From Islamic Boarding School Systems to NASA: Makassar Student Discovers Security Vulnerabilities

Muhammad Al Hindawi, a 12th-grade student at the Al Imam Ashim Islamic Boarding School in Makassar, began his journey into cybersecurity by discovering vulnerabilities within his school’s own system, before subsequently reporting security flaws found in the systems of NASA and the University of Melbourne.

Speaking from Makassar, South Sulawesi, on Wednesday, Al Hindawi stated that he has been studying cybersecurity autodidactically for approximately five months, utilising various YouTube tutorials and security research reports published by other researchers on the Bugcrowd platform.

He then began conducting reconnaissance to identify vulnerabilities across several systems.

“The discovery occurred during the reconnaissance phase; I initially used ‘Subfinder’ to collect subdomains, then checked their ‘response code’ status using httpx,” said Al Hindawi.

“From there, I searched for systems vulnerable to SQL injection,” he added.

Al Hindawi noted that he has discovered two security vulnerabilities within the systems of the United States National Aeronautics and Space Administration (NASA) and one vulnerability within the system of the University of Melbourne, Australia.

According to him, these findings were subsequently reported through the official Vulnerability Disclosure Program (VDP) on the Bugcrowd platform.

Al Hindawi stated that the vulnerability reports have since been validated by the cybersecurity teams of both institutions.

In recognition of his contribution to finding flaws in NASA’s systems, he mentioned receiving a Letter of Recognition (LOR) from the agency.

Regarding his findings in the University of Melbourne’s system, Al Hindeway confirmed that he has received validation from the university’s Cyber Operations team.

Prior to reporting the vulnerabilities in these two institutions, Al Hindawi admitted to having discovered security flaws within the system of the Al Imam Ashim Islamic Boarding School, where he is a student.

This experience served as a foundational part of his process in developing his self-taught cybersecurity skills.

Al Hindawi stated that he continues to study system vulnerability identification techniques by leveraging various online learning resources and available security research reports.