3 ms·

Being a "high school hacker" myself, I'd like to offer a slightly less dreary perspective. Some time back, I found multiple critical vulnerabilities in the mos

by dvdkon 7y ago

Being a "high school hacker" myself, I'd like to offer a slightly less dreary perspective. Some time back, I found multiple critical vulnerabilities in the most used school database system in the Czech Republic. The whole software is a mishmash of native Windows apps in Delphi and Visual FoxPro and an ASP.NET web interface built in a combination of VB, C# and WebForms. The desktop apps access MS SQL Server directly and security seems to have been done by a very uninformed person (the functionality is only a little better). I first told my school's network admin, who contacted the developers, who fixed the issues relatively quickly. Everything went relatively smoothly for me, but I know this depends mainly on the individual people involved.

rjzzleep 7y ago
When I was in high school my teacher actually proudly introduced me to the makers of the software they were using. They immediately dismissed it as known limitation not a bug. It allowed us to run arbitrary applications/code in their Kiosk application. In university where they still had HPUX I asked the IT department if I could get printer credits in exchange for exploits I report and he immediately got angry saying I should be proud to report them. Needless to say I ended up not reporting anything and just keeping them to myself. Thinking back I guess reporting it somewhere(maybe not in school) could have gotten me more opportunities, but who knows. I kinda wish there was some sort of mechanism to push people to make something out of their talents instead of suffocating them.
mieseratte 7y ago
I wasn't trying to be dreary so much as point out that entire school districts simply don't care about security one bit, even after being pwned. There's no incentive for one to give a damn, and we can't rely on good IT to be present in any given organization.

by dvdkon 7y ago

rjzzleep 7y ago

When I was in high school my teacher actually proudly introduced me to the makers of the software they were using. They immediately dismissed it as known limitation not a bug. It allowed us to run arbitrary applications/code in their Kiosk application. In university where they still had HPUX I asked the IT department if I could get printer credits in exchange for exploits I report and he immediately got angry saying I should be proud to report them. Needless to say I ended up not reporting anything and just keeping them to myself. Thinking back I guess reporting it somewhere(maybe not in school) could have gotten me more opportunities, but who knows. I kinda wish there was some sort of mechanism to push people to make something out of their talents instead of suffocating them.

mieseratte 7y ago

I wasn't trying to be dreary so much as point out that entire school districts simply don't care about security one bit, even after being pwned. There's no incentive for one to give a damn, and we can't rely on good IT to be present in any given organization.