6 ms·

What's the truth here? What did Hamed "do"? Exposing a security flaw doesn't get you expelled. He had to have taken it one or more steps too far. I'd like to s

What's the truth here? What did Hamed "do"? Exposing a security flaw doesn't get you expelled. He had to have taken it one or more steps too far. I'd like to see the facts.

namank 14y ago
http://news.ycombinator.com/item?id=5090007 http://news.ycombinator.com/item?id=5090007
thenicepostr 14y ago
Here's his expulsion letter, stating why he was expelled according to the school. http://www.documentcloud.org/documents/560325-al-khabaz-expulsion-revised.html#document/p1 http://www.documentcloud.org/documents/560325-al-khabaz-expu...
- mrtron 14y ago
  Translation: On Sept 21st our site was vulnerable to a simple SQL injection attack. On Sept 22nd you documented this information for us. On Oct 26th our site was STILL vulnerable to a simple SQL injection attack. On Oct 29th you again documented this information for us. On Nov 12th we expelled you for our discovering our abysmal security.
  - anonymouz 14y ago
    I advice everyone to read the original expulsion letter. It is just one page, and the parent's post completely (and I must assume intentionally) twists the facts as mentioned in the letter to make the student look better. In particular the letter claims that the student has in fact attempted to exploit the SQL injection to gain unauthorized access, and that both notifications to the IT department were made after they detected him and blocked his account.
    - noibl 14y ago
      Actually the letter says nothing about detection and all other sources[1][2] about this matter agree that the 'detection' took the form of a voluntary disclosure, which was rewarded with an NDA demand under threat of arrest. So it seems you are the one twisting the facts for reasons unknown. --- [1] "Al-Khabaz immediately alerted the head of information technology for the school about the breach in the Omnivox software used by the college. At first he was thanked for the discovery." -- http://www.thestar.com/news/article/1318163--montreal-student-expelled-for-finding-security-breach-in-school-portal http://www.thestar.com/news/article/1318163--montreal-studen... [2] "they discovered that by exchanging other student numbers in the encrypted links, they could easily obtain information such as the social insurance numbers, home addresses and phone numbers of more than 250,000 students. Al-Khabaz said he informed the school’s head of information technology immediately after discovering the vulnerability in the school’s Omnivox software and was congratulated for the discovery." -- http://www.cbc.ca/m/rich/canada/story/2013/01/21/montreal-dawson-college-hack-hamed-al-khabaz.html http://www.cbc.ca/m/rich/canada/story/2013/01/21/montreal-da...
      - anonymouz 14y ago
        Read point 2: "On September 21, the IT Policy was applied and your network and portal accesses were suspended." Read point 3: "On September 22, you admitted to these attacks in writing." Compare the dates. According to the letter, his disclosure came after the account was suspended. Implying that they did detect the attack before he admitted to it.
        noibl 14y ago
        An admission in writing is not the same thing as a disclosure. You're using uncorroborated dates in a document that's clearly worded to paint the student in the worst light possible to infer a 'detection' which it doesn't mention and for which there is no evidence. You're then sharing your inference as documented fact. That's a smear.
        anonymouz 14y ago
  - hso9791 14y ago
    What kind of IT Policy was applied? Was this automatic, did they detect the event before he alerted them, or did they do this after he had disclosed the vulnerability? The first application of the IT Policy is the interesting one here, as it lays the foundation for - or undermines Hamed's case as a white hat.
thefreeman 14y ago
http://news.ycombinator.com/item?id=5090007 http://news.ycombinator.com/item?id=5090007 A few days after reporting the flaw, he got caught using http://www.acunetix.com/ http://www.acunetix.com/ (web vulnerability scanner) on their network. He says he was checking to see if they fixed the flaw. I don't think he was intentionally being malicious, but his explanation doesn't jive with his actions. I still think it sucks that they expelled him. But I am unable to logically see how he didn't break the rules.
- AustinGibbons 14y ago
  I don't understand how using an external attack tool is grounds for anything. If Hamed could use it to search for exploits an attacker could have used it to search for exploits. Especially if a students' information had been previously exposed and the attacker had access to everyone's personal information / passwords! -- Edit : after reading his expulsion letter, it seems he supposedly injected SQL on both occasions. One imagines they strictly forbid him from doing so again. Sure, he probably should have asked for a sandbox system if he wanted to do ad hoc security research, but it is still quite a logical leap to actually expel him.
  - pprd 14y ago
    Either ways, the solution should be to fix the security system and reward the whistleblower. In a few years, we are going to have millions of teenagers with the competence and ability to pull of what Hamed did. What then?
    - loup-vaillant 14y ago
      Obviously those youngsters are all criminals that ought to be put to jail. We shall implement a zero-tolerance policy, just like the copyright industry did. </sarcasm> Nevertheless, I'm afraid they might do just that.
- jrogers65 14y ago
  > but his explanation doesn't jive with his actions. I think it's perfectly congruent. An entity has your data as well as information on many other people. You come across and report a vunerability. You check that something was done about it. I see no holes in this (aside from the ones in Montreal college's security).
JohnHaugeland 14y ago
> Exposing a security flaw doesn't get you expelled. Unless you're at a minor Canadian trade school which wants to bury that they knew about the security flaw for months and did nothing about it. . > He had to have taken it one or more steps too far. First he told them about it. Then he waited a couple months, and tested to see if it was still there, with some free online security scanner; it was. So he reported it again, and this time contacted the vendor. The school freaked out, decided that he was hacking them without permission, and expelled him over "code of conduct." They absolutely refuse to explain, though they keep pretending that there was a law broken. The student went to the RCMP; the RCMP disagrees. So does the original vendor, who has challenged the school, and given the kid a scholarship. http://www.cbc.ca/homerun/2013/01/21/dawson/ http://www.cbc.ca/homerun/2013/01/21/dawson/ This is just a terrible administrator doing new damage trying to bury his own failure.
- loup-vaillant 14y ago
  Damage control is often about redirecting the damage.

What's the truth here? What did Hamed "do"? Exposing a security flaw doesn't get you expelled. He had to have taken it one or more steps too far. I'd like to see the facts.

namank 14y ago

http://news.ycombinator.com/item?id=5090007 http://news.ycombinator.com/item?id=5090007

thenicepostr 14y ago

Here's his expulsion letter, stating why he was expelled according to the school. http://www.documentcloud.org/documents/560325-al-khabaz-expulsion-revised.html#document/p1 http://www.documentcloud.org/documents/560325-al-khabaz-expu...

mrtron 14y ago
Translation: On Sept 21st our site was vulnerable to a simple SQL injection attack. On Sept 22nd you documented this information for us. On Oct 26th our site was STILL vulnerable to a simple SQL injection attack. On Oct 29th you again documented this information for us. On Nov 12th we expelled you for our discovering our abysmal security.
- anonymouz 14y ago
  I advice everyone to read the original expulsion letter. It is just one page, and the parent's post completely (and I must assume intentionally) twists the facts as mentioned in the letter to make the student look better. In particular the letter claims that the student has in fact attempted to exploit the SQL injection to gain unauthorized access, and that both notifications to the IT department were made after they detected him and blocked his account.
  - noibl 14y ago
    Actually the letter says nothing about detection and all other sources[1][2] about this matter agree that the 'detection' took the form of a voluntary disclosure, which was rewarded with an NDA demand under threat of arrest. So it seems you are the one twisting the facts for reasons unknown. --- [1] "Al-Khabaz immediately alerted the head of information technology for the school about the breach in the Omnivox software used by the college. At first he was thanked for the discovery." -- http://www.thestar.com/news/article/1318163--montreal-student-expelled-for-finding-security-breach-in-school-portal http://www.thestar.com/news/article/1318163--montreal-studen... [2] "they discovered that by exchanging other student numbers in the encrypted links, they could easily obtain information such as the social insurance numbers, home addresses and phone numbers of more than 250,000 students. Al-Khabaz said he informed the school’s head of information technology immediately after discovering the vulnerability in the school’s Omnivox software and was congratulated for the discovery." -- http://www.cbc.ca/m/rich/canada/story/2013/01/21/montreal-dawson-college-hack-hamed-al-khabaz.html http://www.cbc.ca/m/rich/canada/story/2013/01/21/montreal-da...
    - anonymouz 14y ago
      Read point 2: "On September 21, the IT Policy was applied and your network and portal accesses were suspended." Read point 3: "On September 22, you admitted to these attacks in writing." Compare the dates. According to the letter, his disclosure came after the account was suspended. Implying that they did detect the attack before he admitted to it.
      - noibl 14y ago
        An admission in writing is not the same thing as a disclosure. You're using uncorroborated dates in a document that's clearly worded to paint the student in the worst light possible to infer a 'detection' which it doesn't mention and for which there is no evidence. You're then sharing your inference as documented fact. That's a smear.
        anonymouz 14y ago
- hso9791 14y ago
  What kind of IT Policy was applied? Was this automatic, did they detect the event before he alerted them, or did they do this after he had disclosed the vulnerability? The first application of the IT Policy is the interesting one here, as it lays the foundation for - or undermines Hamed's case as a white hat.

thefreeman 14y ago

http://news.ycombinator.com/item?id=5090007 http://news.ycombinator.com/item?id=5090007 A few days after reporting the flaw, he got caught using http://www.acunetix.com/ http://www.acunetix.com/ (web vulnerability scanner) on their network. He says he was checking to see if they fixed the flaw. I don't think he was intentionally being malicious, but his explanation doesn't jive with his actions. I still think it sucks that they expelled him. But I am unable to logically see how he didn't break the rules.

AustinGibbons 14y ago
I don't understand how using an external attack tool is grounds for anything. If Hamed could use it to search for exploits an attacker could have used it to search for exploits. Especially if a students' information had been previously exposed and the attacker had access to everyone's personal information / passwords! -- Edit : after reading his expulsion letter, it seems he supposedly injected SQL on both occasions. One imagines they strictly forbid him from doing so again. Sure, he probably should have asked for a sandbox system if he wanted to do ad hoc security research, but it is still quite a logical leap to actually expel him.
- pprd 14y ago
  Either ways, the solution should be to fix the security system and reward the whistleblower. In a few years, we are going to have millions of teenagers with the competence and ability to pull of what Hamed did. What then?
  - loup-vaillant 14y ago
    Obviously those youngsters are all criminals that ought to be put to jail. We shall implement a zero-tolerance policy, just like the copyright industry did. </sarcasm> Nevertheless, I'm afraid they might do just that.
jrogers65 14y ago
> but his explanation doesn't jive with his actions. I think it's perfectly congruent. An entity has your data as well as information on many other people. You come across and report a vunerability. You check that something was done about it. I see no holes in this (aside from the ones in Montreal college's security).

JohnHaugeland 14y ago

> Exposing a security flaw doesn't get you expelled. Unless you're at a minor Canadian trade school which wants to bury that they knew about the security flaw for months and did nothing about it. . > He had to have taken it one or more steps too far. First he told them about it. Then he waited a couple months, and tested to see if it was still there, with some free online security scanner; it was. So he reported it again, and this time contacted the vendor. The school freaked out, decided that he was hacking them without permission, and expelled him over "code of conduct." They absolutely refuse to explain, though they keep pretending that there was a law broken. The student went to the RCMP; the RCMP disagrees. So does the original vendor, who has challenged the school, and given the kid a scholarship. http://www.cbc.ca/homerun/2013/01/21/dawson/ http://www.cbc.ca/homerun/2013/01/21/dawson/ This is just a terrible administrator doing new damage trying to bury his own failure.

loup-vaillant 14y ago
Damage control is often about redirecting the damage.