Exposing a security flaw doesn't get you expelled. He had to have taken it one or more steps too far. I'd like to see the facts.
A few days after reporting the flaw, he got caught using http://www.acunetix.com/ (web vulnerability scanner) on their network. He says he was checking to see if they fixed the flaw. I don't think he was intentionally being malicious, but his explanation doesn't jive with his actions.
I still think it sucks that they expelled him. But I am unable to logically see how he didn't break the rules.
Especially if a students' information had been previously exposed and the attacker had access to everyone's personal information / passwords!
-- Edit : after reading his expulsion letter, it seems he supposedly injected SQL on both occasions. One imagines they strictly forbid him from doing so again. Sure, he probably should have asked for a sandbox system if he wanted to do ad hoc security research, but it is still quite a logical leap to actually expel him.
I think it's perfectly congruent. An entity has your data as well as information on many other people. You come across and report a vunerability. You check that something was done about it. I see no holes in this (aside from the ones in Montreal college's security).
To be honest anyone using Acunetix isn't looking to hack into anything. It's an enterprise scanner that looks for general web app issues rather than something that's typically used to conduct actual attacks. You'd expect an actual attack to be conducted with a tool like Havij, Sqlmap, Burp or Zap proxy.
http://www.documentcloud.org/documents/560325-al-khabaz-expu...
On Sept 21st our site was vulnerable to a simple SQL injection attack. On Sept 22nd you documented this information for us.
On Oct 26th our site was STILL vulnerable to a simple SQL injection attack. On Oct 29th you again documented this information for us.
On Nov 12th we expelled you for our discovering our abysmal security.
Unless you're at a minor Canadian trade school which wants to bury that they knew about the security flaw for months and did nothing about it.
.
> He had to have taken it one or more steps too far.
First he told them about it.
Then he waited a couple months, and tested to see if it was still there, with some free online security scanner; it was.
So he reported it again, and this time contacted the vendor.
The school freaked out, decided that he was hacking them without permission, and expelled him over "code of conduct."
They absolutely refuse to explain, though they keep pretending that there was a law broken. The student went to the RCMP; the RCMP disagrees. So does the original vendor, who has challenged the school, and given the kid a scholarship.
http://www.cbc.ca/homerun/2013/01/21/dawson/
This is just a terrible administrator doing new damage trying to bury his own failure.
I've seen scholarships handed out over this. But you never hear about those, because nobody's angry.
Hiding responsible disclosure just means you aren't responsible.
His troubles began when he checked later if the security hole was still opened.
http://www.cbc.ca/news/canada/montreal/story/2013/01/21/mont...
In the meantime, their student body is furious that the staff have been knowingly leaving their private information public for months.
So I'd say "a lot."
The only one I've found so far is an audio interview with Mr. Filion; everything else has had the school refusing to comment.
Please provide links.
Marc Emery sold illegal goods internationally. The two situations have nothing to do with one another.
Before the web and the free dissemination of information it brought about, the average academician was more 'smarter' than the average student just by the fact that the students hadn't yet had access to the sources of information their teachers had.
However, we now live in times when you can expect anybody in the society to grow to their full potential, thanks to the free web.
This changes the fundamental role educational institutions has to play. They can't continue to be passive devices of information transmission. Yes, there are an elite bunch of institutions that provide more value than that. But as these events show, the educational sector around the world in general are mediocre and are pretty inefficient.
You now have smarter students and they don't need you to tell them what the world is about. That is the changed reality of the market and it is going to affect this sector for the better in the long run.
This is a trade school, not a college. It's like being angry at DeVry or University of Phoenix. The stupid things that places like that do have nothing to do with real universities.
The business people have decided that the security scanner is "a hacking tool" and that Ahmed needed permission from the school to see if the software that was imposed on him which was leaving his private data exposed after the staff knew was still broken.
The way Richard Filion, who runs the school, tries to make excuses around this is appalling.
http://www.cbc.ca/homerun/2013/01/21/dawson/
The software vendor gave the poor kid a scholarship and asked the school to change its mind.
http://www.cbc.ca/news/canada/montreal/story/2013/01/21/mont...
The RCMP declined to be involved.
The running excuse they're giving is "it was against our code of conduct." And, I mean, most schools don't even kick binge drinkers who got in an accident and nearly killed people out for code of conduct.
So clearly this isn't an excuse.
The people responsible for the decision are the head of the Computer Science department, Ken Fogel, and Dianne Gauvin, one of the deans. Predictably, they do not respond when contacted.
This is a computer science department where a panel of 14 out of 15 "professors" actually chose to stand behind this - though nobody will release their reasoning or names. So don't expect Ken Fogel to get it on grounds that you imagine he's one of us.
The school ombudsman, whose job it is to stand up for Ahmed, has been whitewashing its Facebook page of all criticism. The main school Facebook page is just ignoring the criticism instead; they post inbetween literally hundreds of people (including students and alums) to chat with people on posts from before this started getting public.
And, a reminder? They did this in November. They've been sitting on this for months. They aren't going to change their minds without a very good reason.
Not shockingly, other students have been posting reams of existing security holes on their various servers, and evidence of compromises that are claimed to be years old.
Staff is doing just as nothing about those as they did about this the first time Ahmed reported it.
Unless they can prove he had intent to cause damage, which it sounds like they could not do, they should just forgive and forget and stop trying to cover the overpaid butts of the sysadmin who didn't fix the hole in the first place.
Hell society forgave all the banks and wallstreet for their actual crimes.
