Quebec boy, 12, pleads guilty to hacking government websites | Hacker News Reader

Quebec boy, 12, pleads guilty to hacking government websites

torontosun.com

21 pointsbgtyhn20 comments

Better title: "A 12 years old boy hacked your government websites. Lack of security is concerning."

Seriously, security on governmental websites (in Canada and Québec) is terrible.

I wouldn't be surprised if they stored password in plain text: they ask you to choose a shorter password if yours is too long.

Oh and they don't support Chrome, because 'it updates too fast'.

Ding ding ding. Visited the website for National Student Loans Services Centre and forgot my password. Email reset? Here's your password!

No! Why?

>No! Why?

It was built by the co-op students who couldn't get placements anywhere else.

That's actually exactly what happens. Co-op programs are huge in Québec and that's a good thing. Government jobs usually pay 30-40% less and most of the time the less skilled students end up doing their co-op(s)/internship(s) there.

To be fair, the worst thing someone could do with your NSLSC password is pay off your student loan for you. ;)

> they ask you to choose a shorter password if yours is too long.

Not unlike many US banks.

Or even Canadian ones - TD Bank, IIRC, caps passwords at some ridiculously short length.

8 characters, letters + numbers.

Most of them don't have passwords, they are static pages created in Ms Word XP or FrontPage 97 (to this day). They are now getting "modern" with heavy PHP+Typo3, notice the '"'. Seriously, the requirement of some Qc government organization to make page editing compatible with Microsoft Word (forbid CSS, favor tables) mandatory is the dumbest IT rule I ever saw. PHP will, on the long run, create an even bigger mess than Ms Word. I hate to say that, but they should have gone with Java. The quality of most of their programmers leave to be desired, you can't expect forward thinking practices. Not saying entry level programmers are useless, but relying on them for code with 20+ years lifecycle is not an economical decision.

*I never and will never work for them, but I came across some of their monstrosities as a consultant or over some (geek) beer talks (better than weather, at least funnier).

> Court heard the boy used three different computer attacks, one which resulted in a denial of service to those trying to access the websites and flooded servers, making them ineffective.

> In another method he would alter information and make it appear as the homepage.

> His third tactic involved exploiting security holes in order to access database servers.

> "And he told others how to do it," a police expert testified in Montreal on Thursday.

And now so has the Toronto Sun, because frankly, that's all the info a script kiddie will need, if they couldn't work it out themselves.

I have an uncle who works for a infosec company which has contracts with the provincial government. I know that internally, the police of the province (which is called the SQ) has no real power in terms of hacking investigation. It really is sad. They rely on gathering info from sources such as Facebook, that's how they got the kid.

What this article does not say is that right now is his first court hearing but they had found his identity a couple of months ago. My uncle was at the press conference where they said that they had found him and after it was finished he asked one the police officer on the case how they had found him. He straight up told him that they found him because he talked about it to his friends on Facebook. If not for that, the kid would not have been caught. The alternative is to wait for him to commit a crime against the great US of A and have the FBI do the job.

For the record, I'm a 20 year old guy from Quebec and I really wonder what I could have done if I tried my hands at it. I'm also glad I didn't.

I always hate the comments on these type of articles.

"the government should hire him before someone else gets him"

In reply

"you can be sure there is a line up already - this kid is a treasure"

Why you hate such comments?

Probably the work of CGI Group! :) Not that I really want to bash my follow Canadian developers, but can we please get some experienced developers working on these sites?

How are they sure he wasn't just a pawn or a script kiddie. I say this because he pleaded guilty; was there some serious analysis done or did they just got his address?

I'm curious how many 'hackers' actually wear a hoodie when 'hacking'.

The ones employed by corporation and sitting in open space office. Also headphones.

Well, that's embarrassing.

We are all hackers now.

It took me a minute to figure out what a "Que. boy" was.

Reply on news.ycombinator.com