Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Education Security The Internet

Security and School - How Should One Speak Up? 137

Posted by Cliff from the making-your-concerns-known dept.
AJ asks: "Well, in the midst of writing 1 of my 3 papers tonight, I realized how insecure my school's network is. It all started because I was upset about them changing from using my SSN to a proprietary number scheme for identifying students. I didn't think that was a bad thing, but I was wondering if they really were securing things. So, I needed a password to access a school resource from the internet. After a little of dabbling around, I found the place where I needed to enter my propriety school ID and password. As it turns out, the login form uses HTTP instead of HTTPS! Also, my school runs a wide-open wireless network that I always had considered a convenience, but now I am changing my passwords over that network! Oh, and that proprietary ID along with a password, lead right to a student summary page where my DOB, age, address and SSN are located. So Slashdot, what is a concerned student to do?"
"I have made suggestions before with little results. Should I send an e-mail with an ultimatum. What should my after-ultimatum actions be. I was thinking that I could simply start to sniff passwords (18,000 students and quite a few use wireless) and then place them on my webpage at school. I wouldn't be so concerned, but this wireless problem, combined with a poor web design, has me freaked out. Has anyone dealt with this before?"
This discussion has been archived. No new comments can be posted.

Security and School - How Should One Speak Up? More

Security and School - How Should One Speak Up?

Comments Filter:

  • Job opportunity? (Score:5, Interesting)

    by eviljolly ( 411836 ) on Tuesday April 13, 2004 @07:30PM (#8854740) Journal
    Maybe you should take a different approach to this situation. You say that the school has security problems, and you seem to be knowledgeable in the matter, so why not explain the problem and ask them if they would be willing to pay you to fix it? If all else they might nag their developers to work a little harder after hearing about it. :)

    • Re:Job opportunity? (Score:5, Insightful)

      by c ( 8461 ) <beauregardcp@gmail.com> on Tuesday April 13, 2004 @08:39PM (#8855404)
      so why not explain the problem and ask them if they would be willing to pay you to fix it?

      Because a lot of institutions will take the offer and twist it so it looks like a blackmail attempt, then involve law enforcement. I've seen way too many headlines reading something like "well meaning security person gets ass-fucked because they offered to help intitution fix security problems in return for money".

      The last thing you want to do is make it look like you're after money.

      c.

      • Re:Job opportunity? (Score:5, Informative)

        by torpor ( 458 ) <ibisum AT gmail DOT com> on Wednesday April 14, 2004 @05:51AM (#8858207) Homepage Journal
        well meaning security person gets ass-fucked because they offered to help intitution fix security problems in return for money"

        Too often the 'well meaning' part of these stories is hype. More often than not, it was a selfish, arrogant little brat-kid type who was trying to 'rule supreme over the stooopid school admins' and got upset when nobody listened to their tantrum and rants.

        Some guidelines for the current situation:

        - Put everything in writing, proof-read it first, then again, and spell check. Produce a professional report, not a whiny rant about why things suck.

        - Send a copy of this report to your schools administrators, registered mail. Hand-deliver a copy to the school administrator, if you can, but always, always, always put everything in writing first. Always. ALWAYS.

        - Be thorough and complete, and make sure you explain why you are being so thorough.

        - Provide examples WHEN ASKED and not before-hand. If you attach a page full of passwords you've sniffed out of the ether, this gives you a definite disadvantage if they decide to put your head on a pike. Remember, as a student, you are just one of many in the eyes of the administrator. It may well be that the problems they try to solve involve decapitating you.

        - Be courteous about this problem. It is not one single persons problem, but is in fact a group problem. Singling out one person for all the problems and mistakes of the group will do nothing but serve to make you enemies, so don't do it.

        - Follow up. If there is a change as a result of your investigation, follow up and ensure it is fixed. Work as closely with the people who are responsible for this problem as you can...

        Always, always, always try to remember, that a whiny rant about things sucking is not going to work as well as a detailed, professional, spell-checked report. If your report about the network problems doesn't look like homework, and doesn't shoot for an "A", then its going to get you into more trouble than you expect ...

        • Sounds like the parent poster "torpor" speaks from experience. He probably ratted out some white hacker kid to the cops, justifying it to himself because the kid did not spellcheck his report.

          Oh, torpor, BTW, when you wrote "not one single persons problem," you should have written "not one single person's problem." You forgot the apostrophe....
      • http://boston.internet.com/news/article.php/211044 1

        Somewhere between 'hacking the data' and 'posting it on the web page' or doing whatever he was going to do with it (expose a massive security flaw, perhaps?) a college kid at UT got caught doing exactly this. He hadn't even done anything with them yet except possess the information.

        Best quote of that article : "If convicted, he could face a maximum term of eight years in a federal prison and up to $500,000 in fines."

  • Bad idea! (Score:5, Interesting)

    by 42forty-two42 ( 532340 ) <bdonlan.gmail@com> on Tuesday April 13, 2004 @07:31PM (#8854747) Homepage Journal
    "I have made suggestions before with little results. Should I send an e-mail with an ultimatum. What should my after-ultimatum actions be. I was thinking that I could simply start to sniff passwords (18,000 students and quite a few use wireless) and then place them on my webpage at school."
    If you're going to blackmail your school (and threaten to break various computer crimes laws), don't post about it on a high-traffic site beforehand! Better would be to talk directly to the network admin and offer to show them a live password-capture session.

  • UM... (Score:5, Insightful)

    by ewhenn ( 647989 ) on Tuesday April 13, 2004 @07:32PM (#8854759)
    I was thinking that I could simply start to sniff passwords (18,000 students and quite a few use wireless) and then place them on my webpage at school. I wouldn't be so concerned

    If this page really allow you to view all of the above info (SSN, etc.) AND you are upset it would violate your privacy, why are you willing to post a bunch of other peoples passwords online?? Wouldn't taht violate THEIR privacy. I mean if someone found a problem with my banks online checking that would let people exploit and get into my account, I would not appreciate someone posting my account number an pin online. In fact I would sue the poster of htat information if I could. Be careful where you tread.

    • Re:UM... (Score:4, Insightful)

      by Grab ( 126025 ) on Wednesday April 14, 2004 @07:11AM (#8858395) Homepage
      Dead right.

      By all means, sniff the passwords. But then put them in a document and circulate it to your department supervisors. Make sure the document says *exactly* what you did (every step of the process). It would be good if every step was within the IT policy you subscribed to (then they can't lynch you for that), although as a whistle-blower this may not be necessary. And NEVER use those passwords, otherwise you could be done for hacking into someone else's account.

      Don't even think about asking for money - as someone else said, this makes you look like a blackmailer. Initially you have to act simply as someone bringing in information. What they choose to do with the info is their decision - most likely someone in the IT department *does* have the skills to fix the problem, it's just that they got some incompetent trainee to do it instead. If it turns out that the IT department need your skills then you can negotiate a contract or you can do it for free, but NEVER state that to start with.

      Give out ONLY hard-copies - that way a Word document can't accidentally get put on the web or something dumb like that. This limits circulation - it's more effort to photocopy/scan than to forward an email, so there's less chance of the passwords going where they shouldn't.

      Finally, make sure a hard-copy goes to the school paper, with instructions to hold onto it for 2 weeks (or some arbitrary length of time), and have a good talk with the people running the paper before you tell the school authorities. Make sure when you raise the issue with the school authorities that you tell them you've given the info to the school paper, and tell them the time limit. That way, they know they need to fix things within 2 weeks before things go public. It also covers your ass by ensuring they can't lynch you as a scapegoat, bcos the paper will crucify them.

      Basically, examine every step you take and see how it could be used against you. Getting a couple of your friends to check through what you're doing would also be useful (and having a friend watching at crucial stages like sniffing the passwords gives you the extra backup of a witness).

      Grab.

      • Re:UM... (Score:4, Insightful)

        by Spoing ( 152917 ) on Wednesday April 14, 2004 @11:00AM (#8859850) Homepage
        1. By all means, sniff the passwords.

        Do *NOT* follow that advice.

        Follow this advice. [slashdot.org]

        If I have to say why, you're already treading on thin ice.

        When I've run system scans and dumps on systems I do not manage, I've asked first and shown the admins what I do exactly -- and that's in my professional capacity.

        As a student, make no doubts that you will not be treated well if they even think you are able to do this. The admins should get it, though others will not understand -- though if the admins did know WTF they were doing, they'd use HTTPS in the first place...right?

        Instead, I'd point out that you are concerned since HTTP is an unsecure method and that others are likely to abuse your account and you want to know if the school is willing to take responsibility when that happens.

        Scare them into action but do so from the point of view of someone who would not even look themselves.

        In the meantime, use https:// in the URL yourself -- it will probably work -- and suggest friends do the same if it does.

    • Re:UM... (Score:4, Insightful)

      by Glonoinha ( 587375 ) on Wednesday April 14, 2004 @11:03AM (#8859877) Journal
      This sounds a lot like that college kid that decided to 'test' airport security a few months ago by sneaking a knife onto a commercial flight. Made it past security, got onto the plane, then announced his amazing feat of stealth and cunning to the crew. Ha Ha your security still sucks - I tested it and I am better than you - hey wait, it was only a test - hey who are these stormtrooper guys - ouch.

      Oddly neither the airport nor the government found his 'test' very enlighting. No, in fact I think he was facing several years in Federal Pound-Me-In-The-Ass Prison.

      Original poster : you are approaching this like a child in an adult world. It is obvious that you desire peer level attention and recognition for your 'accomplishments'. Trust me, as someone that was 'recognized' and 'acknowledged' by the university administration for 'hacking' his college computers (possibly before you were even born) ... recognition is highly overrated. That you even suggested collecting the list of passwords and placing them on a webpage at school shows incredible immaturity. Not because you said it, but because doing so is even a remotely viable consideration in your mind.

      You want to blow the whistle, then blow the whistle. If you see a serious breach of security and you feel the need to get it fixed, go to https://tips.fbi.gov and fill out that form, hit submit. I pretty much 100% guarantee that they will take you serious. You can call them at 202-324-3000 if you want.

      Understand, however, that once you invite the government into any aspect of your life or business it is impossible to put that genie back in the bottle. This goes with any cute little pranks you enumerated like sniffing passwords or listing them on a web page at school.

      There is a fine line between helper and terrorist in today's environment and you really don't want to screw away your lifetime potential because you were being 'gifted and talented' in college. Not only do you not want to cross the line, you don't even want to be under evaulation as to which side of the line you are at - all it takes is one bureaucrat to misinterpret anything you have said and you are royally fscked.

      If you are here because you are genuinely concerned about massive lapses in the security as implemented at your university then consider whether or not you are ready to be a martyr for that security - because once you blow the whistle you can pretty much kiss goodbye any chances at graduation from that college. But the needs of the many outweigh the needs of the few and we are ok with sacrificing you as a pawn in the name of the overall good.

      If you are here to impress us with your 1337 haxor skillz - what you did wasn't 1337, it was merely a rite of passage for every systems guy worth his salt. About like programming a bubble sort in visual basic - everybody is proud the first time they do it, but it really isn't that big a deal.

      You want to impress us, do something none of has done yet :
      Find Osama bin Laden, hell I think there is still a $25M reward for the information leading to his capture.
      Figure out a way to actually get the administration to fix their security. Do that and you will be our hero.
      Find a way to bring back the tech sector jobs that are being outsourced overseas. Do that and you will be our hero and we will rename Linux in your honor.

  • Show the problem to your school leaders... (Score:5, Informative)

    by joelparker ( 586428 ) <joel@school.net> on Tuesday April 13, 2004 @07:33PM (#8854768) Homepage
    First, contact your school technical staff;
    they are the ones to fix this problem.

    Second, if the technical staff does not fix it,
    contact your school's Deans for intervention.

    Third, if the Deans do not get the problem solved,
    contact your school paper and ask for help.

    This all shows that you're a team player,
    in case you need to escalate it later.

    • Re:Show the problem to your school leaders... (Score:5, Interesting)

      by mar1boro ( 189737 ) on Tuesday April 13, 2004 @07:49PM (#8854952) Homepage
      Call me paranoid. In a perfect world this would be the ideal situation.
      If you are determined to get this fixed ( as you should be ), and you are
      on friendly terms with both your system admins and your school's administration
      then take the straight forward approach suggested by joelparker.

      If they do not know you, I would attempt to be a little more anonymous.
      If you point out laxaties in their security, you will be the first person
      they think of when there is a problem. The security admin will probably
      also get his ass chewed by his boss. The admin will remember you.

      If you are still determined, do one of two things;
      1. Compose anonymous snail mails. One to the school's admin, and
      if this is a state school - one to the state's security admin at the
      department of education.
      2. If you have money, or can find an activist lawyer willing to do this
      pro-bono - retain council and enter into a priveledged communication.
      Have the lawyer communicate with the admins.

      Just remember - no good deed ever goes unpunished.
      • I sent an anonymous packet of informtion to the dean through campus mail, regarding a faculty member's use of equipment purchased for a university project, and his taking that equipment for a company that he started, and giving us instead dated equipment with 'property of NASA' stickers on it. [where he worked part time, it was my understanding]. He also claimed the work of one of the students for whom he was an advisor, as the work of his company.

        Unfortunately, as there were relatively few people who ha
    • Are you crazy? First, the school network is not his responsibility. Therefore he should not report anything at all.

      Second, someone at that university is responsible for that network. That person might have gotten his job through political means, rather than displaying competency. That's likely, given the nature of the security hole. Pointing out the mistakes of politicians from a point of weakness is not a smart thing. He might be technically right, but I doubt that a college student has the financial mean

      • Gotta agree here. Anonymous is the way to go. While he certainly has every right, and perhaps even an obligation to complain about the problem since it's his personal info that is at risk here, it's all too common for the messenger to be stabbed, hung, shot, and dragged through the street in situations like this.

        • Yes! An anonymous message is the best course of action. If they know who you are, they *will* assume you compromised the system. Then they may take legal action against you. By that point, you're fucked, even if you're in the right. You'll lose a good year or two of your life defending yourself, and paying legal fees.

          Communicating through a lawyer is also good, if expensive. If they're involved from the beginning, then it'll be cheaper than getting them involved later on. Try contacting the EFF [eff.org], the

  • No no no (Score:5, Insightful)

    by FattMattP ( 86246 ) on Tuesday April 13, 2004 @07:34PM (#8854782) Homepage
    I was thinking that I could simply start to sniff passwords (18,000 students and quite a few use wireless) and then place them on my webpage at school.
    So you're going to point out how insecure their network is by placing 18,000 students accounts in more danger than they're already in? You'll end up in jail for "hacking" if you do that. Seriously.

    What you should do instead is write a letter explaining the situation in terms that a layman can understand. Outline why you believe the current setup is a problem and the risks associated with it. Identity theft is becoming more of a problem these days so maybe they'll understand where you're coming from. Then, and here's the important part, present a solution for them.

    Whatever you do, DO NOT sniff the network and post the results. Don't even show them privatly to the people in charge. Let them handle their own security investigation. All you need to do is point out the problem and suggest a resolution.

    • Re:No no no (Score:5, Informative)

      by Biochrome ( 771051 ) on Tuesday April 13, 2004 @07:43PM (#8854878) Homepage
      You'll end up in jail for "hacking" if you do that. Seriously. I meerly nmaped our server, and I spent a night in jail, and lost all computer priveleges forever at school. Do NOT even act like you may be comprimising network security... you'll end up in a boatload of trouble.
      • Reminds me of that one time I set off security alarms for port scanning an entire 255.255.0.0 network. Lets just say that was a mistake ;)

    • Re:No no no (Score:3, Informative)

      by Frisky070802 ( 591229 ) *
      I'm with you there. Just think about what happened [lightlink.com] to Randal Schwartz at Intel a few years ago!

  • Damned if you, damned if you don't (Score:4, Insightful)

    by G4from128k ( 686170 ) on Tuesday April 13, 2004 @07:34PM (#8854784)
    IANAL, but I suspect that if you intentionally demonstrate the insecurity of the system, you will be sent to jail. Ask a lawyer, but I suspect that their advice wil be to not do anything that involves you breaking into the system.

    On the otherhand, until somebody at the school gets their identity stolen AND they can prove the school was at fault, nothing will change.

    At most, I would document the problem WITHOUT breaking any laws (again IANAL). Even documenting the problem that might get you in hot water for the terrorist crime of "hacking."

    I feel for you. Be careful.

  • Inspiration (Score:3, Interesting)

    by MegaT ( 672432 ) on Tuesday April 13, 2004 @07:34PM (#8854785)
    So Slashdot, what is a concerned student to do?
    this? [cnn.com]
    • Please note that this example of a hacking excersize was santioned, and the school knew about it. Also, IANAL but I don't think this is covered under FERPA, so there's not as much rick to the admins. Moreover, these admins appear to be open to criticism vs. those at a college. think about it.
  • I would recommend you not to get the passwords and user names. I know you are not going to be using them to do anything harmful, but it is ilegal. Instead of doing that get one or two professors to back you up. If those in the IT department don't pay attention to you, you would have a professor that could talk to the dean or someone 'important' that would make ge the attention of the admins.

  • Sniffing's a bad idea (Score:3, Insightful)

    by the_truk_stop ( 448393 ) on Tuesday April 13, 2004 @07:35PM (#8854806)
    While sniffing passwords sounds like a great way to get students' awareness up, that's generally an extremely bad idea. While the administration sounds like it's being incompetent, you posting sensitive information online will quickly get you slapped with legal issues.

  • No ultimatums... (Score:5, Informative)

    by isaac ( 2852 ) on Tuesday April 13, 2004 @07:44PM (#8854892)
    Do not make an ultimatum. You WILL be subject to disciplinary procedures, and probably prosecuted. If speaking to the campus technology people responsible (and I mean speaking to the people who are *really* responsible - the managers, not the helpdesk) for these systems and networks about your concerns produces only indifference, you should drop the F-bomb - FERPA, the Family Educational Rights and Privacy Act. Under FERPA, your school may be both liable to you (and theoretically face loss of federal funds) for unauthorized disclosure of your educational records and other personally-identifiable information like SSN. (Directory information, such as your name, and the fact that you're a student, is not automatically protected from discloseure by default, but you may request that such info not be disclosed to third parties.)

    I guarantee the IT managers will have heard of FERPA, and they should snap to attention when you remind them of their responsibilities under the act.

    Consult an attorney licensed to practice in your jurisdiction for more information on your rights. I also recommend judicious use of Google.

    -Isaac

    • Re:No ultimatums... (Score:2, Interesting)

      by GigsVT ( 208848 )
      Yeah, but there doesn't seem to be a clear cut line. From what he's said, the data is pretty much secure. As secure as any normal data was 15 years ago.

      Sure, it could (and probably should) be more secure, but does FERPA lay out detailed standards for encryption and data security practices? I personally don't know, but I seriously doubt it.

      (On the other hand, I see no use in putting that data on the web, of course he knows his own SSN and personal info.)

    • Re:No ultimatums... (Score:3, Insightful)

      by Anonymous Coward
      Remember also that you catch more flies with honey than with vinegar, and even if you drop the "F" bomb, a pissed-off vice chancellor or IT manager can stonewall like you can't even comprehend while appearing to any outsider to be dealing with an unreasonable student as responsibly as possible

    • Re:No ultimatums... (Score:3, Insightful)

      by bcrowell ( 177657 )
      Under FERPA, your school may be both liable to you (and theoretically face loss of federal funds) for unauthorized disclosure of your educational records and other personally-identifiable information like SSN.
      IANAL, but I believe there are some big exceptions written into the law. Your information can be given to anybody who has a legitimate educational reason to see it. I also don't think the law spells out any particular level of security that's required. The only kind of stuff that really gets you in t

  • At Northwestern University... (Score:3, Interesting)

    by the_truk_stop ( 448393 ) on Tuesday April 13, 2004 @07:46PM (#8854915)
    ...the page where you change your password has a Javascript app that will check if your password meets the Northwestern University IT [northwestern.edu] guidelines.

    If it doesn't, a pretty window pops up, displaying your password along with an explanation of the error. Wonderful. A variation of my second most sensitive password suddenly popped up when I missed the shift key while typing in a symbol. So far all my complaint has gotten from IT is "We'll forward this one on to so-and-so."

    Students in-the-know are generally ignored. I wouldn't bet heavily that your school will change its policies anytime soon. It probably took a boatload of work to make the switch in the first place, so more changes will probably take a lot of prodding.

    • How exactly is this a security problem, unless someone happens to be watching over your shoulder?
      • How exactly is this a security problem, unless someone happens to be watching over your shoulder?


        Well, there IS a reason why password entrance fields usually only give asterisks as feedback.
      • Shoulder-surfing is exactly the security risk. The guys around me in my dorm are fairly competent with computers. One in particular likes to gain access to other people's computers and mess around wrecking havoc. Him having my password is a dangerous proposition.

        Having password displayed in plaintext against my will is even more dangerous.

        • If you have one 'super duper' master password that you use for everything and never change it - you are already screwed. In fact the more 'super duper' it is the more you are screwed because you trust it with everything because you think nobody can guess it or hack it. When someone figures it out (and it happens) you are screwed across the board and the damage isn't sectioned off to just one thing like your college network.

          Work up a scheme of passwords for different layers of security :
          - one set of passw
          • one 'super duper' master password...for everything and never change it

            Actually, I have a "super duper" password that's an unspecified-but-very-large number of characters long, was randomly generated, includes alphanumeric and punctuation characters, and I learned by brute force memorization and repetition. I use that for root's password and GPG.

            My lesser password I keep at 10 or more characters. It's got alphanumeric and punctuation characters. I change it yearly.

            Oh yeah, and I have a separate BIOS p

  • obvious (Score:3, Informative)

    by sporty ( 27564 ) on Tuesday April 13, 2004 @07:51PM (#8854962) Homepage
    1. talk to parents. explain to them thuroughly what the situation is.


    2. get a lawyer. you have a right to use their networks, not admin it. you can point things out, and use the system as intended, but that's as far as it goes. i.e. http vs https. changing other's passwords and what not is something for your parents and a lawyer to discuss with the school.

    • Re:obvious (Score:2, Informative)

      by littlerubberfeet ( 453565 )
      I agree. Do ALL communication through that lawyer. That alone will probably scare them into making changes.

      DO NOT give up the protection of a lawyer under any circumstance, because they will screw you over. If changes aren't made, have your lawyer send a cease and desist for violating FERPA, the Family Educational Rights and Privacy Act.

      Lawyers are expensive. I bet you could find one to take this on pro-bono. Ask around, email the ACLU and EFF.

  • Suggestion (Score:4, Informative)

    by theantix ( 466036 ) on Tuesday April 13, 2004 @07:52PM (#8854974) Journal
    Do *not* sniff passwords or publish them, unless you want to face some nasty consequences. What you should to is draw up a list of the tools required to sniff the passwords and give them a recipe as to how someone could crack their security.

    From what you've said there... You should say something along the lines of "A person could sit in the school parking lot with a laptop and a wireless networking card, and run the program 'Ethereal' to watch the network traffic. This person could literally watch the login IDs and passwords, and use that information to get your SSN and other vital and private information."

    Pass that along to IT, your school administrators... if that doesn't get them hopping try passing the story on to your local community newspaper. That would be much safer than risking the legal reprecussions of cracking passwords yourself.
  • I have the following suggestions for you:
    - Don't change your password over the wireless network
    - Don't stir shit up too much. Complain to somebody in the IT department, and then complain to someone in a position of authority (the dean, etc).
    - If that doesn't produce the desired results, forget about it. DO NOT threaten anyone with anything, and don't tell anyone you sniffed passwords. Doing that can land you in jail pretty easily, assuming the network administrator is sufficiently incompetent.

    Otherwise,

  • Honestly? No techies. (Score:5, Informative)

    by JabberWokky ( 19442 ) <slashdot.com@timewarp.org> on Tuesday April 13, 2004 @07:56PM (#8855014) Homepage Journal
    Do not go to the IT department. They have screwed up, and will move to cover their asses in the easiest way; making you a scapegoat and likely sending you ass to jail.

    Go to a Dean, the highest level one you can get a good ten minute discussion. Do not discuss this with anybody else. Tell him that you have not discussed this with anybody else, that you have not exploited this vulnerability in any way, and you are coming to him directly as you realize that publically announcing such a discovery can lead to serious consequences.

    In the corporate world, this is known as an "executive sponsor", somebody with the political clout to shield you when the people who screwed up try to discredit you. It is vital that you have a sponsor, since a student has nearly zero political standing. Lay it all on the line and look the Dean directly in the eye and tell him or her that you are concerned about this issue and also about the reprocussions that whistleblowing this issue may have.

    If the Dean is not connected to the technical issues, they won't have any reason to cover their asses and will stand in your corner in the resulting (and there will be one) shitstorm.

    --
    Evan

    • I've seen this happen, and heard of it so many times, you definitely need to approach this from a deeply political standpoint, that's how it will pe pproached by everyone else. Obviously thi kind of breach is illegal, but they'll get away with it if you let them nail you instead.

    • Re:Honestly? No techies. (Score:4, Interesting)

      by Spoing ( 152917 ) on Wednesday April 14, 2004 @11:26AM (#8860139) Homepage
      1. Do not go to the IT department. They have screwed up, and will move to cover their asses in the easiest way; making you a scapegoat and likely sending you ass to jail.

      Agreed on going to the dean. If you use what I call the Columbo method -- after the dumbly and wise detective on TV -- you can also go to the IT department though this is a bit more risky but may silently solve the problem.

      The Columbo method works basically like this;

      "I'm no expert, though shouldn't there ..." (and give a base -- even misworded -- comment on what is wrong)

      Other phrases: "You know, I was wondering..." / "I find it curious that..."

      Now, don't follow through and 'catch the bad guy'...you're only talking after all -- and *you're* not the expert! These things confuse you!

      "If only someone could do something about that. Do you know anyone?"

      Change the subject and leave or if the mood is right, just smile and leave. A "Yep, I find that interesting" as you go might also get it to sink in.

      If anything, be a little funny but do not be condecending.

      Who to talk to? Pick someone who is in the IT department who does not have an ego or a nasty attitude. Be unexcited, and mention your concerns as if you're commenting on the weather.

      Note: If using https:\\ instead of http:\\ works, mention that *you* found a work around, though https should be the default -- after all -- for all those other people who haven't noticed yet. But what do you know?

      • You, my friend, are a genius.

        If only I had thought of the 'Columbo method' before, I think it could have saved me much time with my own University's idiot IT department (and other idiots... they seem to populate the earth.)
        The Columbo method will be my new problem solving manifesto.
        Thankyou.

  • I always wonder who the kind of people are who say things like:

    I was thinking that I could simply start to sniff passwords (18,000 students and quite a few use wireless) and then place them on my webpage at school.

    I mean, come on. This has nothing to do with computers -- if you just think about that for one second doesn't it strike you as mildly idiotic?

    Just don't do it. If you are concerned about security, write a letter to the editor of your paper or an op-ed piece and explain what could be done by a

  • If you go to the principle, you will probably get suspended/expelled for "hacking" the network. I went to 2 highschools. At Highschool A, if you had anything to do with anything that was not a part of the school's acceptable use policy, even if it was non-malicious and for the better of the school, you were almost guaranteed expulsion. (If they caught you that is. ;-) ) At Highschool B, there was a well established tech community that the assistant principle was a close part of. The on-site LAN admin s were young, former students of the school, so were pretty open to listening to what anyone had to say about "insecurities" on the LAN. I became a part of their student tech program, which offered fairly simple classes in networking, perl, html, and operating system theory. I advanced in the classes, and ended up teaching one of them as a student. Quickly, one of the LAN admins and I become buddies, and a trust was formed with me, him, and the assistant principle. As long as no harm was done when finding some kind of security vulnerability, then no suspension/expulsion was needed. I do recall however, having a history teacher at Highschool A who would periodically pull me and a fellow tech out of class periodically to fix computers. A trust was formed between us, and him. The best advice for reporting this, would be to find a teacher who you are closest to, and explain to them the issues involved. Inform him/her that you aren't trying to harm anyone, you only made a simple ovservasion and would like to report it. A trusting teacher will then put in a good word for you, the student, and you may even get some extra credit.

  • Many players (Score:4, Informative)

    by linuxwrangler ( 582055 ) on Tuesday April 13, 2004 @08:08PM (#8855132)
    First consider your goal. I presume it is to get them to fix the problem rather than to extort money, humiliate them, etc.

    Given that assumption remember that there are many players. There are the software writers and network admins. They may be afraid of being made to look bad in front of their superiors. They may know the problems and be working on them. They may simply be doing all they can with the resources that have been given them.

    Work your way up from there. IT Department heads may try to claim it isn't a problem (prevent embarassment), indicate the need for more resources or may be in the dark because their people screwed up and hid the problem.

    The legal department and higher administration will be worried about liability and bad press. As such, any "demonstration" you put on can be used against you. Suddenly you will be the bad guy - the evil cracker. They may even try to go after you legally to cover their asses.

    Others have mentioned S-O legislation. There may be a compliance officer on campus who you can contact.

    So what to do?

    I would write a detailed letter describing the problem in layman's terms. Profess ignorance to allow people to save face (phrases such as "perhaps I am unaware of fixes that are already in the works", and "I know running a student network on a tight budget is difficult...") and express your desire that this matter be handled quickly and without the need to involve outside parties but insist that it must be handled.

    The "ignorance" method also allows you to send the letter to a wide recipient list without looking like you are trying to skewer any particular person or department: "I apologize for the wide distribution but I'm not sure who is in charge of such a matter as it involves S-O compliance, student privacy, IT etc..."

    You may want to offer recommendations (perhaps this system should be taken offline to protect the sensitive data until the security problems are repaired) and offer your assistance. If you offer to arrange a demo and they accept, request that they set up a dummy account. This helps isolate you from liability and demonstrates your concern for privacy.

    Other avenues if the "good-guy" method fails: many universities have a student ombudsman, there may be state or federal S-O compliance resources and finally, there is the press.
  • By no means is this a complete list, just off the cuff:
    • your parents
    • your teachers
    • other students
    • town paper
    • the school principal/headmaster
    • the super-intendant of schools
    • the PTA
    • the school board
    • your mayor
    • your town selectmen
    • your congressman/woman
    • the EFF
    • the aclu
    • a lawyer
    • Jesus
    • Mary
    • Joseph

    Seriously, though, I'm guessing you have a phone book. There are so many resources that you could use. I'm not meaning this as a knock against you, but you could try google, or ask take a second to think about the

  • I don't know all the ins and outs, but it seems to be that many people have been burned by the DMCA for trying to let others know about their security problems. I can't remember how many stories on Slashdot I've read that seemed utterly ridiculous because someone was in legal hot water for trying to help some company/institution/organization get their security issues known about.
  • I've seen some apps that ran over plain old HTTP but had a Java applet that was a VPN client so they were essentially just tunneling the encrypted session via port 80.
    (Yeah, I doubt that's the case here too... :)
    • That's what I was wondering also. I have a faint recollection that that's how Travelocity used to work, all the pages were http but they used some javascript thingy to encrypt and send off the stuff you entered into the form fields. Maybe the school is using something like that?
  • What are you on about with the whole "proprietary user id and password" nonsense. We usually call these things just "username" and "password". Proprietary usually refers to some sort of intellectual property of some value, like source code or wiring diagrams or similar.

    It's not a synonym for "something I don't like". Weirdo.

  • Nobody seems to have mentioned this, but if the school is knowledgably posting student data, then they are in open violation of FERPA (Family Educational Rights and Privacy Act). If you notify them of the problems & they still refuse to do something, you have every right (& possibily the responsibility) to sue the hell out of them.

  • At my secondary school.. (Score:3, Interesting)

    by Anonymous Coward on Tuesday April 13, 2004 @08:39PM (#8855405)
    At my sec school I got in trouble three times. Once because I used megaproxy.com to access Hotmail to send some work home (intrestingly enough, megaproxy.com was stuck on a post-it on the side of the server (yes, the server was just on a desk in a little closet!) - the council, not the school, have authority over what's blocked, so my guess is the teachers used that site to access things which were blocked too....). I got a little ticking off for that. The teachers knew it was silly and had had lots of complaints from students, but done nothing about it.

    The second time I was logged on on somebody else's account and I just did a copy/paste on the common drive. That didn't actually waste much space or slow down performance at all, but it was worth a letter home and a ticking off. Yes, it was stupid using somebody else's account.

    The third time I was pointing out vulnerabilities in the security software they were using (rather, it was a program running over windows and one of the features was that it prevented you from typing "C:\" in a file dialog box. A friend discovered that if you put c:\ in the clipboard and hold paste in the dialog box then eventually the software will be too slow, windows will win and the dialog will open. He screenshotted it and put it on the common drive for people to see. I opened it and put a ring round the "c:\" showing in the dialog box. Of course, my name came up as "last edited" (I never understood why they didn't check created by, but said person had friends right at the top...hmmm.....CORRUPTION..).

    That got a letter home and lots of chats with the Admin and Head of IT (who also happened to be my maths teacher, and knew a) I was brilliant and b) I wasn't harmful) - but still, because of politics from above, she had to take action.

    The funny thing is that there were people in the year below me regularly abusing holes but who didn't get caught because they weren't trying to inform the school. Oh the irony.

    It sucks. The suits don't understand the world of computing - just right, wrong, PR and . They don't understand that sometimes you have to be "cruel to be kind", to nick a lyric.

    The hardest part is that if you do NOT show them the holes they will ignore you, but if you DO, you get letters, action, records, jail time.

    Good luck.
    • It all goes back to this: anytime you make something illegal, then only outlaws can do it, form compiling programs to owning a gun the patriot act and american policy seem to be making being a white hat illegal. They welcome folly by olny allowing black hats who are really dangerous to continue their activities (for lack of a better word) Maybe we need to start a slashdot letter writing campaign???
  • just where did you say you go to school? ;>

  • SSN?! (Score:5, Insightful)

    by psyconaut ( 228947 ) on Tuesday April 13, 2004 @09:34PM (#8855845)
    " I was upset about them changing from using my SSN to a proprietary number scheme for identifying students..."

    Let me see if I understand: you're upset about not being told to use a piece of information that's the root of identity theft issues? Heck, I'd be *glad* the school was moving away from having my SSN plastered all over the place!

    -psy
  • Send me an email (ste phe n@t ous et. org) so I can find out if you go to the same University I do--the description matches perfectly. If so, the both of us will probably have better chances of changing something. Especially considering I know most of the Student Government and IT folks there.

  • Platinum cards (Score:3, Funny)

    by aminorex ( 141494 ) on Tuesday April 13, 2004 @09:46PM (#8855939) Homepage Journal
    A few credit applications using the Dean of Students'
    home address and the names/ssns of ten or twenty
    lucky students would get some attention, I reckon!
  • You shouldn't have told me that... you can bet I'm going to sit outside your school sniffing wireless traffic now, so I can find out your date of birth and SSN. I hope you have plenty of car parking for the hacker influx!

    Or perhaps not. In the grand scheme of things, this is a very minor issue, the details aren't that significant, the time taken to procure them would be excessive, and I doubt that a large proportion of students even use the wireless network. You should perhaps consider yourself lucky to hav

  • bah (Score:3, Funny)

    by Maskirovka ( 255712 ) on Tuesday April 13, 2004 @10:19PM (#8856216)
    Should I send an e-mail with an ultimatum.

    Nah.
    Just post the name of your school here and let the problem take care of itself.

  • OK, I skimmed the topics and didn't see anything that really targetted this idea, so here it is...

    First, go to the school with a nicely written letter explaining the vulnerabilities, the impact and why it must be fixed. Tell them that you intend to publish your findings after a month or so or later if the school needs that time to fix the problem. The idea it to fix a date so that that school fixes the problem.

    Again, our goal is to fix the problem. Not arm the baddies.

    If you fear that you will be su

  • I was in the library reading slashdot on..shudder..Windows when the impossible happened: IE.EXE crashed. I begin to hold the power down button for a cold boot. [IT Bitch walks over] IT Bitch: What do you think you're doing? Me: IE.EXE Crashed. Big Surprise. IT Bitch: Normally people come and get us when that happens. Me: IT Bitch: What were you doing? Me: Reading /. IT Bitch: What's that? Me: *stare* [IT Bitch informs me that the thing to do is reboot the terminal] IT Bitch: What was all that typing? I hea

  • Above all, tact (Score:2, Interesting)

    by Jmstuckman ( 561420 )
    There are several ways to deal with this situation. The real question is how the IT staff will react to each of them.

    The most important thing to remember is that they're going to avoid losing face in front of their superiors at all costs. This reclaiming of face might involve lying or throwing you in jail. If you find a way to inform them of the problem *without* causing anyone to look bad in front of someone with influence, they'll be grateful.

    Half of business communication is learning how to tell people

  • Your school newspaper (Score:1, Insightful)

    by Anonymous Coward
    Take it to them, explain to their most technically savvy reporter (get their web guys to help if they have them), and get them to write a story. They can make the other students aware of the problem, and once a lot of students are aware, the administration won't be able to simply ignore it. They'll be forced to fix it, and it won't look like you were trying to blackmail them.
  • You said you've already brought it up to them.

    If you're in the US (or France), unless you really like the people in charge of your school AND they like you, forget the whole thing.

    If they're not interested in fixing it, just walk away. There are better things to do. What's in it for you? Jail time?

    You're going to be in that school for how many more years? Just do your time in school and get out. Why risk doing time in jail as well?

    The whole world is not secured properly, but things still work because mo
  • you want the school to kick your ass out because you threatened them with revealing their network secrets and not following their AUP (surely they have one?)?

    instead, find some sympathetic influential faculty (especially if they have tenure) who can make life hell for those responsible. if they refuse to do anything, just report it to your local newspaper and document _EVERYTHING_ (either immediately write notes while in their presence or tape-record what their comments are while they deny any problems). i

  • About a year ago, I noticed a fairly significant vulnerability allowing me to get the shadow passwords of any student in the CS program, as well as all faculty and staff at my university. Thankfully, I am on good terms with the CS computers administrator, and told him what I could do, and told him what to type to get it. Being plain old DES, the shadows passwords would have been trivial to crack using a dictionary approach.

    He immediately contacted the university CTS staff (they administer everything else)

    • He also told me it was a smart decision on my part to come forward immediately with the information, because if they had found out that I knew and didn't tell them, I would have been expelled and barred from any post-secondary institution in North America for several years.

      Bullshit. Even if you were expelled, most schools won't say more than the vaguest idea why. It's to prevent them from lawsuits. Besides, you could just omit that institution from your transcript and they would never know, if that was t
  • 1) Sniff student passwords, then email the passwords to those students. Nothing is compromised since you are only emailing someone their own password, but that will bring the security flaw to their attention. If you do this enough, then a lot of people will get frustrated with the school.

    2) Go to the CS department. There is probably some grad student who is doing a thesis on network sniffing or honeypots or wireless security or sometihng. Have THEM do the sniffing under the watchful eye of their facult
    • Under no circumstances sniff passwords, let alone send e-mails. As if Getting jailed for hacking weren't bad enough, you'll be imediately reported as hackers by the people you e-mail. Once, I pulled all the AIM screen names out of an extensive forward and put them into my Buddy list, I statered to IM them and tell them that thier e-mail addresses were being distributed, and aspects of their privacy violated, and I was called names, cursed at, reported to AOL TOS (which doesn't do anything), and called a c

  • I'm assuming you're in IT (Score:3, Insightful)

    by Gary Destruction ( 683101 ) * on Wednesday April 14, 2004 @12:52AM (#8857217) Journal
    I'm assuming that you're in IT to some capacity and not someone who just knows a good deal about networking and security. The reason I'm asking is because if you're not in IT and you approach them, they might talk down to you or attempt to discedit you. I'm sure you know what I'm talking about. The "Well what does he/she know about computers?" If you are in IT, you might want to approach them from the standpoint of an IT professional. You might say something like,"Hello. I was logging in and noticed something...." And make them aware that you are an IT professional/student so that they know you're someone that's speaking on a level playing field. And if you're a student, you could say something like,"Well in security class, I learned https and..." It's a tough situation because you don't want them to get the impression that you're snooping around and looking for something to exploit. At the same time, you don't want to come across as being intrusive or pushy. The other option is to approach them showing concern about your own privacy. The idea of an ultimatum has already been answered by previous comments.

  • Watch your ass (Score:2, Interesting)

    by +CipherDemon ( 652887 )
    I experienced similar things with my school (except that we're a high school in florida, which means there's almost no education money. bastard politicians.). I found a multitude of insecure things in the workstation setup (including being able to edit file shares between machines from a non-admin account). So, I made a report for them and gave it to my computer teacher. The first IT person that got ahold of my report wanted me suspended and barred from all on-campus computer labs. The second one finally fi
  • Every thing you said is begging to be prosecuted in some way. Do you think that the sysadmin doesn't KNOW what sort of network he is running? Do you think that some of the other students have not pointed this out? The network is set up the way it is because the school administration doesn't care to spend the money / time to do the right thing.

    In this case they will only fix the "squeaky wheel" YOU! And probably with a bludgeon. Shutup, protect yourself, get over it and stop using their network for thin

  • Grab userid/password from all 18,000 students, then send emails from ALL of them to the Dean, and head of IT demanding that security holes be fixed. Then, use those email accounts to SPAM the administration until security is fixed. Problem solved, and I'm sure the other students will be fine with you using their accounts for such a noble endeavour.

  • Certified mail.

    To the principal of the school and cc the office of the superintendent of the district.

    Politely and concisely explain that as a concerned student you believe that the current student database system is needlessly risky as it exposes private information such as name, address and social security number on the computer network.

    Students and parents rely upon the school board and administration not only to provide the best possible education, but also to protect their students' private inform

  • Get your parents to pay for his/her retainer. If you're in the Columbus, OH area I could refer you to one lawyer at least that would be ethical and fight for you at the same time. (He's not me, but I do know him well enough to know he's a good guy).

    Seriously. If you know that your personal ID info can be VERY easily obtained (as your posting indicated) then it's only different than if you were embroiled in trying to regain your identity through fraud because you're being pre-emptive about it rather than tr
  • (Slightly OT, but I've been meaning to bring this up, and my /. submission was rejected.)

    If you're in the mailing database of CCP [ccp.edu], you'll see your SSN right on the envelope, above your name and address. Someone must have realized this would be a problem, but instead of doing something real about it they just shift the numbers around. So if your SSN is 123-45-6789, then the address label looks something like this:

    45 ** 6789 123
    JOHN DOE
    123 FOO STREET
    PHILADELPHIA PA 19111

  • OK, so you know your own password and you can allow yourself to access your data. So, how about making a controled intrusion attempt?

    Try to see if you can obtain your own password over the wires or wireless. You know what you are looking for but it may be more difficult than you think, and hence you can avoid making a scene of yourself :-)

    Record the whole session, so you can replay it in front of the admin. A demo is often very instructive when people seem reluctant to believe you.

    You cannot be accused o

  • I happened to check the online site for my high school grades, too, and noticed it's on a HTTP, not HTTPS for pete's sake !

  • I was upset about them changing from using my SSN to a proprietary number scheme

    What? Are you saying you were content with them using your social security number as an means of unique identification? I am not sure about the specifics, but I know there is legal restriction involving using someone's SSN for anything but social security. Secondly, my university does the same thing, and I don't like the idea at all. Sometimes I have to fill it out on scantrons and other forms that include my full name. By la

  • Anonymity (Score:2, Interesting)

    by AgentOJ ( 320270 )
    Back in college, the same thing (more or less) happened to me. My school was using http instead of https for email, and the same password was used to access student information including DOB, SSN, etc. You also had the ability to add or drop classes with the same password. Since the school had "free" wireless access, and no form of network authentication, anyone could sit in the library and sniff passwords. I made the utterly stupid mistake of calling the "help desk," and the lout who answered accused m

  • From a guy in the IT Dept: (Score:3, Insightful)

    by tverbeek ( 457094 ) on Wednesday April 14, 2004 @05:56PM (#8863761) Homepage
    Do not under any circumstances use this knowledge of vulnerabilities to actually sniff passwords, gain access to information you're not intended to have, etc. If your college's Acceptable Use policy is anything like ours, doing so will be a violation. Full stop. AU policies never include an "unless you're doing it for a noble reason" or "didn't do any harm by it" exception. And if you were to catch me with my pants down, you can be sure that I'm not going to thank you for it; I'm going to throw the book at you, to make sure that no one else gets the idea of trying something similar. It doesn't matter if I'm negligent or not; that's just the prudent IT fear-mongering to discourage genuinely malicious hacking (of the kind you're worried about).

    Instead if you know people in IT, you can try going to them with your concerns, from a "hey did you know... it worries me...." perspective. If they're good people and well managed (but just didn't stop to think about it), that should help. If you don't have a friend there, or you hear that IT are a bunch of bozos, your best bet is to bypass them and take your concerns (as "I know enough about it to suspect this could happen", not "I know how to do this") directly to one of the offices charged with handling your student data (e.g. registrar, business office, financial aid). They're the ones who ought to be most alarmed over confidentiality problems (because they've had in-services driving the point home), and it'll be their bosses in the administration who'll have the authority to put the pressure on IT to do their job.

  • Find an admin who knows his shit, and wants to help.

    DO NOT sniff passwords, DO NOT send "ultimatums", just say "Hi, I've found what could be a security hole on the network. I can show you why it's insecure and how it could be exploited. I don't want anything in return, I just want to help you close the hole because it could uncover a hell of a lot of problems."

    Your ass is covered (you said you didn't want anything, can't be blackmail) and you might get a few brownie points out of it. If the admin responds

Slashdot Top Deals

E = MC ** 2 +- 3db

Close