Dawson expels whistle-blowing student

Posted By: Trudie Mason · 1/21/2013 9:44:00 AM

The student union at Dawson College is going to bat for a computer science student expelled after he alerted administrators to a security flaw in an important program.  

20-year old Hamed Al-Khabaz was a member of Dawson's software development club.  He was working on an app to give students easier access to their school account when he discovered a problem with a program used by many CEGEPS - a flaw that if exploited would have given hackers access to personal information on thousands of people.  

Al-Khabaz told Dawson about it, then tested the system a few days later to see whether the hole had been plugged.  It was the testing that got him expelled.  The company which designed the software said his check could have crashed the program.  

The student union says Dawson betrayed a brilliant student to protect the company which supplied the faulty software.  There's an online petition to help him out.

Dawson is standing by its decision to expel Al-Khabaz.

Leave a comment:

showing all comments · Subscribe to comments
  1. Eduardo Gonzalo Agurto Catalan posted on 01/21/2013 11:17 AM
    Thanks for relaying this information, it is highly appreciated. Attitudes like that seem certainly not to be pleasing both to average users as well as security experts. This seems to reveal "security by obscurity", a method proven to be the most ineffiscient and dangerous to approach IT security. The reason why you shall not hide a breach when it is discovered, or why you shall fix it quickly and only keep it confidential for the shortest time necessary is simply that someone ill-intentionned is highly likely to have found the same breach and may not be disclosing it, so you remain vulnerable by keeping an eye blind on it! Public scrutinity is generally accepted, in the industry and the academia, as the best way to secure and harden programming standards.
  2. RobBob posted on 01/21/2013 02:46 PM
    How did Edouard Taza, the president of Skytech (makers of OmniVox) know Hamed's home phone number as reported in the National Post story?

    It can only be assumed Mr. Taza used the information in OmniVox to do this which I'm sure is a breach and illegal use of the information stored on their servers. To be clear, OmniVox is a service and the software and data is stored not at the College but at the Vendor. Is SkyTech handling this information with proper care?

    Where is the Minister of Eduction Marie Malavoy on this issue? OmniVox is in almost every CEGEP in Quebec?

    The media and public have to keep the heat on Dawson and the government. They must be questioned on how seriously they take privacy.
  3. Charlene posted on 01/21/2013 05:15 PM
    I can't help but wonder....if this young man's name would have been perhaps
    more Canadian sounding, would the same chain of events have occurred.
    It's a fair question. Sounds to me like a bit of post 911 stereotyping.
    I want to be wrong.
showing all comments

News

You are seeing the 2 most recent blog posts.

Most Popular

News Videos

News Audio

Note about comments: Comments will not appear immediately after posting. Comments containing links or vulgar language and comments that are racist, sexist or offensive will not be approved.