Teenager finds bugs in Google, Facebook, Apple, Microsoft code

Teenager finds bugs in Google, Facebook, Apple, Microsoft code
Published: 03 February 2012 (1587 Views)
When he's not at school, 15-year-old Cim Stordal spends his time playing the Team Fortress video game, shooting his Airsoft pellet gun, and working in a fish shop in Bergen, Norway. But his real passion is finding bugs in software used by millions of people on the Internet.

Stordal has made the Google Security Hall of Fame, been credited with disclosing a cross-site scripting bug to Apple, been thanked by Microsoft for disclosing a vulnerability to the company, and received an elite White Hat Visa card from Facebook with $500 credit on it.

"I got a card for a self-persistent XSS [cross-site scripting flaw] at Facebook, and a nonpersistent XSS at Google, Microsoft, and Apple," he said in a recent Skype interview with CNET. (As a "self-persistent" issue, the bug Stordal disclosed was not exploitable by a third-party because it required a user to take an action to be at risk, according to Facebook.)

"I just look around at the site and find out where I can input HTML and stuff and it's not filtered in the source code. Often they filter some characters but forget some or they totally forget that input," he said. "What an attacker wants is often the cookie, which can be used to log-in as the user."

Stordal says of the sites he poked around in, Apple was the easiest to find a flaw in. "I found the Facebook [hole] after four days and the Google one after three, but Apple took me only five minutes" to find two XSS flaws, he said. (Apple representatives did not respond to a request seeking comment.)


Cim Stordal shows off the White Hat Visa card he received for disclosing a vulnerability to Facebook.
(Credit: Cim Stordal)

The companies appreciate his efforts, particularly because he tells them before going public with any of the details. "Everyone was happy about it and fixed the flaws kind of fast."

Stordal started looking for vulnerabilities in software when he was 14 years old. "I have always loved being on the PC and I already was programming some C++," he said. "So I wanted to do something new and I searched around and learned Basic."

His friends are impressed with his skills and lean on him to help keep their Web sites secure. His parents aren't really sure what to make of his research.

"They think it's kind of cool, I guess, as they don't understand what I do," he said. "But they also don't want me to stay on the computer all day."

His next move is looking for vulnerabilities on mobile devices. He's trying to set up a fuzzer (automated software testing tool) on his iPhone 3GS.

- news.cnet.com

 0

You May Like These Videos

Comments

There are no comments.

Latest stories

Knox Mutizwa wins August Goal of the Month award

by kickoff | 05 November 2018 | 1049 Views

BREAKING: Gandawa on the run

by Staff reporter | 05 November 2018 | 2030 Views

Econet cannot distribute Kwese TV content to Zimbabwean viewers

by Staff reporter | 05 November 2018 | 1542 Views

Shoot-out robbers arrested

by Staff reporter | 05 November 2018 | 1569 Views

Mnangagwa ally warns economic saboteurs

by Staff reporter | 05 November 2018 | 1500 Views

Chamisa mobilises supporters for mass protests

by Staff reporter | 05 November 2018 | 1282 Views

LISTEN: Acie Lumumba speaks on how he got paid

by Staff Reporter | 05 November 2018 | 1063 Views

Dzamara speak on Zanu-PF fights

by Mandla Ndlovu | 05 November 2018 | 1028 Views

Minister Raj Modi Modi donates salary

by Mandla Ndlovu | 05 November 2018 | 881 Views

'I am a Trillionaire' Magaya says

by Mandla Ndlovu | 05 November 2018 | 1423 Views

Supermarkets to be blacklisted over cooking oil

by Mandla Ndlovu | 05 November 2018 | 844 Views

UK army to recruit from Commonwealth

by BBC | 05 November 2018 | 938 Views

Magaya opens up on arrest

by Mandla Ndlovu | 05 November 2018 | 951 Views

Kambarami is still 'Deputy Mayor'

by Mandla Ndlovu | 05 November 2018 | 786 Views

'Import ban must not go beyond December 21'

by Staff reporter | 05 November 2018 | 870 Views

Prophet Magaya puts fresh spin to arrest

by Staff reporter | 05 November 2018 | 897 Views

Chamisa's sign language interpreters get thumps up

by Staff reporter | 05 November 2018 | 884 Views

Mnangagwa to review Mthuli Ncube's 2% tax again

by Staff reporter | 05 November 2018 | 848 Views

Lumumba to be probed by ZAAC?

by Staff reporter | 05 November 2018 | 626 Views

Dzamara speak on ZANU PF fights

by Mandla Ndlovu | 05 November 2018 | 589 Views

Zimbabwe as a new gateway into Africa

by Minister of Finance Prof Mthuli Ncube | 05 November 2018 | 869 Views

Chiwenga's ex-wife looted millions

by Mandla Ndlovu | 05 November 2018 | 1261 Views

We are our own worst enemies

by Mapozho Saruchera | 05 November 2018 | 914 Views

Mnangagwa to deal with unexplained wealth and bank deposits

by Staff reporter | 05 November 2018 | 827 Views

WATCH: Chiwenga talks about Prophet Walter Magaya's lipstick

by Staff reporter | 05 November 2018 | 819 Views

Lumumba Saga takes new twist....War vets bay for Mutsvangwa's blood

by Mandla Ndlovu | 05 November 2018 | 884 Views

Chamisa demands Presidency

by Mandla Ndlovu | 05 November 2018 | 775 Views

Zimbabwean teachers miss out on New Zealand opportunity

by Staff Writer | 05 November 2018 | 722 Views

Zimbabwe to introduce e-provisional driver's exams

by Staff reporter | 05 November 2018 | 768 Views

Zimbabwe to supply water to South Africa

by Staff reporter | 05 November 2018 | 762 Views

Mnangagwa claims that 'good times will soon roll'

by Staff reporter | 05 November 2018 | 727 Views

Zimbabwe as a new gateway into Africa

by Hon. Prof Mthuli Ncube | 05 November 2018 | 864 Views

Chiyangwa appoint Karikoga Kaseke

by Staff reporter | 05 November 2018 | 729 Views

ZCTU demo: Ruling today

by Staff reporter | 05 November 2018 | 678 Views

Missing cop found dead

by Staff reporter | 05 November 2018 | 822 Views

Tagwirei marries long-time girlfriend

by Staff reporter | 05 November 2018 | 1285 Views

Zimbabwe relaxes maternity leave entitlement

by Staff reporter | 05 November 2018 | 794 Views

Zimbabwe to receive drugs, ambulances from India

by Staff reporter | 05 November 2018 | 712 Views