Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Youth expelled from Montreal college after finding security flaw

news.nationalpost.com

Post reply on HN
Print view View original

31–40 of 308 posts

Re: Youth expelled from Montreal college after finding security flaw

#31

Post by gpcz »

rdtsc wrote: post #25

I've said this before -- don't bother being a "white hat". The industry and the legal system doesn't have a pigeon hole for that. You'll be labeled as "hacker" (and not in a positive sense of it). Either disclose the vulnerability immediately to get recognition, hoping it is public enough they'll be ashamed of going after you, or or sell and profit from it. You are already treated as a criminal by these large institu…

During undergrad I discovered the university's blackboard-like site sent plaintext passwords over http, and the majority of its use was over wireless. I went to the IT office responsible for the site, told them about it, and refused to give my name when they asked. After reading some of the horror stories on this page, I feel really lucky that the IT department didn't go further to figure out who I was and get me in trouble. End result was that quickly afterward their site forced https on you...

Re: Youth expelled from Montreal college after finding security flaw

#32

Post by herethis »

droithomme wrote: post #29
herlifeinpixels wrote: post #19

What's upsetting is the 14/15 professors who voted him to be expelled. Do computer science professors not understand the concept of white-hat hacking? Shame on them. What message does this send to other students at Dawson? Don't be curious; don't go out of your way to do a favour for the safety of your peers; keep your mouth shut and we'll hand you your degree. Someone give him a scholarship to a legit university!

> Do computer science professors not understand the concept of white-hat hacking? Unfortunately, if they were at all competent they wouldn't be teaching at a place like that. CS programs at minor universities are notoriously poor and staffed by whoever they could get, and it's not going to be anyone that can make decent pay working on current technology.

Dawson isn't a university. Its a CEGEP. In Quebec high school only goes until grade 11, after which most students do 2 years at a CEGEP before going on to university. It replaces Grade 12 and first year of university.

http://en.wikipedia.org/wiki/CEGEP

Re: Youth expelled from Montreal college after finding security flaw

#36

Post by mathrawka »

Back in 1999 when I was a freshman in university, my school had a server for students to host their websites on and use Pine for email. The server did not give shell access... but then there was a security hole in Pine that would allow you to run chsh. So I did that, and got shell access. I think the worst thing I did (other than running ls in a few directories) was use it to connect to IRC.

Since I wasn't really trying to hide anything, so one of the IT guys must have seen me with shell access and reported me. My punishment was having my ethernet turned off in my dorm room (even though the incident occurred in a computer lab while the dorm's ethernet was turned not ready for use yet). I appealed the decision and met with the Dean, and she said I was considered a threat to the school so I should be happy that my punishment wasn't worse.

Anyways, the rest of the year in the dorm was spent playing a cat and mouse game. I used my computer on my roommate's LAN port, so they ended up shutting off his ethernet as well.. I felt bad about that, especially since they refused to give him internet access for the rest of the year. So I ended up making a 50 foot ethernet cable and running it through the bathroom into another person's room (Two 2-person dorm rooms were connected by a common bathroom). That got shut off, so I bought a new LAN card (to get a new MAC address) and connected to another ethernet drop. I was able to get online for the rest of the year, but that sure left a sour taste in my mouth for my school.

Edit: I remember one close call... over a break (I was one of the few people in the dorm), water came out of the shower drain and flooded our rooms. I came back from spending the day out to see the Dean going into our room to inspect the damage, and I quickly had to hide my 50 foot cable that went through the bathroom.

Re: Youth expelled from Montreal college after finding security flaw

#37

Post by dbbolton »

The title is misleading. He wasn't actually expelled for finding the flaw; he was expelled because, after reporting the flaw, he ran an exploit program on the school's server without permission, allegedly to see if it had been fixed. Had he only reported it, he would not have been subject to any disciplinary action.

Re: Youth expelled from Montreal college after finding security flaw

#39

Post by chii »

kirillzubovsky wrote: post #8

I love the part of the story where the guy naively assumed that it would take his school less than two days to fix the vulnerability. In reality, would probably take them months. How long did it take sony to fix their issues? Oh, right, it took someone to explose it publicly. Heh. It's unfortunate how broken some IT organizations are and that they would rather kill the messenger than fix things.

its apathy. The people "responsible" for the service don't actually care, and perhaps probably won't be punished for teh failure of the service. Hence, the vulnerability (and the publicity) only makes more work for them - therefore, they shoot the messenger as a form of blame/revenge.
Post reply on HN