The unsung achiever: Pakistani tops lists of ethical hackers of 2014

Published: January 3, 2015
SHARES
Email
Rafay Baloch says ethical hacking is one way to change Pakistan’s image. STOCK IMAGE

Rafay Baloch says ethical hacking is one way to change Pakistan’s image. STOCK IMAGE

KARACHI: 

He is doing Pakistan proud, and feels his work is one way the image of Pakistan can be improved globally. Yet, this celebrated final-year computer science student at Bahria University has not yet received the recognition he deserves.

The world’s leading information security publications have featured Pakistani security researcher, Rafay Baloch, as one of the top ethical hackers in 2014, putting the 21-year-old Karachiite on top of their lists, The Express Tribune learnt on Thursday.

“Ethical hacking, which makes the information world more secure, is one way we [Pakistanis] can change our country’s negative perception in the world,” said Baloch.

CheckMarx, a source code analysis company based out of Tel Aviv, Israel, recognised Baloch as one of the world’s top five ethical hackers who made the headlines in 2014 for exposing a serious vulnerability – a Same-Origin Policy (SOP) bypass – in Android’s Open Source Platform browser (versions older than 4.4).

The recognition comes from a company that has, arguably, the best tool for Static Application Security Testing. CheckMarx was ranked number one for static analysis in “Critical Capabilities for Application Security Testing”, a 2014 report by the world’s leading information technology research and advisory company, Gartner.

“Contrary to common belief, many high-profile hackings in 2014 were performed by ethical hackers interested only in the benefit of the community,” CheckMarx said in a blog post on December 31, 2014, terming 2014 the year of the mega attacks, such as the Snapchat fiasco, iCloud photo leaks and North Korean orchestrated Sony Pictures hacking.

“Rafay Baloch took the world by storm after finding glaring flaws in Android’s stock AOSP browser,” read the post, putting Baloch on top of their list, which also featured ethical hackers from Israel, Egypt and Switzerland among top five in the world.

According to CheckMarx, the security loopholes identified by the Pakistani white hat “have not been addressed and are allowing hackers to steal session cookies to this very day, enabling them to perform a wide variety of malicious actions including identity theft”.

According to the world’s leading information security magazine based out of New York City, The SC Magazine, “Baloch has responsibly disclosed hundreds of vulnerabilities in his roughly six-year career in security research. His biggest discovery may be CVE-2014-6041, a bug that could allow a bad actor to circumvent the AOSP browser’s SOP”. The magazine published this on December 8, 2014 in an article titled Reboot 25: Threat seekers.

The magazine added that it was a significant issue; it was covered by major news outlets and was deemed a privacy disaster by security experts, and at the time impacted approximately 75 per cent of Android users running platforms older than version 4.4.

Though none of the two publications ranked the security researchers covered in their reports, both put Baloch on top of their list.

A professional penetration tester and author of “Ethical Hacking and Penetration Testing Guide”, his first book on internet security, Baloch has been participating in various bug bounty programs to help several major internet corporations improve their internet security. He was rewarded with $10,000 in cash and a job offer from PayPal, a global online payment solution, for finding remote code execution vulnerability along with several other high-risk vulnerabilities inside PayPal.

Despite the international recognition, the Pakistani security researcher who released three more security bugs in different Android browsers even on the last day of 2014 hardly got any attention from national news channels.

“Being a Pakistani, I feel great to be recognised by an Israeli company,” Baloch said, responding to a question. CheckMarx was founded by Maty Siman, former advisor to the Israeli Prime Minister’s Office on IT security, who also worked in the computer unit of Israeli Defence Forces.

Published in The Express Tribune, January 3rd, 2015.

Facebook Conversations

Reader Comments (6)

  • Ali.baloch
    Jan 3, 2015 - 11:55AM

    Our national news is busy broadcasting hate speeches of Altaf, no time for Pakistani Achiever in Android Security holes…

    Recommend

  • Maher
    Jan 3, 2015 - 12:04PM

    Well done…

    Recommend

  • ThnxIsreal?
    Jan 3, 2015 - 12:42PM

    Israel is a leading voice about any news in the Internet Security. Its their second front against its numerous “natural enemies”.

    Pakistan has no shortage of fine brains, its proven more often than realized. Our immensely free media is one of our rare achievement, beside the free-thought & unstrapped education, that is to be given credit too, for bringing the world to our inquisitive students. A ruthless scrutiny by them of our flaws is after all paying back its wonderful rewards. Blind nationalism after all is not the way to go we see now. Without the proper scrutiny by our media there is no hope in future. One can correct itself better if s/he can see his/her flaws in the mirror. While other countries are looking to make money our talents are polishing brain games. Money comes after a talent is discovered not the other way around,

    Recommend

  • PcDoc
    Jan 3, 2015 - 1:34PM

    Congrats Rafay.
    Our media is too busy highlighting sensational political stories.

    Recommend

  • Yasir Khan
    Jan 3, 2015 - 6:41PM

    Kudos Rafay. Proud of you.

    Recommend

  • Jan 4, 2015 - 3:17PM

    Great legends are never recognized at first because the striking brightness around them turns everyone blind. Stars do look small from a distance but they look Giant when looked from a close eye. The local media needs years to hatch out of immaturity and take the oath to broadcast unfunded news. Its people who matter more and the world’s perception of great people like Rafay baloch. I as a friend of Rafay and amongst his very first companions, pray for his long lasting success and forever achievements. May Allah keep you a shining star always my friend, the future awaits to hug you with tons of pleasant surprises.

    You made me proud again Rafay.

    ==================================================================
    With Love,

    Mohammad Mustafa Ahmedzai,

    STCnetwork.org

    Recommend

More in Pakistan

Karachi

Fiqah Hanfia
Sehar 4:14 AM
Iftar 7:26 PM
Fiqah Jafaria
Sehar 4:26 AM
Iftar 7:26 PM
Fiqah Hanfia
Sehar 4:14 AM
Iftar 7:26 PM
Fiqah Jafaria
Sehar 4:26 AM
Iftar 7:26 PM

Lahore

Islamabad