Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Youth expelled from Montreal college after finding security flaw

news.nationalpost.com

Post reply on HN
Print view View original

81–90 of 308 posts

Re: Youth expelled from Montreal college after finding security flaw

#81

Post by aaron695 »

Am I the only one that sees that the title/headline is pretty close to a lie and that he ran a 'Web Vulnerability Scanner' on someone else's web site?

This is illegal! Most people seem to be missing this.

If you're going to break the law at your own University at least cover your tracks.

Don't annoy the crap out of them(Rightly or wrongly) then go on to black hat them.

Re: Youth expelled from Montreal college after finding security flaw

#82

Post by hn-miw-i »

securitywiz wrote: post #34

shall we all assume it was an sql injection? does anyone know what the actual vulnerability was?

It's likely to be an application logic authorization bug; the application doesn't check the context to see if it should return that info. Being web it's something silly like the student-id stored in the user cookie is used to to build the (parameterized) SQL statement. It's not arbitrary injection per say.

Re: Youth expelled from Montreal college after finding security flaw

#83

Post by kyllo »

Maybe consider punishing the negligence of the person who wrote the insecure code instead? But I don't think most people, especially lawmakers, even understand that security vulnerabilities are caused by flawed code, which is caused by human error. So they tend to shoot the messenger instead.

Re: Youth expelled from Montreal college after finding security flaw

#84

Post by plouvre »

Who in their right mind would think it's a good idea to use a penetration tool against their college?? The title is all wrong. He got expelled for using a penetration, not finding a flaw. He was congratulated for that! I heard someone else from the team even got some kind of prize for it.

Sensationalist journalism is what it is. After a little bit of research, I discovered it's written by someone who used to be in Dawson's Student Union, so I guess he has a teeth against the administration.

"Ethan Cox is a 28-year-old political organizer and writer from Montreal. He cut his political teeth accrediting the Dawson Student Union against ferocious opposition from the college administration and has worked as a union organizer for the Public Service Alliance of Canada."

Re: Youth expelled from Montreal college after finding security flaw

#85

Post by plouvre »

dbbolton wrote: post #37

The title is misleading. He wasn't actually expelled for finding the flaw; he was expelled because, after reporting the flaw, he ran an exploit program on the school's server without permission, allegedly to see if it had been fixed. Had he only reported it, he would not have been subject to any disciplinary action.

Well the article is basically written by the student union, so they try to get people on their side I imagine.

"Ethan Cox is a 28-year-old political organizer and writer from Montreal. He cut his political teeth accrediting the Dawson Student Union against ferocious opposition from the college administration and has worked as a union organizer for the Public Service Alliance of Canada."

Re: Youth expelled from Montreal college after finding security flaw

#86

Post by dutchbrit »

Reminds me of when I was a kiddo, I almost got expelled because I found a security issue in the schools network. I could access everyones files. They also didn't like it when I pointed out they were running cracked versions of Macromedia Flash on all their pc's. Let's just say, I'm glad I didn't get expelled. But I'm pretty sure they just saw me as an annoying fuck & that's all. I don't think they really cared, but were 'forced' to put time and effort making their network more secure.

Re: Youth expelled from Montreal college after finding security flaw

#87

Post by plouvre »

Dylan16807 wrote: post #76
dbbolton wrote: post #37

The title is misleading. He wasn't actually expelled for finding the flaw; he was expelled because, after reporting the flaw, he ran an exploit program on the school's server without permission, allegedly to see if it had been fixed. Had he only reported it, he would not have been subject to any disciplinary action.

He ran an exploit FINDER. He did not put exploit programs on the server.

You think that's not against the law?

ie: http://security.stackexchange.com/questions/14978/is-scannin...

Re: Youth expelled from Montreal college after finding security flaw

#88

Post by dagw »

rdtsc wrote: post #25

I've said this before -- don't bother being a "white hat". The industry and the legal system doesn't have a pigeon hole for that. You'll be labeled as "hacker" (and not in a positive sense of it). Either disclose the vulnerability immediately to get recognition, hoping it is public enough they'll be ashamed of going after you, or or sell and profit from it. You are already treated as a criminal by these large institu…

I'd revise that to don't be a hobbyist "white hat". If you want to do white hat hacking either get yourself hired by a serious security outfit or set yourself up as a company doing security consulting. On the whole people are far less likely to go after a genuine security company as opposed to 'just some kid in a basement'.
Post reply on HN