6 ms·

Quebec boy, 12, pleads guilty to hacking government websites

21 points by bgtyhn 13y ago

InternalRun 13y ago
I always hate the comments on these type of articles. "the government should hire him before someone else gets him" In reply "you can be sure there is a line up already - this kid is a treasure"
- scotty79 13y ago
  Why you hate such comments?
Frozenlock 13y ago
Better title: "A 12 years old boy hacked your government websites. Lack of security is concerning." Seriously, security on governmental websites (in Canada and Québec) is terrible. I wouldn't be surprised if they stored password in plain text: they ask you to choose a shorter password if yours is too long.
- Frozenlock 13y ago
  Oh and they don't support Chrome, because 'it updates too fast'.
- iLoch 13y ago
  Ding ding ding. Visited the website for National Student Loans Services Centre and forgot my password. Email reset? Here's your password! No! Why?
  - redthrowaway 13y ago
    >No! Why? It was built by the co-op students who couldn't get placements anywhere else.
    - DonPellegrino 13y ago
      That's actually exactly what happens. Co-op programs are huge in Québec and that's a good thing. Government jobs usually pay 30-40% less and most of the time the less skilled students end up doing their co-op(s)/internship(s) there.
  - eigenvector 13y ago
    To be fair, the worst thing someone could do with your NSLSC password is pay off your student loan for you. ;)
- chimeracoder 13y ago
  > they ask you to choose a shorter password if yours is too long. Not unlike many US banks. Or even Canadian ones - TD Bank, IIRC, caps passwords at some ridiculously short length.
  - hdevalence 13y ago
    8 characters, letters + numbers.
- Elv13 13y ago
  Most of them don't have passwords, they are static pages created in Ms Word XP or FrontPage 97 (to this day). They are now getting "modern" with heavy PHP+Typo3, notice the '"'. Seriously, the requirement of some Qc government organization to make page editing compatible with Microsoft Word (forbid CSS, favor tables) mandatory is the dumbest IT rule I ever saw. PHP will, on the long run, create an even bigger mess than Ms Word. I hate to say that, but they should have gone with Java. The quality of most of their programmers leave to be desired, you can't expect forward thinking practices. Not saying entry level programmers are useless, but relying on them for code with 20+ years lifecycle is not an economical decision. *I never and will never work for them, but I came across some of their monstrosities as a consultant or over some (geek) beer talks (better than weather, at least funnier).
joelgrus 13y ago
It took me a minute to figure out what a "Que. boy" was.
Balgair 13y ago
Well, that's embarrassing.
avty 13y ago
We are all hackers now.
iLoch 13y ago
Probably the work of CGI Group! :) Not that I really want to bash my follow Canadian developers, but can we please get some experienced developers working on these sites?
teamonkey 13y ago
> Court heard the boy used three different computer attacks, one which resulted in a denial of service to those trying to access the websites and flooded servers, making them ineffective. > In another method he would alter information and make it appear as the homepage. > His third tactic involved exploiting security holes in order to access database servers. > "And he told others how to do it," a police expert testified in Montreal on Thursday. And now so has the Toronto Sun, because frankly, that's all the info a script kiddie will need, if they couldn't work it out themselves.
adamnemecek 13y ago
I'm curious how many 'hackers' actually wear a hoodie when 'hacking'.
- scotty79 13y ago
  The ones employed by corporation and sitting in open space office. Also headphones.
deletes 13y ago
How are they sure he wasn't just a pawn or a script kiddie. I say this because he pleaded guilty; was there some serious analysis done or did they just got his address?
simlevesque 13y ago
I have an uncle who works for a infosec company which has contracts with the provincial government. I know that internally, the police of the province (which is called the SQ) has no real power in terms of hacking investigation. It really is sad. They rely on gathering info from sources such as Facebook, that's how they got the kid. What this article does not say is that right now is his first court hearing but they had found his identity a couple of months ago. My uncle was at the press conference where they said that they had found him and after it was finished he asked one the police officer on the case how they had found him. He straight up told him that they found him because he talked about it to his friends on Facebook. If not for that, the kid would not have been caught. The alternative is to wait for him to commit a crime against the great US of A and have the FBI do the job. For the record, I'm a 20 year old guy from Quebec and I really wonder what I could have done if I tried my hands at it. I'm also glad I didn't.

21 points by bgtyhn 13y ago

I always hate the comments on these type of articles. "the government should hire him before someone else gets him" In reply "you can be sure there is a line up already - this kid is a treasure"

scotty79 13y ago
Why you hate such comments?

Frozenlock 13y ago

Better title: "A 12 years old boy hacked your government websites. Lack of security is concerning." Seriously, security on governmental websites (in Canada and Québec) is terrible. I wouldn't be surprised if they stored password in plain text: they ask you to choose a shorter password if yours is too long.

Frozenlock 13y ago
Oh and they don't support Chrome, because 'it updates too fast'.
iLoch 13y ago
Ding ding ding. Visited the website for National Student Loans Services Centre and forgot my password. Email reset? Here's your password! No! Why?
- redthrowaway 13y ago
  >No! Why? It was built by the co-op students who couldn't get placements anywhere else.
  - DonPellegrino 13y ago
    That's actually exactly what happens. Co-op programs are huge in Québec and that's a good thing. Government jobs usually pay 30-40% less and most of the time the less skilled students end up doing their co-op(s)/internship(s) there.
- eigenvector 13y ago
  To be fair, the worst thing someone could do with your NSLSC password is pay off your student loan for you. ;)
chimeracoder 13y ago
> they ask you to choose a shorter password if yours is too long. Not unlike many US banks. Or even Canadian ones - TD Bank, IIRC, caps passwords at some ridiculously short length.
- hdevalence 13y ago
  8 characters, letters + numbers.
Elv13 13y ago
Most of them don't have passwords, they are static pages created in Ms Word XP or FrontPage 97 (to this day). They are now getting "modern" with heavy PHP+Typo3, notice the '"'. Seriously, the requirement of some Qc government organization to make page editing compatible with Microsoft Word (forbid CSS, favor tables) mandatory is the dumbest IT rule I ever saw. PHP will, on the long run, create an even bigger mess than Ms Word. I hate to say that, but they should have gone with Java. The quality of most of their programmers leave to be desired, you can't expect forward thinking practices. Not saying entry level programmers are useless, but relying on them for code with 20+ years lifecycle is not an economical decision. *I never and will never work for them, but I came across some of their monstrosities as a consultant or over some (geek) beer talks (better than weather, at least funnier).

joelgrus 13y ago

It took me a minute to figure out what a "Que. boy" was.

Balgair 13y ago

Well, that's embarrassing.

avty 13y ago

We are all hackers now.

iLoch 13y ago

Probably the work of CGI Group! :) Not that I really want to bash my follow Canadian developers, but can we please get some experienced developers working on these sites?

teamonkey 13y ago

> Court heard the boy used three different computer attacks, one which resulted in a denial of service to those trying to access the websites and flooded servers, making them ineffective. > In another method he would alter information and make it appear as the homepage. > His third tactic involved exploiting security holes in order to access database servers. > "And he told others how to do it," a police expert testified in Montreal on Thursday. And now so has the Toronto Sun, because frankly, that's all the info a script kiddie will need, if they couldn't work it out themselves.

adamnemecek 13y ago

I'm curious how many 'hackers' actually wear a hoodie when 'hacking'.

scotty79 13y ago
The ones employed by corporation and sitting in open space office. Also headphones.

deletes 13y ago

How are they sure he wasn't just a pawn or a script kiddie. I say this because he pleaded guilty; was there some serious analysis done or did they just got his address?

simlevesque 13y ago

I have an uncle who works for a infosec company which has contracts with the provincial government. I know that internally, the police of the province (which is called the SQ) has no real power in terms of hacking investigation. It really is sad. They rely on gathering info from sources such as Facebook, that's how they got the kid. What this article does not say is that right now is his first court hearing but they had found his identity a couple of months ago. My uncle was at the press conference where they said that they had found him and after it was finished he asked one the police officer on the case how they had found him. He straight up told him that they found him because he talked about it to his friends on Facebook. If not for that, the kid would not have been caught. The alternative is to wait for him to commit a crime against the great US of A and have the FBI do the job. For the record, I'm a 20 year old guy from Quebec and I really wonder what I could have done if I tried my hands at it. I'm also glad I didn't.