“Let’s hack Harvard’s systems! And then I decided to play it out”

Recently, Nguyen Van Khanh B (born in 1996) - Sun* Cyber-Security Research Team (R&D Unit) received a special letter of appreciation from Harvard University (USA) for finding and reporting vulnerabilities along with instructions on how to fix their systems. Sun* News has met Khanh and listened to his interesting sharing behind this story.

"I'm kinda a game lover. In the past, I used to play CF and download the hacked version to defeat those shooters who are better than me. I heard that hackers are good at technology, and I want to be like them. So I keep pursuing and now I get some techniques for myself. 

Personally, I am passionate about security research, moreover, I am a member of the Cyber-Security Research Team of the R&D Unit, so to be honest, finding bugs for technology products is part of my personality and interests. 

The story about a destiny between me and Harvard (the American most famous university) begun with a suggestion of my close friend: “Hey, let’s hack Harvard’s systems!”. As a person who likes to explore and search, that suggestion hit the spot, and I agreed to play it out.

Actually, I didn’t know Harvard at first even though everyone in Vietnam knows it. I even went to Google to search for information to discover that Harvard is the top university in the world and the dream school of many generations.

“And I know nothing about it. What a hillbilly!”, that’s what I thought. 

Harvard's website interface is really professional, just like its reputation. But there is nothing in the world 100% perfect. And then, I decided to "take pains in picking holes in Harvard's coats".

After every working hour at the company, I often spend some free time in the evening to enlist the technology that the Harvard website uses, find bugs on the domain, and then sub-domain. “What is done by night, appear by day”, it takes me about a week to find quite a lot of bugs from their website. If you are wondering about the bugs that Harvard encountered, you can check out my Viblo!

(Because the vulnerability severely affected the Harvard systems, their Security team asked me to close the technical analysis post before they reviewed it all)

I never thought that, on a beautiful day, I received a letter of appreciation from a top university in the world. I was so surprised! 

It’s really hard to describe my feeling. I remember receiving the letter Saturday morning (July 18). That day, I stayed up until 4-5 am to finish some personal things. I was too tired and fell asleep. When I woke up, it was already past 10 am. Due to the habit of checking email every morning, when I opened it, I saw a letter from Harvard, and somehow, I no longer felt tired but excited. It felt like I was standing on a high mountain. 

Many people think that finding and reporting bugs to websites around the world is free or none of your business. But I don't think so!

Think positively, it is a way for us to learn more skills, more advanced technologies that the world is applying, and someday, our products will soon use such technologies or even more. Most importantly, it's #for a world without bugs. If you look for it and you'll find it. Learn and gain experience from it day by day, and soon you'll be able to do anything!! *giggle*"