Indonesian Primary School Student Honoured by NASA for Finding Cybersecurity Flaw

Since the fourth grade of primary school, Ibrahim Al Abrar, a pupil at SDN 3 Genengsari in Kemusu District, Boyolali Regency, Central Java, has been fascinated by computer programming. Through diligent self-taught study of the subject, Ibrahim, commonly known as Ibra, was rewarded by NASA after discovering a flaw in the cyber security system of the United States space agency.

“When I received the letter from NASA, I was shocked, I couldn’t believe it,” said Ibra when interviewed shortly before attending a meeting with Central Java Governor Ahmad Luthfi at his office in Semarang on Wednesday (29/7/2026).

The NASA letter of appreciation was received by Ibra via email in early July 2026. “Dear Ibrahim Al Abrar, on behalf of NASA and the NASA Vulnerability Disclosure Policy (VDP), we would like to acknowledge your efforts as an independent security researcher, both in identifying the vulnerability you submitted and for following NASA’s VDP policies and guidelines in responsibly reporting it to us,” NASA wrote in its letter dated 9 July 2026.

NASA assessed that Ibra’s ability to detect and report vulnerabilities in its security system represents a valuable skill in the information security industry. “Your report has raised NASA’s awareness of a previously unknown vulnerability and has helped us protect the integrity and availability of NASA’s information. Please accept this letter as a token of our appreciation for your efforts in detecting this vulnerability,” NASA told Ibra.

Ibra, who is now 12 years old and in the sixth grade at SDN 3 Genengsari, revealed that his initial attempt to find a flaw in NASA’s cyber security system was made in April 2026. At the time, he was intrigued to try after a friend from his IT enthusiast community, a junior secondary school pupil, failed to detect a vulnerability in NASA’s system.

Ibra then read the instructions published by NASA for detecting flaws in its cyber security system. “So it’s called broken link hijacking, where the link is dead, and then I can take it over and use it for phishing under NASA’s name,” said Ibra.