Scrolling through the Topgolf website looking to purchase a membership for himself and his friends, it was a typical day of summer break for senior Lukas Zenick. With three years of CompSci magnet experience under his belt, he casually decided to test his proficiency on the site’s checkout page using a security testing software called BurpSuite. He ended up finding a crucial vulnerability.
“Normally the [Top Golf] server will send price data to your computer so you know how much things cost, but what was happening was the opposite, and your computer was calculating the price and sending it to the server,” Zenick said. “So what you could do was sort of intercept that request and edit the price so you could pay a different amount for something.”
Upon discovering this flaw, Zenick contacted the company and received an invitation from Topgolf’s Chief Technology Officer to meet and discuss the website.
“They were a little freaked out, to be honest,” Zenick said. “I wasn’t trying to be malicious or anything – I went to them and helped them to identify and fix it.”
Zenick received free Topgolf attendance for a year, awarded by the company for reporting their vulnerability. Zenick said he’s frequented Topgolf since receiving this discount.
In terms of applying what’s taught in the classroom into larger things, Zenick certainly impressed his CompSci teacher Henry Vo, who stressed to his students the importance of ethical conduct in his cybersecurity courses.
“Instead of taking advantage of it, he actually said ‘hey, you guys have an issue, I want to let you know about it,’” Vo said. “I don’t expect any less from Lukas, I really don’t.”
This hasn’t been the only instance of Zenick applying Comp Sci skills to his benefit. Since September of 2017, Zenick and senior Ty Bierwagen have run their company Zenick Technologies, where they engage with clients to custom pick and ship computer parts directly to their residences.
“Most CompSci students don’t spend free time trying to find vulnerabilities on websites, Lukas just took it a step further by applying his knowledge to a real-world application,” Bierwagen said.
