Teen finds bugs in Google, Facebook, Apple, Microsoft code

At 15 years old, Cim Stordal is one of the younger bug hunters to disclose vulnerabilities to big tech firms.

(Credit: Cim Stordal)

When he's not at school, 15-year-old Cim Stordal spends his time playing the Team Fortress video game, shooting his Airsoft pellet gun, and working in a fish shop in Bergen, Norway. But his real passion is finding bugs in software used by millions of people on the Internet.
Stordal has made the Google Security Hall of Fame, been credited with disclosing a cross-site scripting bug to Apple, been thanked by Microsoft for disclosing a vulnerability to the company, and received an elite White Hat Visa card from Facebook with $500 credit on it.
"I got a card for a self-persistent XSS [cross-site scripting flaw] at Facebook, and a nonpersistent XSS at Google, Microsoft, and Apple," he said in a recent Skype interview with CNET. (As a "self-persistent" issue, the bug Stordal disclosed was not exploitable by a third-party because it required a user to take an action to be at risk, according to Facebook.)

Related stories

• Facebook hands out White Hat debit cards to hackers
• Facebook paid $40,000 to bug hunters in three weeks
• Facebook launches bug bounty program

"I just look around at the site and find out where I can input HTML and stuff and it's not filtered in the source code. Often they filter some characters but forget some or they totally forget that input," he said. "What an attacker wants is often the cookie, which can be used to log-in as the user."
Stordal says of the sites he poked around in, Apple was the easiest to find a flaw in. "I found the Facebook [hole] after four days and the Google one after three, but Apple took me only five minutes" to find two XSS flaws, he said. (Apple representatives did not respond to a request seeking comment.)

Cim Stordal shows off the White Hat Visa card he received for disclosing a vulnerability to Facebook.

(Credit: Cim Stordal)

The companies appreciate his efforts, particularly because he tells them before going public with any of the details. "Everyone was happy about it and fixed the flaws kind of fast."
Stordal started looking for vulnerabilities in software when he was 14 years old. "I have always loved being on the PC and I already was programming some C++," he said. "So I wanted to do something new and I searched around and learned Basic."
His friends are impressed with his skills and lean on him to help keep their Web sites secure. His parents aren't really sure what to make of his research.
"They think it's kind of cool, I guess, as they don't understand what I do," he said. "But they also don't want me to stay on the computer all day."
His next move is looking for vulnerabilities on mobile devices. He's trying to set up a fuzzer (automated software testing tool) on his iPhone 3GS.

• Tweet
• Share
• Share
• Share
• Share

About Admin MC3

This is dummy text. It is not meant to be read. Accordingly, it is difficult to figure out when to end it. But then, this is dummy text. It is not meant to be read. Period.

Related Post

• Forget $100B! Facebook could soon be worth $200B For all the naysaying about Facebook, that it's a flash in the pan and such, there are very few
• Twitter turns on SSL encryption for some usersTwitter is slowly turning on automatic encryption on its website, a move following other major prov
• Facebook Surpasses 1 Trillion Pageviews Per Month [REPORT]Facebook garnered more than 1 trillion pageviews per month in June and July, according to data from
• Googleplex expansion to include 'Experience Center,' test labs Google is planning a massive expansion at Googleplex, its Mountain View, Calif., headquarters.