Canadian student hacker expelled

kuwisdelu · Jan 21, 2013

Canadian student expelled for playing security “white hat”

A 20-year-old Canadian computer science student has become, depending on your point of view, a martyr for computer security or a cautionary tale for students and others who take an interest in exposing security flaws in software products. While Ahmed Al-Khabaz said he felt he had a "moral duty" to probe the security of a student information system used by over 250,000 students, the school's administration said his acts were a "serious professional conduct issue" and expelled him. Now, fellow students are demanding his reinstatement, and the college and its software provider are facing a publicity and security backlash.

Al-Khabaz and another student reported finding a security flaw in the mobile application for Omnivox, a Web-based software package developed by Montreal-based Skytech Communications that is used by students to access and manage their personal information and college services—including their Social Insurance numbers, the Canadian equivalent of US Social Security numbers.

I guess being a white hat doesn't make you the good guy anymore?

A lesson to hackers out there: administration would rather not know about their vulnerabilities than be informed by you, so don't try to help them.

Opty · Jan 21, 2013

Well, it's certainly a lesson in "do the ends justify the means?" While he may have done what he did with the noblest of intentions, anyone could do the same but with malicious intent and, when caught, claim that they were also trying to "help."

It would be naive for any organization to not take action. They seem to have let it slide the first time but then he did it again. That doesn't look good at all, no ,after what the kid is claiming. Fool me once, shame on you. Fool me twice...

This kid may have thought he was being noble but his approach was pretty stupid, IMO.

kuwisdelu · Jan 21, 2013

Opty said:
Well, it's certainly a lesson in "do the ends justify the means?" While he may have done what he did with the noblest of intentions, anyone could do the same but with malicious intent and, when caught, claim that they were also trying to "help."

It would be naive for any organization to not take action. They seem to have let it slide the first time but then he did it again. That doesn't look good at all, no ,after what the kid is claiming. Fool me once, shame on you. Fool me twice...

This kid may have thought he was being noble but his approach was pretty stupid, IMO.

It certainly might have been a mistake, but it certainly doesn't seem grounds for expulsion to me.

Anyone with malicious intent wouldn't have taken such an obvious, easy-to-detect approach.

benbradley · Jan 21, 2013

kuwisdelu said:
Canadian student expelled for playing security “white hat”

I guess being a white hat doesn't make you the good guy anymore?

A lesson to hackers out there: administration would rather not know about their vulnerabilities than be informed by you, so don't try to help them.

Let me guess where this was going...

Al-Khabaz claimed that Taza threatened prosecution if he did not meet with him and sign a nondisclosure agreement.

Is there a recording of this? What about the IT director saying "it would be fixed immediately?" Making such recordings itself might be illegal, but if they exist, ...

Taza confirmed the conversation to the Post but denied he made threats; Skytech executives did not respond to Ars' request for comments.

Just as I thought. The problem was the potential PUBLICIZING of a security problem (that didn't actually get fixed immediately, as the IT director said it would). I might have asked the IT director [okay, all of this is in hindsight, but the next time I'm in college and I'm poking around on the system holding student records...] "So you don't have a problem with me checking again in a few days to be sure it's fixed?"

If the administration had succeeded in shutting him up, would that make it "security by obscurity?" (and yes, that is a weak, bad, and not-recommended type of "security")

The deal is, you don't embarrass such an entity (whether it's a college administration or a business), but maybe if you play your cards right you can get a good job out of it.

kuwisdelu · Jan 21, 2013

But embarrassing them is the fun part!

...even white hats need some lulz......

shadowwalker · Jan 21, 2013

I suppose people would be upset if a bank clerk got fired for staging a robbery, cos, y'know, he wanted to make sure the bank was secure...

Maxinquaye · Jan 21, 2013

shadowwalker said:
I suppose people would be upset if a bank clerk got fired for staging a robbery, cos, y'know, he wanted to make sure the bank was secure...

I suppose the administration should have shot the student, because if you shoot the student, there's no need to worry about security leaks, and the student was obviously horrible anyway.

Gynn · Jan 21, 2013

I wonder if he could have documented his concerns for the security and presented them to the school rather than actually hacking into the system.

cbenoi1 · Jan 21, 2013

> But embarrassing them is the fun part!

I don't see where the fun is when someone cracks-open a system containing personal information and then goes public about it.

-cb

kuwisdelu · Jan 21, 2013

cbenoi1 said:
> But embarrassing them is the fun part!

I don't see where the fun is when someone cracks-open a system containing personal information and then goes public about it.

-cb

That's not the embarrassing part, silly.

Williebee · Jan 21, 2013

From the article:

When Al-Khabaz and fellow student Ovidiu Mija reported the problem to the school's director of Information Services and Technology, they were initially congratulated for finding the flaw and were told it would be fixed immediately. But it was Al-Khabaz' next step that landed him in trouble with the school. Two days later, he decided to check to see if the flaw had indeed been fixed, using a site security scanning tool called Acunetix.

"Hey, you gotta security hole. It's right here!"

"That sucks, thanks for telling us. We'll get it fixed immediately."

Now, "immediately" when dealing with a third party vendor's software usually means reporting it at the earliest possible moment (which depends on whether the college had 24/7 support for the software or 8/5, for example) and then staying on them to make sure it gets fixed.

Two days later Al-Khabaz decided to threat scan it again. He didn't call or email and say "Hey, you ready for me to test this again?" or even "Hey, I'm gonna double check this for ya'!" And, we don't know whether he scanned the vulnerability or, as indicated in the article, took advantage of the tool's capability to scan everything.

"Hey, your office was unlocked so I went in and hung out for awhile. You got a lot of stuff about people in there."

"Ok, thanks for letting me know."

"Hey, your office was unlocked again so I went in and hung out some more. You've got a lot of stuff about people in there."

A "martyr" ? -- not so much.

benbradley · Jan 21, 2013

kuwisdelu said:
But embarrassing them is the fun part!

...even white hats need some lulz......

It's all fun and games until someone pokes an eye out. Going public is "poking an eye out" of the administration.

Gynn said:
I wonder if he could have documented his concerns for the security and presented them to the school rather than actually hacking into the system.

It's the kind of thing where you have to do it (and it's cracking, but that's another rant) to find out if it's vulnerable, much like to see if a door is locked you have to turn the knob and push and see if it opens.

kuwisdelu said:
That's not the embarrassing part, silly.

Then what is?

kuwisdelu · Jan 21, 2013

benbradley said:
Then what is?

That they had a vulnerability and he showed it to them?

blacbird · Jan 21, 2013

I think Williebee has summed it up pretty well. This was a stupid maneuver on the part of an otherwise very smart student. But you don't notice a flawed lock on the back door of a business, enter surreptitiously and take some cash to prove you did it, then walk back into the business the next day to return the cash and claim your moral superiority for exposing to them their security problem. You can't ride off on a bicycle left unattended in somebody's yard just to prove they shouldn't do that, even if you return it and tell them so. At least I wouldn't recommend trying such things. There were other and better means of dealing with this situation.

The school expelled him, which is perfectly within their rights. They didn't pursue a legal case against him. The idea that just because you are clever enough to outwit some clumsiness in another person's computer security doesn't mean you have the right to do so. This principle seems oddly lost on a disturbing percentage of the younger spectrum of savvy computer geekies.

caw

kuwisdelu · Jan 21, 2013

I can see why scanning it afterward might have been a mistake, but are you saying he should not have been looking for vulnerabilities in the first place?

Xelebes · Jan 21, 2013

Williebee said:
From the article:

"Hey, you gotta security hole. It's right here!"

"That sucks, thanks for telling us. We'll get it fixed immediately."

Now, "immediately" when dealing with a third party vendor's software usually means reporting it at the earliest possible moment (which depends on whether the college had 24/7 support for the software or 8/5, for example) and then staying on them to make sure it gets fixed.

Two days later Al-Khabaz decided to threat scan it again. He didn't call or email and say "Hey, you ready for me to test this again?" or even "Hey, I'm gonna double check this for ya'!" And, we don't know whether he scanned the vulnerability or, as indicated in the article, took advantage of the tool's capability to scan everything.

"Hey, your office was unlocked so I went in and hung out for awhile. You got a lot of stuff about people in there."

"Ok, thanks for letting me know."

"Hey, your office was unlocked again so I went in and hung out some more. You've got a lot of stuff about people in there."

A "martyr" ? -- not so much.

Yep, quite the lack of professionalism or display of ethical behaviour there. If you plan to double check at a later time, make sure you disclose it.

Williebee · Jan 21, 2013

kuwisdelu said:
I can see why scanning it afterward might have been a mistake, but are you saying he should not have been looking for vulnerabilities in the first place?

I'm certainly not saying it. For all we know he was test driving software, pointed at the first thing that came up on his screen, and found the hole.

Was it one of my networks, I'd have brought the guy in and said, "Ok, let's fix it. Document how you found it and what you did and we'll get started." (The more documentation I can put together, the bigger stick I have to "whack" the vendor with -- that is, the more I can motivate them to fix it.)

Of course we also don't know what else there may be to the story.

Celia Cyanide · Jan 21, 2013

kuwisdelu said:
I can see why scanning it afterward might have been a mistake, but are you saying he should not have been looking for vulnerabilities in the first place?

From what I see in this thread, I don't think anybody is saying that, no.

RichardGarfinkle · Jan 21, 2013

Security holes in campus networks don't get fixed that fast. The systems can have so many interacting pieces of sotware in use for so many different reasons, and approval to change things may need to come from so many different sources that it's simply not possible to change things instantly.

I sympathize with the student. When a programmer finds a bug, the immediate response is to root it out and fix it. But a system like that is not like one person's software. It's a mass of interacting programs, priorities, and politics. IT can't change things instantly even when they need to and know they need to.

cbenoi1 · Jan 22, 2013

There was an article in LaPresse this morning about the case. The student was developing a mobile application for students when he came across a way to get far more data than what the system allowed. The student met the IT director to explain his discovery. Then Dawson warned the student not to tamper with the college computer systems again or face expulsion.

That was supposed to be the end of it - thanks, we'll take it from here, and don't do this again.

Then he did it again two days later... this time with software that could do some serious damage to Omnivox's servers.

Dawson expelled him, as per the previous warning.

-cb

ETA: http://www.lapresse.ca/actualites/q...yberpresse_BO2_quebec_canada_178_accueil_POS3

robeiae · Jan 22, 2013

Williebee said:
A "martyr" ? -- not so much.

Agree.

Celia Cyanide · Jan 22, 2013

RichardGarfinkle said:
Security holes in campus networks don't get fixed that fast. The systems can have so many interacting pieces of sotware in use for so many different reasons, and approval to change things may need to come from so many different sources that it's simply not possible to change things instantly.

I sympathize with the student. When a programmer finds a bug, the immediate response is to root it out and fix it. But a system like that is not like one person's software. It's a mass of interacting programs, priorities, and politics. IT can't change things instantly even when they need to and know they need to.

That's kind of what I thought....two days? Give them a break.

Torgo · Jan 22, 2013

What I don't get is why this would have gone away if he'd signed the NDA.

If he gets told 'don't scan us again' or he damages the network using the scan, those seem like legit grievances, especially as he only waited a couple of days and didn't give any warning. But it appears that those issues aren't as important as publicising the flaws in the system.

My hackles instinctively rise in situations where actual security holes and cracking are seen as a lower priority than keeping stuff out of the papers (because there's an inglorious history of white-hat hackers being persecuted for trying to help out.)

Williebee · Jan 22, 2013

Torgo said:
What I don't get is why this would have gone away if he'd signed the NDA.

If he gets told 'don't scan us again' or he damages the network using the scan, those seem like legit grievances, especially as he only waited a couple of days and didn't give any warning. But it appears that those issues aren't as important as publicising the flaws in the system.

My hackles instinctively rise in situations where actual security holes and cracking are seen as a lower priority than keeping stuff out of the papers (because there's an inglorious history of white-hat hackers being persecuted for trying to help out.)

Also true, however, the NDA isn't just about trying to avoid PR problems created by complaining about it in the campus coffee shop. Mention what you've found on a message board and the world knows about it -- from the hacker kid down the street to the guys running 'bot nets across the planet -- to Anonymous.

Torgo · Jan 22, 2013

Williebee said:
Also true, however, the NDA isn't just about creating PR problems by complaining about it in the campus coffee shop. Mention what you've found on a message board and the world knows about it -- from the hacker kid down the street to the guys running 'bot nets across the planet -- to Anonymous.

Sure, and there are ways to deal with that beyond forcing an NDA. Hackers, white-hat or black-hat, and rightly or wrongly, don't like being told what they can and can't do with information. The best way to ensure this security hole would be publicized is to make it into a huge deal involving confidentiality agreements and threats and expulsion.

I'd just have told the kid that the security hole was being fixed, tell him what the timescale is, and that he should under no circumstances scan the network again, for a variety of good technical reasons. This kind of person just wants to be a hero. The alternative is 'martyr' and that's no good for anyone.

Canadian student hacker expelled

Revolutionize the World

Revolutionize the World

It's a doggy dog world

Revolutionize the World

empty-nester!

That cheeky buggerer

Wandering worlds

Revolutionize the World

Capeless, wingless, & yet I fly.

It's a doggy dog world

Revolutionize the World

Revolutionize the World

Delerium ex Ennui

Capeless, wingless, & yet I fly.

Joker Groupie

Nurture Phoenixes

Touch and go

Joker Groupie

Formerly Phantom of Krankor.

Capeless, wingless, & yet I fly.

Formerly Phantom of Krankor.