Expelled from College for Reporting a Security Problem

[softwareFREEk]

Kid Got Expelled from College for Reporting a Security Problem to School Officials

No good deed, huh. A student from Dawson College in Montreal has been expelled for his involvement in the uncovering of a potentially horrible flaw in his school's online directories. Sounds dumb, right? Even worse: Everyone more or less agrees he meant no harm.

Here's what happened: Ahmed Al-Khabaz, a Computer Science student at Dawson, and a friend were working on a mobile app to allow students mobile access to their school data. In the process, they uncovered a pretty serious vulnerability ("sloppy coding") that would have put student information at risk. What kind of information? According to Al-Khabaz, "social insurance number, home address and phone number, class schedule, basically all the information the college has on a student."

So Al-Khabaz took the issue to the school's Director of Information Services and Technology. The meeting went well, and he was told that Skytech, that company that makes the software in question, would get right on it. After not hearing back for a few days, Al-Khabaz decided to check to see if the vulnerability had been patched, using a program called Acunetix. That was a mistake. He immediately received a call from the head of Skytech, saying this was the second time in a few days that he'd been spotted in their system, and this was a serious breach. The software he'd used to check up on the system could have caused serious problems, since it was used without prior notification to the system admin.

Al-Khabaz apologized, and eventually signed an NDA forbidding him from discussing the case, but that wasn't the end of it. Despite the Skytech people acknowledging that there was no malicious intent, Dawson's faculty held a vote on whether it should expel him for "unprofessional conduct." Al-Khabaz was not allowed to speak on his own behalf, and 14 of 15 professors voted to expel him—rendering his grades for the semester zeroes across the board. Two motions for appeal have been turned down.

So that's Al-Khabaz's situation right now: 20 years old, expelled from school with bottomed-out grades and a record of unprofessional conduct. All for trying to help, and bungling it a bit.

Read more

you gotta be kiddin right???


If you wanna help Ahmed, you can sign an online petition at the link below.
Help Hamed petition

 

[McLovin]

By the sounds of the name was not in a western country (not trying to have ago at others). If that happened here they would be thankful.

 

[Deleted member 178]

It was in Canada

 

[McLovin]

It was in Canada

Oh ha, well umm that is bad on their behalf. Geez, if a student came to be saying there was a hole in my system, I would be like:

Student: Sir. Sir. SIR! Hi, uhh, look umm there is a security hole in your computer system.
McLovin: lulwut? there is. Can you show it to me.
Student: sure thing bruv

That should be the end of it... not expelled.

 

[thecombo101]

Ack, this is kind of why I'm afraid to report problems if I do find any in our school computers. :s

 

[softwareFREEk]

It was in Canada

Oh ha, well umm that is bad on their behalf. Geez, if a student came to be saying there was a hole in my system, I would be like:

Student: Sir. Sir. SIR! Hi, uhh, look umm there is a security hole in your computer system.
McLovin: lulwut? there is. Can you show it to me.
Student: sure thing bruv

That should be the end of it... not expelled.

now ur just being modest MrIT Reviews :lol:

 

[Gnosis]

Those type of things are not supposed to happen up there; they have government healthcare.
Punishment for extracting colossal amounts of crude?? lol

Seriously though, universities have expelled students for far less. If he meant well maybe they should not have expelled him, but they are probably making an example of him so others won't feel free to hack school records no matter how good or bad their intent was.

It is kind of like the military; you get in trouble and you have to answer to the police, and then you have to answer to a tribunal and (or) your commander. Universities have ethics committees that will (and do) expel students for potential conflicts of interest, or seeds that they planted that might sprout into conflicts. There really has to be no laws broken or really even any campus rules broken. All that is required is a little controversy pertinent to your actions, seemingly well intended, or not.

Down here in the lower 48 we have the NCAA (which is a bad ethics joke). They exploit some of the best athletes in the world. They allow them to run around and knock the hell out of each other in stadiums and arenas, which makes the schools mega bucks via marketing revenue schemes. Then they turn around and slap the same athlete on the hands for so much as receiving 10 bucks from their aunt, or getting taken out to dinner by a friend. Their schools/NCAA does not even offer them gift cards for books and meals for their sacrifices. NCAA athletes abuse their bodies to make universities, and the NCAA filthy rich. Meanwhile, they are risking their health, thus earning ability at the next level in sports.

That is why those commentators call 'em "kids", not because a 20 year old is, but because "kids" just are not able (capable/allowed) to reap any rewards while making the universities millions (or tens of millions) of dollars each. Then the good players don't have to be expelled--They voluntarily LEAVE, and get paid the kind of money that the NCAA and their respective university used them for, like modern slaves on the campus plantation. Scholarships just don't cut it in that respect. You have many athletes riding the bench (no scholarships) that rarely play during games, but they are meat 5 days a week at football practice for the gifted scholarship players that are being exploited by the NCAA along with the bench warmers. And their coaches make millions and are allowed to date cheerleaders.

I would imagine it is quite possible that all universities have a "we can expel you at anytime for any reason" type of legal framework. They simply do as they please, like United States judges, with zero accountability. Then they punish ALL of the students and
ALL of the athletes for what one booster, three crooked coaches, and 3 or 4 players did, or did not do.

Based on that, it surprises me not one bit that a student attempting to help a school, and his fellow students, got expelled.
In all fairness, he should have spoken with an attorney before he breached the schools database, and definitely before he spoke with any of the university hierarchy about the incident and his intentions relative to it.

 

[WinAndLinuxTutorials]

I actually feel sad for him. They expelled him for a very stupid reason.

14/15 Professors were drunk.

 

[Plexx]

I Feel sorry for the student in a way, but then again there is always a 2nd side to the story.

For a school to expel based on simply first doing a favor but then "infiltrating" once again, well something ain't right here and I doubt it will ever come to light.

Why would you venture a second time to find out for yourself if a security hole has been fixed when there are other ways to find it out (i.e. query the relevant people). Don't people learn from other's mistakes?

 

[Littlebits]

tracy.cooperjr yesterday
Umm... He didn't get expelled for reporting the security flaw. He was expelled for running a security scan on their network to see if the flaw was fixed. I don't know of any university that would have allowed that. Random users running security scans to check for vulnerabilities is usually pretty frowned upon by any network administrator worth the name.
Also, title is misleading but I guess "Student expelled for running unauthorized security scan on university network" wouldn't have been quite as good for linkbait.

http://gizmodo.com/5977646/kid-got-expelled-from-college-for-reporting-a-security-problem-to-school-officials?post=56443712

I completely agree with this users commits.
He step over the line by doing something that he had no permission to do.
It was not his job to check to see if the vulnerabilities were fixed. By running an unauthorized security scan on university network is just like trying to illegally hack into it.

Thanks.

 

[McLovin]

http://gizmodo.com/5977646/kid-got-expelled-from-college-for-reporting-a-security-problem-to-school-officials?post=56443712

I completely agree with this users commits.
He step over the line by doing something that he had no permission to do.
It was not his job to check to see if the vulnerabilities were fixed. By running an unauthorized security scan on university network is just like trying to illegally hack into it.

Thanks.

That is true, but if he didn't go over it again, it still might have that vulnerability there. Some IT staff might say they will get round to it, but they end up not doing it at all.

 

[Gnosis]

Regardless, I am sure they have the right to expel him unless he plays the race or religion card.