 5—Covering Tracks Regarding this guy's intention, you're probably right. The main reason why I'm commenting here is that guys with good intentions don't get themselves in the trouble for not knowing what they're doing. Finding vulnerab…

But you wouldn't call reconnaissance hacking, would you? That's just vaguely looking at the site and information about the company. Step 2, pointed at something like a webserver, does not connect to any systems the person is not supposed to have access to. Only step 3 crosses the line.

Re: Youth expelled from Montreal college after finding security flaw

#236

Post by randomdata »

laumars wrote: post #135
slapshot wrote: post #118

Earlier quoted context omitted.

> more jail time than robbing a bank This meme of "more jail time than robbing a bank" needs to end. The federal penalty for possessing a firearm while robbing a bank is a mandatory minimum of 5 years and a maximum of life in prison. The mandatory minimum means that a judge could not sentence an armed bank robber for less than 5 years for each bank robbed while holding a gun (you don't even need to show it; just havi…

> "The federal penalty for possessing a firearm while robbing a bank is a mandatory minimum of 5 years and a maximum of life in prison. The mandatory minimum means that a judge could not sentence an armed bank robber for less than 5 years for each bank robbed while holding a gun (you don't even need to show it; just having it is enough). What's more, you don't even have to have a gun for it to be classed as "armed ro…

This seems more like walking up to a teller and asking nicely in a clever way if you could have all the money. Is it even a crime if the teller responds positively to your request?

Re: Youth expelled from Montreal college after finding security flaw

#237

Post by Dylan16807 »

Karunamon wrote: post #233
tomp wrote: post #157

Earlier quoted context omitted.

That is probably just their excuse. I think it's quite reasonable to check if someone fixes a security flaw that puts your own information to the risk. It's like trying to open (without the key) the safe at the bank that has your money in it.

Try walking into the safe deposit box area at the bank absent escort or previous notification and see how that works out for you. Again, the school is on record as giving him kudos for reporting the error - it's perfectly reasonable to assume that someone will not launch offensive penetration testing tools at your site, without notice or permission , just because they have reported the bug in the past. He could have…

The webserver did escort him into the room with the safe deposit boxes.

He has a key, they let him in, that's their job. The problem is that he could open his box, or any other box, without actually using the key.

Re: Youth expelled from Montreal college after finding security flaw

#238

Post by Dylan16807 »

hn-miw-i wrote: post #79

Problem is he used an auditing/penetration testing tool POST disclosure, and did it without authorization. The availability of these tools puts weapon grade exploits in the hands of those with limited understanding of the consequences. I don't have an issue with the availablity -- best we lighten our history with Full Disclosure and provide best of breed tools to simulate attackers -- however, responsibility and indi…

What is with all these analogies that equate testing with smashing things.

Stop it.

Stop. It.

Re: Youth expelled from Montreal college after finding security flaw

#239

Post by rwg »

ivix wrote: post #137
rwg wrote: post #93

I've already posted my "almost got arrested for using zsh" story, so here's another one: I used to work at a large public university. One day, a grad student brought me his laptop and asked if I would take a look at it because "the Internet [was] really slow." It turned out that his computer was part of a botnet controlled via IRC, and it was being used to attack hosts on the Intertubes. After sniffing the IP address…

I would guess that being a CIO is 80% about management/people skills and 20% about technology. Hopefully that goes some way to explaining why these people did not understand your email.

I'm not disagreeing with you at all, but if they don't understand the technology, then they should have an underling who does monitoring the abuse@ mailbox...

Re: Youth expelled from Montreal college after finding security flaw

#240

Post by Dylan16807 »

namank wrote: post #212
namank wrote: post #52

Tweet this link to Anonymous. I just did. https://twitter.com/naman_k/status/293252007878328320

While I was expecting downvotes for this comment, I was also looking forward to the discussion that should arguably accompany such downvotes. But that, of course, is a privilege exercised by the downvoter and rarely ever happens!

If you know why you got downvoted then you don't need someone to explain it to you.

There are less-irritating ways to start a conversation than trying to be 'loud and wrong'.

Post reply on HN