281–290 of 308 posts
Earlier quoted context omitted.
Was MAC spoofing not doable in 1999?
and sadly it won't be in the future. New Intel-wifi cards have them blocked[1], their new drivers even go out of the way to modify/intercept Windows from doing it from the software side. Won't be long until other manufacturers follow suit. [1] http://www.intel.com/support/wireless/wlan/sb/CS-031081.htm
Unauthorized security testing == Malicious attack The actions of Mr. Al-Khabaz were unlawful and unethical. If he only accidentally found the flaw and reported it to the responsible person, things would be fine. But security testing without the permission of the system owner is the same as unauthorized access attempt! I work as a security professional for 7 years, and I recently did a guest lecture on the college dis…
I'm going against the general idea here, but the college issued a statement: http://www.dawsoncollege.qc.ca/home Basically, they say Ahmed did more than just what is reported in the article, and they can't publicly say what he did - because that's private info about Ahmed that they're legally obliged to protect. Now I'm not taking a position in favor of the college or in favor of Ahmed. I'm just saying, it's not all…
Perspective: That bit about protecting his privacy is the same sort of excuse Ortiz's office gave in their initial response to Aaron's death.
This sort of thing scares me. One time I found a security vulnerability in a popular forum I frequented. I emailed the site owner, and he thanked me and fixed it. Later someone else discovered another weakness and used it to post spam; the site owner emailed me asking about it. My initial thought was that he suspected I was the one doing it, but it turned out he was just trying to see if I could help him. That scared…
> more jail time than robbing a bank This meme of "more jail time than robbing a bank" needs to end. The federal penalty for possessing a firearm while robbing a bank is a mandatory minimum of 5 years and a maximum of life in prison. The mandatory minimum means that a judge could not sentence an armed bank robber for less than 5 years for each bank robbed while holding a gun (you don't even need to show it; just havi…
I think the college administrators are bullying this student because they are embarrassed. The threats by the Skytech CEO Edouard Taza; the college not allowing the professors to hear the student before voting; his transcripts vandalized with zeroes so he cannot continue his studies elsewhere... What exactly is the relationship between Skytech and this college? I've signed the petition to reinstate Hamed: http://www.…
I used to work at Skytech. We already had a case of a student discovering a flaw in our code while I was there and things went very smoothly. We contacted the student, he told us what the flaw was, we corrected it. Edouard made him sign a non-disclosure agreement and made him delete all the data he had gotten from our servers and that was the end of it. This student was a brilliant student with excellent grades just…
He got kicked out of CEGEP. He'll survive unharmed. Sad that he thinks getting publicity is worth it though.
I don't agree that expulsion is the correct reaction, but when he ran the pen-test software, what he was doing was wrong. It's one thing to stumble upon a bug while you're developing an app, and report it. That's totally respectable. Running pen-testing software without permission is akin to walking up to a stranger's home and testing that all the windows are locked, with a crowbar.
I can't help but feel a better analogy is finding a rip in the seat of a bus, reporting it, and then poking at the rip a few days later to see if it has been repaired. Going at someone's windows with a crowbar doesn't seem to fit the situation at all, in my opinion.
What he did do was download pen test software to automatically check the website for flaws AFTER BEING TOLD NOT TO. He went to every bus and checked every seat, door, window, engine, tire, seat belt for dozens of different flaws without permission.
And yes, pen test software can be destructive. It can put bad data in a database, crash a server, overrun log files, and corrupt things. Penetration testing is not a passive process.
Earlier quoted context omitted.
Didn't he famously fail the whole class one of the times he gave it?
I don't think so, as he's only taught the class once and I didn't fail it: http://cr.yp.to/courses.html
I remember reading the course syllabus online and being jealous despite already having worked in professional vulnerability research for a few years. You're lucky to have been at the class! Was he a good lecturer?
I've already posted my "almost got arrested for using zsh" story, so here's another one: I used to work at a large public university. One day, a grad student brought me his laptop and asked if I would take a look at it because "the Internet [was] really slow." It turned out that his computer was part of a botnet controlled via IRC, and it was being used to attack hosts on the Intertubes. After sniffing the IP address…
I would guess that being a CIO is 80% about management/people skills and 20% about technology. Hopefully that goes some way to explaining why these people did not understand your email.
There really needs to be legal protection for acts of white-hat hacking like this. Both protection from prosecution, and protection from reprisal. This kind of stuff isn't going to stop happening unless the act of finding and reporting a security vulnerability becomes legally protected behaviour.
The problem is the that would provide a legitimate cover story for black hats. "Oh I was just doing a white hat scan".
In the meantime, until we can make this understood, we need to make the workaround understood: if you find a security flaw in a system you don't own, and you haven't been formally hired for the specific purpose of finding that flaw, ignore it and get on with your life; it's not your problem. Going out of your way to help people in normal circumstances is noble. Going out of your way to help people who will reward you with a knife in the back is a mistake. Don't make that mistake.
I've said this before -- don't bother being a "white hat". The industry and the legal system doesn't have a pigeon hole for that. You'll be labeled as "hacker" (and not in a positive sense of it). Either disclose the vulnerability immediately to get recognition, hoping it is public enough they'll be ashamed of going after you, or or sell and profit from it. You are already treated as a criminal by these large institu…
> You are already treated as a criminal by these large institutions, so if you go in that direction might as well make some money. In the second scenario, you probably are hurting innocent people. So if you have a moral compass, you should maybe bother being an anonymous white hat.