Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Youth expelled from Montreal college after finding security flaw

news.nationalpost.com

Post reply on HN
Print view View original

61–70 of 308 posts

Re: Youth expelled from Montreal college after finding security flaw

#62

Post by nwh »

tantalor wrote: post #42
securitywiz wrote: post #34

shall we all assume it was an sql injection? does anyone know what the actual vulnerability was?

Almost certainly a query parameter, since he was reverse engineering their API it would be obvious. For it to be a SQL injection, he'd have to have been looking for vulnerabilities.

While it's probable he found some issue with permissions in the queries, stumbling on SQL injection is easier than you'd think. For a very short period I used a completely random (any ASCII character) password generator for websites, but I quickly realised that the ' and " characters were breaking the vast majority of sites I logged in to. Plaintext passwords in a database without escaping; about the worst password storage you can get.

Re: Youth expelled from Montreal college after finding security flaw

#63

Post by bstar77 »

I dealt with a situation at a college internship. The company was designing a marketing campaign for Nokia, but we were having major problems with the firewall software, which made for a very flaky Internet connection.

Long story short, my manager disabled the firewall and we were hacked that night. I was let go the following day unceremoniously. I discovered soon after that the company blamed me for the attack, saying I turned the firewall off and hacked the servers myself.

The school immediately started expulsion proceedings without even contacting me. Fortunately, my advisor personally addressed the issue and had everything dropped. The drama only lasted a few days, but the schools brain dead response to the issue gave me zero confidence in their ability to review anything objectively. I was so disgusted I refused to walk in the graduation ceremony, much to my parents disappointment.

Re: Youth expelled from Montreal college after finding security flaw

#65

Post by eru »

guard-of-terra wrote: post #30
rdtsc wrote: post #25

I've said this before -- don't bother being a "white hat". The industry and the legal system doesn't have a pigeon hole for that. You'll be labeled as "hacker" (and not in a positive sense of it). Either disclose the vulnerability immediately to get recognition, hoping it is public enough they'll be ashamed of going after you, or or sell and profit from it. You are already treated as a criminal by these large institu…

You can also pastebin it. That's what you should do.

Perhaps from a tor connection?

Re: Youth expelled from Montreal college after finding security flaw

#66

Post by eru »

mathrawka wrote: post #36

Back in 1999 when I was a freshman in university, my school had a server for students to host their websites on and use Pine for email. The server did not give shell access... but then there was a security hole in Pine that would allow you to run chsh. So I did that, and got shell access. I think the worst thing I did (other than running ls in a few directories) was use it to connect to IRC. Since I wasn't really try…

Was MAC spoofing not doable in 1999?

Re: Youth expelled from Montreal college after finding security flaw

#67

Post by vertis »

sudhirj wrote: post #45

Ahmed, if you're reading this, sorry about your college acting like idiots. If finishing college is important to you, I'm sorry they've made it so difficult. That said, please don't think this is going to end your career. There are a lot of companies and startups that would love to have you for your kind of initiative. Not having a degree that you don't seem to need anyway will not be a sticking point with them. And…

I have to second this. Start sending your resume out and include a link to the story.

We're a little far away (Australia), but otherwise you'd get in the door for an interview at the very least.

Re: Youth expelled from Montreal college after finding security flaw

#68

Post by eru »

kennywinker wrote: post #7

There really needs to be legal protection for acts of white-hat hacking like this. Both protection from prosecution, and protection from reprisal. This kind of stuff isn't going to stop happening unless the act of finding and reporting a security vulnerability becomes legally protected behaviour.

Perhaps the existing whistleblower protection could be used here?
Post reply on HN