Thai student earns thank-you letter from NASA for reporting security hole

A first-year cybersecurity student at Thailand's Khon Kaen University has received a letter of appreciation from NASA for reporting a security flaw in the U.S. space agency's information systems.

Thanapon Butsricha, a student at the university's College of Computing, found a cross-site scripting (XSS) vulnerability, a flaw that could let attackers insert malicious script code into web pages, Naewna reported.

Working under the online pseudonym "nullbyt3z," he reported it through NASA's security team under the agency's vulnerability disclosure policy. Under the practice, known as responsible disclosure, researchers alert a system's owner directly, do not exploit the flaw and keep its details private until it is fixed.

The letter, dated Nov. 5, came from NASA's Office of the Chief Information Officer and was signed by Kelvin Taylor, its senior agency information security officer, Khaosod English reported.

"Your reporting has facilitated NASA's awareness of otherwise unknown vulnerabilities and helped us protect the integrity and availability of NASA information," the letter said.

Thanapon said he was proud that his efforts over the past month had helped make a world-class organization's systems more secure, according to Khaosod English.

"The challenge was finding the vulnerability in the first place, and ensuring that every report submitted was not a duplicate of one already reported by someone else," he said.

Thanapon Butsricha, a first-year cybersecurity student at Khon Kaen University. Photo courtesy of Khon Kaen University

NASA's vulnerability disclosure policy offers researchers no compensation "other than NASA's gratitude for your help in advancing the NASA Mission."

The agency gives letters of recognition only for reports that have been validated, accepted and confirmed as fixed, and reports flagged as duplicates or known issues do not qualify.

Phet Imtongkhum, an assistant professor who chairs the university's cybersecurity program, said the achievement showed its students had "both international-level technical skills and professional ethics," which he called the heart of training cybersecurity graduates, Naewna reported.