Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Youth expelled from Montreal college after finding security flaw

news.nationalpost.com

Post reply on HN
Print view View original

41–50 of 308 posts

Re: Youth expelled from Montreal college after finding security flaw

#41

Post by doktrin »

droithomme wrote: post #29
herlifeinpixels wrote: post #19

What's upsetting is the 14/15 professors who voted him to be expelled. Do computer science professors not understand the concept of white-hat hacking? Shame on them. What message does this send to other students at Dawson? Don't be curious; don't go out of your way to do a favour for the safety of your peers; keep your mouth shut and we'll hand you your degree. Someone give him a scholarship to a legit university!

> Do computer science professors not understand the concept of white-hat hacking? Unfortunately, if they were at all competent they wouldn't be teaching at a place like that. CS programs at minor universities are notoriously poor and staffed by whoever they could get, and it's not going to be anyone that can make decent pay working on current technology.

Perhaps CS is an exception, but I was under the impression that jobs in academia (in general) were in woefully short supply.

While I'm sure they wouldn't get the cream of the crop, there's reportedly an excess of under-employed & under-paid PhD's and post-docs in a number of STEM fields (again, specifically in academia).

Re: Youth expelled from Montreal college after finding security flaw

#42

Post by tantalor »

securitywiz wrote: post #34

shall we all assume it was an sql injection? does anyone know what the actual vulnerability was?

Almost certainly a query parameter, since he was reverse engineering their API it would be obvious.

For it to be a SQL injection, he'd have to have been looking for vulnerabilities.

Re: Youth expelled from Montreal college after finding security flaw

#43

Post by jrockway »

tptacek wrote: post #22
jrockway wrote: post #9

I found something like this at my school. The administration reacted similarly. But fortunately, I was taking djb's Unix Security Holes at the time, and a harshly-worded note from djb to the Computer Center folks ended up getting me a thank you. Next semester, though, I refused to sign the new AUP (which included a clause allowing the computer center staff to seize any computer I was using, even at my off-campus home…

Did you pass that course?

I got a B. The homework was to find and write an exploit for 10 security holes in deployed software, but I only found 2. (3 including the one above, which I must have found the week or so after exams. The holes I found were in nasm and in some amateur open-source smtpd.)

FWIW, the exams are quite thought-provoking nearly 10 years later, here's a link to them: http://cr.yp.to/2004-494.html

Re: Youth expelled from Montreal college after finding security flaw

#45

Post by sudhirj »

Ahmed, if you're reading this, sorry about your college acting like idiots. If finishing college is important to you, I'm sorry they've made it so difficult.

That said, please don't think this is going to end your career. There are a lot of companies and startups that would love to have you for your kind of initiative. Not having a degree that you don't seem to need anyway will not be a sticking point with them. And the option of starting your own consultancy is a possibility - you already have some publicity that can help with initial gigs.

If you'd like to try your hand at a job, do check out ThoughtWorks (www.thoughtworks.com). We don't usually stand on ceremony or make a fuss about qualifications.

Re: Youth expelled from Montreal college after finding security flaw

#46

Post by namank »

securitywiz wrote: post #34

shall we all assume it was an sql injection? does anyone know what the actual vulnerability was?

Who knows but I'm bound to look the way of GET URLs given that they discovered it trying to make an app around an existing system.

API not validating correctly. If this is true, it will take a long time to fix.

Re: Youth expelled from Montreal college after finding security flaw

#47

Post by eduardogonzalo »

My name is Eduardo Gonzalo Agurto Catalan, I am an entrepreneur in the field of IT security and a digital rights activist. i would like tohave Ahmed Al-Khabaz's e-mail or other contact information in order to contact him and discuss how I and a few fellow experts could help him. We believe it is a great injstice and that the business community cannot stay passive towards this situation which we perceive as a kind of bullying. You can contact me : eduardogonzalo@hotmail.fr

Re: Youth expelled from Montreal college after finding security flaw

#48

Post by Gigablah »

dbbolton wrote: post #37

The title is misleading. He wasn't actually expelled for finding the flaw; he was expelled because, after reporting the flaw, he ran an exploit program on the school's server without permission, allegedly to see if it had been fixed. Had he only reported it, he would not have been subject to any disciplinary action.

So the fact that the submission title is misleading makes the university's heavy-handedness easier to swallow?

Re: Youth expelled from Montreal college after finding security flaw

#49

Post by jrockway »

monsterix wrote: post #28
jrockway wrote: post #9

I found something like this at my school. The administration reacted similarly. But fortunately, I was taking djb's Unix Security Holes at the time, and a harshly-worded note from djb to the Computer Center folks ended up getting me a thank you. Next semester, though, I refused to sign the new AUP (which included a clause allowing the computer center staff to seize any computer I was using, even at my off-campus home…

Reading stories/incidents like these makes me believe that education as a whole is stapled for reinvention. As they say: competition doesn't kill your business; attitude kills it.

Agreed. The vendor involved with the security problem was quite pleasant to deal with, of course. It was just the bureaucrats that were worried/afraid/stupid/whatever.

Re: Youth expelled from Montreal college after finding security flaw

#50

Post by wpietri »

tantalor wrote: post #35

> The agreement prevented Mr. Al-Kabaz from discussing... No, it didn't, because he was blackmailed into the NDA. It's completely unenforceable. It was signed under duress and only benefited one party.

You misunderstand the purpose of an agreement like that.

It's not like it magically binds your tongue. It just makes it easier to sue you if you violate it. The fact that the student could win in a suit is irrelevant. He couldn't afford the time and money to fight.

Before he signed the NDA, they would have had a harder time suing him. Perhaps he could have spent merely $10k and gotten it quickly dismissed. After, the company could make it arbitrarily expensive for him to fight it. If he could have eventually proved coercion (which I'm honestly skeptical of) then he would have been off the hook -- after years of stress and massive lawyer bills.

Post reply on HN