A student hacker was tasked with securing the system he breached

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 2:43:35

   in university i um uh i was i was very good at computer science but i hated going to school and in jordan if you don't go to school they ban you from from the exam oh i was getting a's but i just didn't want to like i didn't want to sit in class uh and actually this is when i started thinking about programming on my phone i was like maybe i can code my phone class um but uh but i felt there was like injustice like i just made adhd whatever you want to call it like you just can't sit in class like just give me give me a break and so i felt justified to you know rebel or fix the situation somehow so i decided to like hack into the university and change my grades so i can graduate because everyone was graduating it was like five years in it took me six years to get through a four-year program just because I can't sit in class

2. 2:44:26

   and have some dyslexia and things like that. But so I decided to do that. And I'm like, okay, like hacking takes a lot of time because like you're coding, you're scripting, you're running scripts against servers and you're waiting. And I'm like, I'm just going to, you know, to optimize my time, I'm just going to do this DaVinci thing where like four hours. By the way, there's a Seinfeld episode where – what's his name, the crazy guy in Seinfeld?

3. 2:44:57

   Kramer? Kramer. Kramer does polyphasic sleeping. Maybe I learned it from there. I'm not sure. How do you wake up? You set an alarm. Oh, God. Yeah. It's torture. That sounds so crazy. Apparently, Da Vinci used to do that. But anyways, I was able to hack into the university by working for weeks using polyphasic sleep and was able to change my grades. Um, and, uh, initially I didn't want to do it on myself, but I had a neighbor who, uh, went together to school and, and, and I was like, you know, let's change this grade and see, see if it actually succeeds and actually succeeded in his case.

4. 2:45:37

   And it was my lab rat. But in my case, I got caught. And the reason I got caught is there is, you know, in the database, there's your grade out of 100, you know, zero to 100. When you get banned because of attendance, your grade is de facto 35. So I thought I would just change that, and that's the thing that will get me to pass. Well, it turns out there's another field in the database about whether you're banned or not.

5. 2:46:11

   This is bad coding. There's bad programming because this database is not normalized. There's a state in two different fields. So I'll put the blame on them for not designing the right database. That's hilarious. You blame them for your hacking being successful. So what was the punishment? So the entire university system went down because of this. anomaly i was i was i was you know um i passed but at the same time i was i was banned and so i got a call uh from the head of the registration system and it was like 7 p.m whatever it was landline and i pick up the call he's like hey listen we have this issue we're dealing with like the entire thing is down and and it just shows your record there's a problem with it do you know anything about it and at the time i'm like all right there's like a fork in the

6. 2:47:03

   road you know i either like come clean or just like this is a lie that will like live for me forever and i'm like i was gonna say it was like yeah i i did it uh and i was like what do you mean i was like okay i'll i'll come explain it to you so so the next day i i go there and it's all the university deans and it's like one of the best computer science universities in in the region the princess of my university for technology um and they're all nerds you know it's so i the the the discussion became technical on like how I hacked into the university.

7. 2:47:33

   And I went to whiteboard and explaining what I did, whatever. And it just felt like a brainstorming session. I'm like, all right, I'll see you guys later. It's like, wait, we need to figure out what to do with you. Like, you know, this is serious. And I'm like, oh, crap. But the president of, they kind of put the decision to the president. And he was, I forgot his name, but he was such an enlightened guy.

8. 2:47:58

   um and and i went and told him like i just didn't mean any malice i just felt like justified i need to graduate i've been here for a long time i actually do good work and um and he's like look you're talented um but with great power comes great responsibility he gave me the spider-man and he said uh for us to forgive you you're gonna have to go and harden the uh systems in the university against against hacking so i spent the summer trying to work with uh with the engineers at the university to to do that but uh but they hated me because you know i'm the guy that hacked into the system so they would like blackball me like sometimes i'll show up to work and they wouldn't open the door and i can see them like i could see you there i'm knocking and they would let me in and let me work with them um we did some stuff to to fix it and and then uh uh i i gained

9. 2:48:53

   And, you know, fame, maybe notoriety in the university and actually got me my first job while I was in school. And it's a different story, but that job was at a startup that ended up making videos that were a big part of the Arab Spring. Oh, wow. Yeah. And I was part of some of these videos as well. But anyways, so one of the computer deans was like, hey, listen, I really helped you out, computer science dean.

10. 2:49:26

    I really helped you out when you had this problem. And I need you to work with me in order to do another research to hack into the university again. I was like, I'm not going to do that. Like, I don't want to get into – no, it's like, no, you're not going to get in trouble. Sanctioned. It's going to be sanctioned. So, again, I worked hard on that. This time I invented a piece of software to help me do that.

11. 2:49:48

    Uh, and, um, and I, I was able to like find more, uh, more, uh, vulnerabilities. Uh, and so I show up at my project defense and it's, uh, it's like a committee of different deans and students and all of that. Uh, and so I go up and I start, um, explaining my, my project and like, I run a scan against the university network and it showed a bunch of red, like there's vulnerabilities. and one of the teens was like, no, that's fake, that's not true it started dawning in me that I was like a pawn in some kind of power struggle so that guy was responsible for the university system and this guy is using me too i was like oh shit but like i'm not gonna back down i was like no that's not a lie it's true uh and so uh i'd like tap into that uniform uh vulnerability and i go into the database and i'm like um all right what do you what do you want me to show your salary or your password

12. 2:50:50

    it was like show me my password so i show him the password uh and uh i was like no that's not my password it was encrypted but they also have in the database like a decrypt function which They shouldn't have, but they had it. So I was like, decrypt the password, and the password showed on the screen in the middle of the defense. And so his face was red. He shakes my hand, and he leaves to change his password.

13. 2:51:19

    That's awesome. And I graduated. And they caught me some slack, and I was able to graduate. That's awesome. That's a great story. We'll end with that. Thank you very much, brother. I really appreciate it. It was really fun. My pleasure.