College Student Expelled for Uncovering Security Flaw

Ahmed Al-Khabaz came across a vulnerability that exposed students' Social Insurance Numbers, class schedules, home addresses and phone numbers. The National Post's Ethan Cox reports that Ahmed Al-Khabaz, a 20-year-old computer science student at Montreal's Dawson College, was expelled following his discovery of a security flaw that exposed more than 250,000 Quebec college students' personal information.

"Al-Khabaz ... was working on a mobile app to allow students easier access to their college account when he and a colleague discovered what he describes as 'sloppy coding' in the widely used Omnivox software which would allow 'anyone with a basic knowledge of computers to gain access to the personal information of any student in the system, including social insurance number, home address and phone number, class schedule, basically all the information the college has on a student,'" Cox writes.

"So Al-Khabaz took the issue to the school's Director of Information Services and Technology," writes Gizmodo's Kyle Wagner. "The meeting went well, and he was told that Skytech, that company that makes the software in question, would get right on it. After not hearing back for a few days, Al-Khabaz decided to check to see if the vulnerability had been patched, using a program called Acunetix. That was a mistake."

"Shortly after, he was contacted by the president of Skytech who accused him of launching a cyberattack against the company," writes Softpedia's Eduard Kovacs. "Skytech told the student that he could go to jail, unless he signed a non-disclosure agreement. The student agreed to sign the non-disclosure agreement, but his problems were far from being over."

"While Skytech saw the probe by Al-Khabaz as the mistake of an overeager student, Dawson College administrators decided to take disciplinary action," writes Ars Technica's Sean Gallagher. "After he was interviewed by the dean of Dawson and his Computer Science program coordinator, the details were brought to a meeting of 15 professors in the school's Computer Science department. By a 14-to-1 vote, they moved to expel him."

RATs - Remote Access Trojans

RATs - Remote Access Trojans - are often used by cyber attackers to maintain a foothold in the infected computers and make them do things unbeknownst to their owners. But, in order to do that and not be spotted, RATs must employ a series of obfuscation techniques.

Take for example the FAKEM RAT variants recently analyzed by Trend Micro researchers: in order to blend in, some try to make their network traffic look like Windows Messenger and Yahoo! Messenger traffic, and others as HTML. Usually delivered via spear phishing emails, once executed the malware copies itself using the into the %System% folder. When contacting and sending information to remote servers, the malicious traffic begins with headers similar to actual Windows Messenger and Yahoo! Messenger traffic. But checking the traffic after it clearly shows its malicious nature.

The communication between the compromised computer and the RAT's controller is also encrypted. The RAT starts with sending out information about the compromised system, and can receive simple codes and commands that make it do things like execute code, go to sleep, execute shell commands, allows the attacker to browse directories, access saved passwords, and more. "Now that popular RATs like Gh0st and PoisonIvy have become well-known and can easily be detected, attackers are looking for methods to blend in with legitimate traffic," the researchers noted .

"While it is possible to distinguish the network traffic FAKEM RAT variants produce for the legitimate protocols they aim to spoof, doing so in the context of a large network may not be not easy. The RAT’s ability to mask the traffic it produces may be enough to provide attackers enough cover to survive longer in a compromised environment."