Blackboard Campus IDs: Security Thru Cease & Desist

On Saturday night, Virgil and Acidus, two young security researchers, were scheduled to give a talk at Interz0ne II on security flaws they'd found in a popular ID card system for universities. It's run by Blackboard, formerly by AT&T, and you may know it as OneCard, CampusWide, or BuzzCard. On Saturday, instead of the talk, attendees got to hear an Interz0ne official read the Cease and Desist letter sent by corporate lawyers. The DMCA, among other federal laws including the Economic Espionage Act, were given as the reasons for shutting down the talk (but -- update -- see the P.P.S below). I spoke with Virgil this morning.

Virgil was there two years ago when Dmitri Sklyarov was arrested and led away in handcuffs at Def Con 9. He's not in handcuffs now, but in speaking to me, he had to stop and think about everything he said, and every third answer was "I really shouldn't talk about that."

The DMCA is largely to thank for that. Section 1201 states that no one "shall circumvent a technological measure that effectively controls access to a work," and that no one "shall... offer to the public... any technology" to do so. Blackboard Inc., whose card system is called the Blackboard Transaction System and known to end users under various names, uses a network of card readers and a central server, and they communicate over RS-485 and Internet Protocol -- using, or so they apparently claim, measures that effectively control access.

For the record, none of what I learned about the Blackboard technology was from him or Acidus after the restraining order was sent. I spoke to other people, who have not been served with a restraining order. Google has a less enlightening mirror of the slide titles from this weekend's PowerPoint presentation and a more enlightening mirror of Acidus's "CampusWide FAQ" from last July. And, most enlightening of all, this mirror has an updated version with details on what they figured out how to do and what their talk was going to be about (click "CampusWide" for the text description, the PowerPoint slides, and Acidus's timeline of the last year).

At many schools, Blackboard's system is the ID: you swipe your card for your meal plan at the cafeteria, to get into your dorm, maybe even to get your final exam.

A swipe at a vending machine will get you a soda -- a money transaction from your campus debit account. When you use a swipe to do laundry and make copies, money has to be involved. Blackboard even notes that they can set up a merchant network on- and off-campus: "a cashless, safe, and secure way to transact on and around campus while offering parents the assurance that their funds will be spent within a university-approved network." (Emphasis added. Maybe readers who go to schools that use such a system can expand on how that system is used.)

The kicker, of course, is that this network is not very secure, or at least Blackboard doesn't think it's as secure as... well, as lawyers. One anonymous Slashdot submitter wrote that: "The authentication system is so weak that [Virgil and Acidus] have been able to create a drop in replacement for the CampusWide network debit card readers used on coke machines on campus."

Virgil couldn't provide me any details about what he had learned about the system. Based on the mirrors, it looks like a man-in-the-middle replay attack -- which is a pretty simple attack, repeating messages sniffed over the RS-485 protocol, or even over IP -- can have effects like convincing a Coke machine to dispense free product. Or, it's claimed, the attacker can create a temporary card, with no name attached, and free money in its account. Hmmmmm.

Or, more ominously, someone else's identification might be sniffed, and then replayed from a security terminal. If a thief gained entrance to a building by sending the message "open the door, my name is John Doe," the real John Doe might be sorely inconvenienced the next morning.

So, if you're a student at a school that uses Blackboard, do you feel more secure now that the DMCA has tried to stop you from learning about its security flaws?

If you're a parent putting money into a Blackboard-based debit account, do you feel more confident of its safety now that this information is ostensibly hidden?

This card system has been installed on many campuses and its roots go back almost twenty years. My guess is that replacing the card-reading hardware would be necessary to improve the security of these devices. Obviously, Blackboard would be hard-pressed to replace thousands of hardware devices at all its locations, even if they'd started in late 2001 when Acidus claims he called to tell them of the flaws he'd found (and "was blown off").

So, assuming that's not possible -- is the DMCA a viable tool to ensure security?

P.S. Virgil tells me that he has a good lawyer. They are scheduled to argue on Thursday that the restraining order not be made permanent. Slashdot will keep you apprised of what happens in our Slashback stories... stay tuned.

P.P.S. Update: 04/15 02:30 GMT by J : Now online are the restraining order, which just lists the six things that Acidus and Virgil are not to do, and the more detailed Complaint. Now that these are available, as Declan McCullagh points out, it turns out the DMCA was only in the lawyers' threatening letter and not considered as part of the Complaint itself. I'm not sure why it would be included in the letter -- some of the language of the Georgia Computer Systems Protection Act is similar, and who knows, Section 1201 might be mentioned later on, as this case progresses. Maybe the lawyers are just keeping their options open. Meanwhile, I love this part of the Complaint:

"Mr. Hoffman openly acknowledges on his website that 'I am a hacker.' His website then defends the process of hacking. See Exhibit B."

Comments

Remember, Citizens

[RLiegh]

This in NO WAY implies we live in a police state.

Re:Remember, Citizens

[Lord Ender]

Not giving this talk could have saved the university from a rash of fraud.

Re:Remember, Citizens

[SeeJaneLane]

That's all he was trying to do. If you've done your homework and read Acidus' webpage (http://www.se2600.org/acidus/index.html), you'd know he went straight to the buzzcard office and told them about the flaws. Not only did they threaten charges against him, Blackboard tried to get him to sign an "I'm full of shit" document (which, if you've read the 2600 articles, he isn't). So, after they essentially told him to screw himself, he did the next best (capitalist) thing; he sought to put Blackboard, which markets a sub-optimal, falsely advertised product, out of business while increasing the market share. And, instead of waiting for some script kitty to f*ck everything around and steal, say, $1M from the computer lab or attack the girls in a locked dorm, he thought he'd _force_ Blackboard and the buzzcard office to come clean by exposing the system frauds. Instead, they've forced their lawyers on him, a 22-year-old college kid with 1/2 a degree and no assests; now, do you honestly think Blackboard is gagging/potentially suing Acidus because his article is _*false*_? Hell, no, they're trying to cover their ass before several major universities (currently with their heads in the sand) to stick their collective foot up it. Next time, "prince" Ender, perhaps you'll do your research before posting.

Re:Remember, Citizens

[surprise_audit]

That meeting with Blackboard should have given Acidus and Virgil a clue about how the public exposure would go.

Perhaps a better approach would have been to engage the interest of a local TV news station and arrange, with cooperation from campus security, a live broadcast of a break-in on a Coke machine. If the guys were suitably disguised (ski masks?) and the details sufficiently fuzzy to prevent casual replication by "script kiddies", I'd think they might get away with it. Especially if the news crew leaned heavily towards "the security provided by the cards is clearly crap", instead of "look what these hackers just did".

They wouldn't even have to name Blackboard specifically, just mention that the system so easily cracked is used by major Universities to "secure" thousands of devices, ranging from Coke machines to the girls dorm...

I say publish all the details overseas

[Marx_Mrvelous]

I wish there were a way to accidentally leak the exacty details overseas. There, it would be very difficult to get shut down, and every college using this system would have to deal with it.

While this may be an inconvenience to students, they can get by without buying coke with a swipe of a card for a while.

Re:I say publish all the details overseas

[Jeffrey Baker]

It is trivial to leak this kind of information. Walk into an internet cafe (or walk by any of millions of open 802.11b network) and upload the information to USENET. Problem solved.

Re:I say publish all the details overseas

[Marx_Mrvelous]

Now of course, I wouldn't have had this reaction if the company had taken steps working with the discoverers of the security flaw. If anything, they should hire/pay these researchers for their work, fix the problem, implement it, and then publish what went wrong. And who knows, maybe they even tried. I doubt it though, when a cease-and-desist can have the same effect.

Re:I say publish all the details overseas

[Acidic_Diarrhea]

Why isn't there a way? It seems like it wouldn't be that hard to drop a .pdf file onto a p2p network (call it how_to_get_coke_for_free_at_school.pdf) and watch the downloads begin. The point is that by doing it in this manner, the flow of information is limited to those people who are tech-saavy enough (I know, I know - you wouldn't have to know very much to download and view a .pdf file) to get the file. This prevents many of the people who really need this information, the administrators and parents, from getting it. The college kids can still find out because they've grown up with computers but the people pulling the strings won't know their system is insecure because their knowledge of computers starts and stops with Solitaire.

Re:I say publish all the details overseas

[Anonymous Coward]

I wish there were a way to accidentally leak the exacty details overseas. There, it would be very difficult to get shut down, and every college using this system would have to deal with it. While this may be an inconvenience to students, they can get by without buying coke with a swipe of a card for a while.

Yeah, I wish we had some sort of global communication network where you could instantly and anonymously post a piece of information, and people anywhere in the world could see it. Wouldn't that totally rock?

Re:I say publish all the details overseas

[gl4ss]

chances are that they knew _exactly_ how bad the system was, and maybe just hadn't care when they first made the system, maybe thinking that it would be such niche system or so it wouldn't need to be secure, or maybe it was some other system adapted to use where security would have paid off..

Re:I say publish all the details overseas

[archeopterix]

Now of course, I wouldn't have had this reaction if the company had taken steps working with the discoverers of the security flaw. If anything, they should hire/pay these researchers for their work, fix the problem, implement it, and then publish what went wrong. And who knows, maybe they even tried. I doubt it though, when a cease-and-desist can have the same effect.

Sadly, the reaction of Blackboard is a big hint to the future discoverers of security flaws: don't even try to contact the company - wear gloves, attach a fake beard, go to an internet cafe, publish your exploits on Freenet, Usenet, foreign haxx0r sites and whatever else comes to your mind, grin evilly (this part is optional).

Re:I say publish all the details overseas

[skillet-thief]

The same kind of thing happened in France. (Maybe it was on /., it was a few years ago...)

A guy figured out how to manipulate the chip on the smart cards used for credit cards. He contacted whatever company makes the cards to try to get them to hire him. They didn't believe him, so to prove his point he bought about $7.00 worth of metro tickets from an automatic distributor.

And then what?

They busted his ass big time. I think it totally destroyed the guy's career, life, etc. Then the company upgraded their encryption...

Re:I say publish all the details overseas

[mcheu]

Maybe, but with the current global environment, Freedom of the Press seems to be getting the short end a lot whenever the DCMA and its international clones come into play. Even now, when the DeCSS code is pretty much obsolete, they still can't publish the source code to it (though it's still easily found).

How much of a story would it be if the NYT and 60 minutes aren't able to disclose any details?

Re:I say publish all the details overseas

[jlk_71]

It would be interesting if the information made it overseas. So, has anyone thought of the fact that it essentially already is? If someone reads /., all they have to do is follow the link above to the mirror site that has this beauteous info. :)

jlk

Re:I say publish all the details overseas

[Anonymous Coward]

Ah, I've often shouted "POST IT ON USENET!" at the television screen whenever there's a movie or x-files/whatever episode where the hero is running away with the evidence/HotInfo trying to keep it from the Evil Conspirators.

They almost never do.

Re:I say publish all the details overseas

[Flabby Boohoo]

No, those chips are implanted in Trojan condums.

Re:I say publish all the details overseas

[Dylan Zimmerman]

No, no, no! If you want people do download it, you have to name it something like Naughty_(coeds|nurses|whatever)_hot_and_wet_4_U.pd f.

Re:I say publish all the details overseas

[Pharmboy]

Just get 2600.com to link to it.

*duck*

Re:I say publish all the details overseas

[Kilbasar]

The problem is that uploading the information to usenet is exactly what's going to happen. Corporate-types don't read usenet, but hacker-types do. What does that lead to? Some bored kid stealing all of my money, and only THEN is there a reaction from the company. I attend Cornell University, and I have to say, Blackboard is EVERYWHERE. We call it CornellCard. It controls all of the vending machines and meal plans. At least one door on each academic building and all the doors on the newer dorms are controlled by it. Not only can it be used to charge money out of our debit account (called Big Red Bucks), but it can be used to charge however much you want to your parents' bursar bill. The card isn't the only product Blackboard provides to schools. They also sell Cornell a web service called MyBlackboard. It allows teachers to set up websites for their classes. In addition to trivial stuff like assignments and lecture notes, the teachers use this interface to post test scores. Imagine all the havoc that could be brought upon this huge system simply because some exec decided it was more "cost-effective" to send out the attack lawyers than to fix their shoddy product.

Re:I say publish all the details overseas

[cpn2000]

The unfortunate thing is that this is exactly the kind of reaction that these stupid do-no-good laws will foster. It is unfortunate because when the evil person(s) who get their hands on these exploits use it to profit/wreak havoc/do evil/..., it will be at your and my expense, not at the expense of the company with the vulnerable product.

Re:I say publish all the details overseas

[jonadab]

Indeed. If they'd just thrown the information onto usenet in the
first place, no lawyer action would have had any effect at all.
The problem is, people[1] who find security flaws don't generally
*want* to post them to usenet: they want to work with the vendor
and the security community to get the problems _fixed_.

So here's the question: will these sorts of responses from vendors
force the security community into just giving up on all pretenses
of working with the vendor and just leaking everything to the
general public immediately upon discovery? That would be bad for
all concerned, but it might be better than being lawyered to death.
It's pretty easy to arrange to get something posted to usenet
with a reasonable degree of anonymity, and there's absolutely no
way to suppress anything that has been posted to a big-8 or alt
group, short of destroying the whole planet. But I don't think
I trust the security of a product whose vendor is sufficiently
uncooperative as to motivate a discoverer[1] of a vulnerability
to do things that way.

Maybe people who discover such vulnerabilities should discreetly
communicate everything they know to some third party overseas
first before doing anything else...? But you still have the
problem that if you try to work with the vendor they know who
you are and can laywer you, and you can be held responsible for
communicating the information to the third party.

Ah... but what if the original discoverer remained anonymous
and communicated to someone _else_ who would try to work with
the vendor, and if that failed the original discoverer or some
third party he communicates with could release the information
to the security community (and, in the process, the general
public)? This would be harder for the discoverer, who would
have to anonymously contact a trusted third party in the first
place whom he would have to trust to make a good-faith attempt
to work with the vendor. But if the vendor tried to laywer
the non-anonymous person, they'd run into "I just found out
from this here anonymous email and was trying to work with
you; this leak must have been perpetrated by the evil person
who circumvented your effective measure in the first place,
probably the same dude who sent this email, which seems to
have come to me from an evil open relay in southeast Asia,
one of the same ones the spammers use to send me special
offers for reduced-price copies of your products, which they're
probably pirating. Gosh, you should really go after those
open relays, they're all kinds of trouble."

[1] Security people, I mean. I'm not talking about blackhats.

Re:I say publish all the details overseas

[Spunk]

I'm surprised there isn't an alt.dmca.violation or something yet.

Re:I say publish all the details overseas

[treuf]

The chips used in French credit card are made by Bull - French computing company (Chip is called CP8, program on it B0').
I supposed you guessed why we have those useless chips - well just to make bull exist I suppose.

Among other things, what happened is that the 512 bit des key used to sign the card datas have been broken, thus allowing anyone with good electronic/programming knowledge to make fake cards with authenticated datas - which were then accepted anywhere where the payment terminal was not dialing to the central bank network (that's one of the purpose of those chips)

Now to save their asses, they upgraded the encryption to 768 bits - which will be fine till the new key is broken.
Anyway, cards can still be copied (data extracted and then put back to emulating cards) - which could be done with magnetic strip ...

What they are selling as an added value (really selling, you have to pay more) is that you can use those cards as a virtual walet with limited money - which you can use without PIN and recharge.
Just another way to use people's money.

Hope the explanation was clear :)

Re:I say publish all the details overseas

[hondo_san]

The story of Serge is here

Duh...

[c0dedude]

Well, if you aren't even able to TALK about security flaws *Cough*First Amendment*Cough* they'll never get fixed. The DMCA again makes the net less secure instead of more.

Re:Duh...

[adamruck]

im no lawyer but I think that talking about security holes vs. giving a lecture on how to exploit security holes are two different things, and the first ammentment only applies to one of them.

Re:Duh...

[BattleTroll]

Ummm, no. If Neo-nazis can parade down the street, hate-mongers can publish their diatribes, crosses can be burnt, and flags defecated on then by God the first amendment should protect academic discussion on security holes and their implications. Teaching someone how to pick a lock is not the same as breaking into Ft. Knox.

Re:Duh...

[harvardian]

Actually, the US Supreme Court recently ruled that cross burning is, in fact, illegal.

But the supporting opinions agreed that it should be illegal because it is a form of intimidation, and I don't think anybody believes that a presentation on the security flaws of a popular transaction system is intimidating...just dangerous to a certain corporation.

Re:Duh...

[JimDabell]

Ummm, no. If Neo-nazis can parade down the street, hate-mongers can publish their diatribes, crosses can be burnt, and flags defecated on then by God the first amendment should protect academic discussion on security holes and their implications.

Yes but none of this has an impact on a specific company's bottom line, it can't be quenched with a lawsuit, and you can't discredit the Neo-nazis by calling them "hackers".

Or are you under the impression that individual rights are as important as those of a corporation? What kind of commie are you?

Note to the less intelligent and more rabid Slashdotters: no I am not serious.

Re:Duh...

[ngrier]

Actually, IIRC, the article doesn't quite state the facts clearly. The supreme court was split in that it supported one case and returned the other to the lower court. It ruled that the two men who got drunk and burned a cross on their [black] neighbor's lawn did so for the purposes of intimidation and that this was not a protected form a speech. (see for example their recent ruling on the illegality of the anti-abortion websites posting "wanted" ads of abortion doctors.).

They did, however, uphold the right of the KKK to burn the large 30' cross as a form of protected speech (i.e. political, without an immediate threat of harm or intimidation). It was for this reason that Thomas dissented - his comments indicated that the history of cross-burning is such that there is never a time when cross-burning is not meant to intimidate.

So to return to the question at hand, the Supreme Court has clearly, multiple times, made a distinction between types of speech and that some are protected and others aren't. Regardless of the first amendment, you can't make threats on the life of the president (no matter how much of a ditz he is). Similarly, you can't give away state secrets. No matter how inane or ludicrous the DMCA is, there is a long precedent for restricting certain types of speech. (So the question of its constitutionality is not one that is easily answered.)

Re:Duh...

[TC (WC)]

and you can't discredit the Neo-nazis by calling them "hackers".


The easier method would probably be to discredit them by calling them Nazis.

Re:Duh...

[akmed]

I'm a law student, but this is NOT legal advice.

Assuming that Blackboard's security has a flaw, then the first amendment protects your right to say Blackboard's security system has a flaw in it.

The first amendment might protect your ability to talk about the flaw in general terms.

The first amendment does not protect your ability to instruct people about the precise details of the flaw and how to exploit it.

The difference? Saying there's a flaw is beneficial because then the company knows and can fix it. Saying how the flaw works and how to exploit it facilitates criminal activity.

Tell a kid that the kid who made fun of him is an idiot and someday he'll die lonely and maybe you'll have made him feel better.

Tell the kid that if he takes the gun on the table, points it at that other kid who made fun of him, and pulls the trigger that the other kid won't make fun of him anymore and you'll land yourself in jail.

In both instances you're talking about speech. See the difference?

And btw, picking a lock almost inherently involves tools. Possession of tools for picking a lock is a crime in most places if you're not a locksmith. Go ahead and ask a lawyer.

Re:Duh...

[TGK]

I wish I could mod you up, unfortunately I never have mod points when I want them, and always have them when I don't.

Your analysis of the case is dead on. It's key to realize that the Virginia statute says that ANY form of crossburing IS intimidation. It is this provision of the law that the Court had a problem with.

They remanded it to the lower court on orders that they either prove or fail to prove the intent to intimidate.

Coming full circle, this DIRECTLY applies to the topic at hand. What is the INTENT, not the consequence, of this proposed discussion. If the INTENT is to incite a rash of fraud and theivery then this is not protected speach. The Government must prove what is called "A compelling state interest" in cases of free speech. In this case it would be very difficult to prove that there is a compelling interest to regulate this speach, particularly if the intent is to FIX the problem not make it worse.

The DMCA has not yet seen a serious constitutional challenge. I know we have a lot of conservitives on /., but those of you caught up in this issue might consider sending a check to those crazy ACLU treehuging dirt-worshipers (my Father-in-law's phrase, makes me chuckle). I'm a bit of a leftist myself, but even those more inclined to the right should know that the ACLU is likly biding its time and waiting for a strong case to take to the top on this one.

Re:Duh...

[lar3ry]

Telling the company that you've found a flaw in their software is likely your best bet.

And, according to the story, they did that and... THE FUCKING COMPANY BLEW THEM OFF when they told them about the flaw months ago!

So... what do you do then? The company doesn't want to hear that it has an insecure product. And people are still using the product as if it were secure.

What do you do then? Simply shrug your shoulders and say, "Well, I tried to tell them. Let others worry about it, now." It's a sad fact that most people would actually do this... they are afraid of sticking their necks out for this very reason... it gives a very nice target for the lawyers' guillotines. Amerikan citizens have turned into domesticated puppies.

But the people that are willing to stand on principle... they are the unfortunate target of the DMCA: people that are actually tring to do the right thing!

I think the fact that this can happen is a sad state of affairs in the United Coporate States of Amerika.

No, it doesn't.

[Anonymous Coward]

A corporation is preventing you from doing something, which is their right according to law.

If we lived in a police state, armed thugs would not tell you, "You can't detail the flaws of our product." They'd just beat the living crap out of you and then go home, kick back, and drink a cold Coors 20 ouncer.

Re:No, it doesn't.

[nehumanuscrede]

A corporation who distributes flawed merchandise or software has every right to tell me to be quiet. I also have every right to a functional secure product that they claim to be pawing off on you. Perhaps hitting the corporation with a false advertisement lawsuit ( we sell a secure product, we swear ) in return would wake them up. ( Doubtful ) With our sorry ass congress/senate passing these bills as fast as they can, it's probably our only recourse until we boot the entire lawmaking body out of office and get someone with some sense.

Re:No, it doesn't.

[nehumanuscrede]

Think of America as the 'politically correct' police state. While the jackbooted-gestapo isn't kicking the door down and beating you. . . (yet) . . . they are instead getting law degrees, dressing in nice suits and suing you. It's much more profitable. It ultimately achieves the same goal. You tend to keep your opinions / comments to yourself.

Re:No, it doesn't.

[mickwd]

The trouble is, how can you win a false advertising law suit it no-one is prepared to do the research to find the product is insecure ?

Interesting, isn't it, in these days of terrorism paranoia, that laws like this ARE going to result in worse security ? Well worse security for the USA, relative to every other country in the world that doesn't (yet) have these sort of laws.

Re:No, it doesn't.

[Anonymous Coward]

Hello. Stupid. The corporation is using the law to prevent speech. The law is stopping someone from speaking. A prior restraint, stupid. This is the hallmark of a police state -- laws being used to silence the voice of individuals. Armed thugs will beat the shit out of him if he speaks -- they will attempt to kidnap him, imprison him, and extort money from him for this sin in the guise of arrest, detention, and fines by the police and court system. You have no idea what you are talking about, AC.

Re:No, it doesn't.

[PeterHammer]

You also don't die or suffer any physical harm, and with all the repeat "criminals" around, that ensures their future source of revenue. There is a far greater chance that you will repeat your offense if all you lost is some money (as opposed to your life).

Re:No, it doesn't.

[geekoid]

" A corporation who distributes flawed merchandise or software has every right to tell me to be quiet."

but that doesn't mean you should have to respect that wish.
How many things only get better because someone talks to the press?

Re:No, it doesn't.

[jodo]

A corporation who distributes flawed merchandise or software has every right to tell me to be quiet.
I strongly disagree with this concept of licensing, legal or eula restrictions preventing a citizen from speaking his/her mind about what is (generally) a consumer product. A "free society" that cannot freely discuss the products and services it purchases and uses is not a free society.

Re:No, it doesn't.

[berzerke]

...laws like this ARE going to result in worse security...

My thoughts exactly (for quite some time now). The true criminals won't care it's illegal. They will get and USE the information anyway, leaving someone else to take the blame. (Honest officer, it wasn't me who swiped the card to break into the dorm and rob people.) And since the system is <sarcasm> so secure</sarcasm>, who's going to believe the victim? Of course, defending yourself without access to the information that shows how insecure the system really is is going to be a <sarcasm>cake walk</sarcasm>.

It's been my experience (and looking at history, I'm not alone) that trying to ignore a problem (bring in the lawyers!) only makes it worse and more expensive. Sadly, common sense seems so uncommon nowadays.

Re:No, it doesn't.

[stefanb]

I think you have that backwards.

They might claim that my statements are not factual, libelous, and what not.

However, they shouldn't have the right to stop someone from proving facts about the company, it's products, services or dealings with others.

Of course, they try to contract you to be unable to do just that; did you have to sign an EULA for using your card?

Re:No, it doesn't.

[Pxtl]

No, they just take enough money from you that you and your family become destitute - and heaven help you if you have any conditions that require health coverage that you can no longer afford... wait, so if you have a serious condition, you do die. And possiblly dependant family members. Whoops.

Re:No, it doesn't.

[Hanno]

If we lived in a police state...

You alreay do live in a police state. Welcome to the real world.

Nazi Germany, which my grandparents and the older ones among my aunts and uncles lived in and can still talk about, was a police state. I guess you'd agree with that. It had thugs, sure, and beatings, sure, but most of the oppression in the first years of Nazi Germany was done through laws and intimidation.

Nazi Germany is known for its slaughter of its German-Jewish population, but they didn't go for that right from the start. First, they stripped the Jews and other unwanted individuals such as communists and members of the opposition from their jobs, their offices, their personal belongings, etc. It was a subtle step-by-step way of humiliating them, to take away their rights as citizens of a formerly democratic country. Because the Nazis could. Through laws.

Remember that while there was a majority of Germans who supported Hitler (I know that my grandparents were Nazis, and I'm not exactly proud about it), the German population was nonetheless afraid of being the next ones the state put an eye on. State-organzied neighbourhood watch was an easy method of intimidating the population into following party orders. Suddenly, your neighbours could turn you in, and the laws were broad enough that simple things became violations of the law. At some time it was forbidden to listen to non-German radio and news. Older Germans still talk about how afraid they were each time they listened to news or jazz music on the BBC, afraid that some neighbour might tell the police about it.

Watching what is going on the United States right now is a very frightening thing for someone who has a personal perspective on fascism.

I consider the US a great country and a great concept, I have the highest respect for the US, but never have I been more afraid of your government than now. The laws and rules that your government is putting into effect now - with surprisingly little complaining by the general population - is indeed the road to a police state. You're already halfway there, and it is getting worse.

Re:No, it doesn't.

[kubrick]

A corporation is preventing you from doing something, which is their right according to law.

When common sense is outlawed, only outlaws will have common sense.

Re:No, it doesn't.

[nehumanuscrede]

"Since when does revealing such information about a flawed product that would allow anyone to exploit that flawed product to engage in illegal activities equate to "rights"?" When it has a profound influence over what products I choose to buy. I'll be damned if I'm buying the inferior product if I know about it. If you wish to use lockpicks as the example, no problem, I'm game for it. I own not one, but TWO sets of lockpicks. ( I wore my first set out ) I am quite proficient with them. I understand how locks work and why some locks are better than others because of my study and use of the lockpick. Knowing how the criminal mind works is the first step in defending yourself or your property against one. Do you actually think that by imposing laws / limits on distributing this kind of information is going to make you and / or your valuables any safer? Do you not perhaps think that if you had the same knowledge as I about locks, that you would be more careful in your choice of locks to protect your things with? You know the locks they advertise can take a bullet and stay locked? ( Won't name any names here. . . you know why ) You're probably thinking " That's a pretty secure lock. " Couldn't be further from the truth. If someone actually bothered to use picks on it, the average lock of that type, can be bypassed in less than thirty seconds on a very bad day. ( My record is less than ten seconds ) If this information was publicly known, they probably wouldn't sell many of those type locks now would they? This is why this information needs to come out. The average person simply accepts what they see / hear as gospel and that's it. While the knowledge of lockpicking can be used for ill purposes, the same knowledge can be used to defend against it. No one is condoning the theft of anything, but an informed user is a much tougher target than an ingorant one. Just because I have the know how and tools to commit a crime, does not mean I will. ( Haven't as of this writing ) Yet, because of human nature, someone will surely take up the task for me. You have a choice, you can either be a victim of ignorance, or not. Condoning the laws that keep the public ignorant, effectively puts them at the mercy of those who will use this information to further their own agenda.

I know a little about this...

[Probius]

Our school uses blackboard, and last year the machines were shut down for a long time because students used methods to get free stuff out of the snack machines. And I'm not talking cracking a case or making a fake card either. It was really simple too, like swiping really fast after the transaction, if I remember right, and you could get a second item for free. Kinda scary.

Re:I know a little about this...

[orthancstone]

Do you know what your school did after the incident? Did they do anything to try and increase security for the system for future prevention?

Re:I know a little about this...

[JahToasted]

The sentence "swiping really fast after the transaction" is a violation of the DMCA. Seriously.

Re:I know a little about this...

[Blue Stone]

The sentence "The sentence "swiping really fast after the transaction" is a violation of the DMCA. Seriously." is also a violation of the DMCA.
Repeat ad infinitum.

obviously not

[ih8apple]

To answer the question "is the DMCA a viable tool to ensure security?"

Here's an article from the BBC.

and here's a good presentation from toorcon.

and lastly, this is a good article from ITWorld.

Freedom of the press?

[Tiger Smile]

That freedom has taken a back seat to congress' lust for power and money.

We should look for other ways to take on the DMCA. IANAL, but the following link is to an interesting case, about fedral powers. I have some doubt, but maybe this is a method to bypass the DMCA.

http://supct.law.cornell.edu/supct/html/93-1260. ZO .html

I am very interested in what people think. Any ideas?

Ps: Why aren't techies lawyer? Oh, and why look at http://www.lp.org They hate the DMCA also.

Re:*cough* Clueless *cough*

[intermodal]

actually, it does. Thats the point of a free press. An informed public is necessary to maintain ones freedoms, but i guess we already missed the "informed public" boat too early to avoid draconian laws like the DMCA anyhow.

Money

[nehumanuscrede]

Cease and decist letters get written when someone threatens anothers money making schemes. To fix the problem costs money, to scare individual X into keeping their info to themselves is much cheaper.

What about this analogy

[Anonymous Coward]

Say that a random person on the street finds a crack in a banks wall that allows intruders to get in, tack the cash, and run away. Should the person start holding seminars about how there's such a vulnerability, or should the person go tell the bank so it can fix it?

Initially, the later case seems like the thing to do. But what if the bank ignores you? Should someone be allowed to convey information about a problem with a system if the system controllers refuse to fix it? I'd still think not - it'd be one thing to state that there is a vulnerability, and that in good conscience could not state what the vulnerability is, and quite another thing to go explaining the vulnerability to everyone else.

Just my 2 cents, and as always, there's probably more to the story.

F-bacher

Re:What about this analogy

[Frobnicator]

or should the person go tell the bank so it can fix it?

They DID try to tell the company, and were "blown off".

But what if the bank ignores you? Should someone be allowed to convey information about a problem with a system if the system controllers refuse to fix it? I'd still think not - it'd be one thing to state that there is a vulnerability, and that in good conscience could not state what the vulnerability is, and quite another thing to go explaining the vulnerability to everyone else.

This is something compuer security has had to deal with for quite some time. The normal ethical guidelines are to first contact the vendor and attempt to work with them to find a solution, and release the information once the vulnerability is corrected. If they either ignore it or fail to correct the problem in a reasonable time frame, the consensus is to take the problem to the security experts and users of the security system generally. This is based on the theory that criminals may already have such knowledge, and therefore the users need to know in order to protect themselves.

Hope that helps with your question.

Re:What about this analogy

[tulare]

I actually had something like this happen once. I went to a drive-up ATM at a bank I once used, and the machine was literally unlocked - there was a sort of swing-door arrangement where the whole ATM would open on a hinge sort of like some switch stacks do, and it was broken open. I decided not to stick my card in the machine and instead drove away to a payphone and called the bank.

Amazingly, the people on the other end gave me attitude when I called to tell them that their ATM was broken open - the attitude switched between "it's not my problem" and "you must have done it." At no time did I believe that they were actually going to do anything about it.

Two months later, when I was back in that town, I went to the same ATM, and the lock was still jimmied - it was closed, but obviously broken so that it would be a matter of prying with a screwdriver to open it again. I guess a couple of thousand bucks in cash and whatever private details can be gleaned from endorsed checks and deposit slips are unimportant to bancs of, um America.

Re:Again?

[MKalus]

Not anytime soon.

Most people in their daily lives aren't directly affected by it (or not to their knowledge at least).

Most of the places that bump into the DMCA right now are the academics. Why? Because they are a bit ahead of the curve, the idea to undstand things is integral to them. Most people though are just consuming the final product, as such they won't be affected for a while.

Wait a bit longer until the product Johnny wants to buy (or an update to a Software he is using) can't be had anymore because the developer wasn't allowed to incorporate the functionality because of the DMCA.

Of course by then the question is if the masses will still care (I bet not).

M.

good for students, not for administration

[Anonymous Coward]

Where I went to undergrad there was a debit card system that was also unsecured (unknown company). This was actually a nice thing, as it effectively meant everything was free for engineering students (vending, meals, ?), with the rest of the student body picking up the tab. I was all for the poor protocols at the time. It?s the administration, not the students or parents that should worry...

And yes I realize this is immoral and wrong, it was more a thrill thing at the time.

Is this SLAPP?

[dacarr]

Considering the nature of the security flaws and that they are now exposed, can this legal action against Virgil be challenged under SLAPP clauses?

Companies hurting themselves

[Blue23]

You know a C&D letter may stop people from disclosing exploits, but will not stop people from disclosing that their are exploits. That's enough for lots of poor, enterprising college students.

A much better plan would of been to let these guys give their talk, to hire them, fix the problems, and them make a bundle in upgrades to existing customers. Come on, if some of these installations are 20 years old we're not talking much more then maintenance revenue. On the other hand system upgrades, especially when demanded by parents, can net a pretty penny. The colleges could have fund drives, hit up alumni societies, all the normal ways to get money when something unexpected walks through the door.

Instead the company gets to look like a fool that knows there are security flaws, aren't fixing them and instead are wasting money on laywers, get getting bad press.

Oh well, I guess there is no such thing as bad press. And that companies would rather think about prestige short term then a better product long term, even if the better product will get them more money.

=Blue(23)

"Power Point" is a trade mark, not a thing

[t_allardyce]

"remove all references to Blackboard and its Transaction System from any website, power point presentation, seminar handouts, or any other promotional materials"

Why so Microsoft centric? does that mean they can use OpenOffice.org "Impress" presentation slides instead? Does that also mean Microsoft can sue the lawers for use of their trademark in their document?

it's over

[HBI]

Time to stop being a geek. I'm getting my pencils and paper back out, doing RPGs that way, and selling off my 7 or 8 computers.

I can see the writing on the wall just as easily as anyone else. The joy that I got out of these marvelous toys just isn't worth it anymore. It used to be liberating, now it's just torturous. I can think of dozens of ways to get thrown in prison just by playing around with my system at night after work. Tinkering and exploring are forbidden. I'd rather be an insurance guy or something similarly boring then spending part of my life in a 4x6 cell, or even living in fear of same.

Just proof once again that anytime government gets involved with anything, it sucks all the fun out of it. All in the name of equity and greater corporate profits.

Re:it's over

[HisMother]

I can think of dozens of ways to get thrown in prison just by playing around with my system at night after work.

The same could be said of cameras, chef's knives, wood chippers, and table saws. Does this mean that photographers should live in fear of accidentally creating child pornography, or chefs of accidentally dismembering their lovers? Nope. C'mon, buddy, you've got free will, you may recall. If you're not interested in fighting the laws, then just keep your nose clean. It's not rocket science, and it ain't the end of the frickin' world.

Re:it's over

[dubl-u]

Time to stop being a geek. I'm getting my pencils and paper back out, doing RPGs that way,

Uh, I hate to tell you, but if you're tring to stop being a geek you're on the wrong track. :-)

I'd rather be an insurance guy or something similarly boring then spending part of my life in a 4x6 cell,

Man, you must not have spent much time at an insurance company. 40 years at an insurance company is roughly the same number of hours you'd spend in a 10-year prison sentence, and the cells are about the same size. And at an insurance company, nobody ever gets time off for good behavior.

Re:it's over

[Qzukk]

Yes, the same could be said, but unlike photography where you have to take a picture of a child to make child porn, did you know that a major entertainment company once convinced a judge that your DVD player makes a copy of the DVD to play it (naturally, this copying was only authorized in authorized DVD players, using any other player was to be considered unauthorized copying, they insisted). Just keeping your nose clean means nothing when the RIAA starts to insist that because your speaker level was above 20%, you owe royalties for every one of your neighbors because they might have been able to hear your music too.

The fact is, the people in charge are so technologically incompetant that the laws they wrote are being rewritten in legal precedents as companies twist them and the weak minds of judges and juries. The DMCA could have been a great copyright protection tool. Too bad it now covers everything from Wal Mart's prices to garage door openers, a far cry from its intent. How long before the internet is illegal under the DMCA and everyone with a computer is fined for possession of a circumvention device?

So yeah. You have free will. You can choose to live your life on the straight and narrow. And you'll even get away with it as long as the MPAA, RIAA, or someone else doesn't want your money. Or you can sell your computers and live like a hermit.

Just like the unibomber.

Is this the most correct channel?

[sabinm]

Surely Acidus and his colleagues informed the Universities about this before they went public with this information. That is of course the most effective way to get the system to change. . . Imagine inviting the Dean of Purchasing and Procurement to a Coke and a Apple pie on campus and using a facsimile of his id and account to pay for it. Or even more fun - - getting a sweet new laptop at the bookstore with a hyper-inflated account balance. Most certainly then Blackboard would think about upgrading their machines. Announcing that you are going to circumvent their digitally encrypted system in public, no less, simply gave Blackboard a way to facilitate their illegitimate hardware and polices and making it legitimate under the cover of an unjust law.

As my good old Uncle Scrooge always said: Work Smarrrrrterrrr not harrrrrderrrrr

Re:Is this the most correct channel?

[FortKnox]

What's silly is that Blackboard is, in no way, in the clear. They know this. The circumvention WILL get out, and it WILL spread, and Blackboard KNOWS this.
What they are doing is slowing the process down so they can create a fix, and implement it before everything goes nuts on tons of college campuses

Re:Is this the most correct channel?

[robslimo]

What they are doing is slowing the process down so they can create a fix...


WADR, I disagree.

In reality, they're probably running around in circles, not sure what to do. They may wind up doing just as you said, maybe to the point of backing off with the legal threats once they've got a handle on their technical and marketing response to the issue. I think they're scared and lashing out anyway they can.

The cat's outta the bag. Maybe they didn't expect this publicity from their legal actions but I can't believe that... and maybe the adverse publicity doesn't matter.

Dumb move in the long run or not, when they cool down, I bet they'll just stick to their present course. If they can stop wholesale dissemination of their technical flaws, perhaps dealing with the individual, rare case of exploitation (based only on the knowledge that there *are* flaws) can be done under the radar and on the cheap.

Freedom?

[AmbyVoc]

So the legistlation in the US no longer supports freedom of speech? God bless America, again.

You should really consider switch to using GNUnet/Freenet solutions for distributing such information there since it seems the Government there is just too restrictive.

I bet the NSA & Co. are after me now for whatever reason they can come up with... truth hurts yea I know...

- Voice of Ambience -

Stupid. Typical.

[jasenj1]

If guns are outlawed, only outlaws will have guns.

If hacking is outlawed (and talking about it), only outlaws will know how to hack.

So who do you get to sue if someone makes a dupe of your ID card and raids your campus debit account, or breaks into your dorm room? The school? The hacker? The company that sold the school the lame ID system they claim is secure but is not?

I would think the schools would like to know why sodas, meals, etc. are disappearing from their supplies. Hmmm.... This Coke machine is empty, but only 5 Cokes were recorded to be bought from it. Hmmm...

This is the worst kind of security through obscurity.

- Jasen.

Re:*cough* Clueless *cough*

[HeghmoH]

Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances.

Sounds to me like "you can say what you want, when you want, and no consequences" to me.

Re:Another way to go about this?

[Dyolf Knip]

Obviously, Blackboard would be hard-pressed to replace thousands of hardware devices at all its locations, even if they'd started in late 2001 when Acidus claims he called to tell them of the flaws he'd found (and "was blown off").

And you know very well that this is not the first time this sort of thing has happened.

Oh no! Not again! (And again, and again, ...)

[Ungrounded Lightning]

How many more times are we going to hear about the DMCA and the extreem mesures some companies and people will go to use it?

Probably a couple per week until the damned thing is repealed or struck down.

When will the DMCA start getting some media attention outside of /.?

When there are media outside of /. that aren't part of entertainment conglomerates that are pushing the use of the DMCA to "protect" their "content", or by conglomerates that also own proprietary software vendors who are using it to "protect" their software products from reverse engineering, exposure of security flaws, and/or competition.

The DMCA strikes down a lot of rights that many people hold near and dear. I don't know about the rest of /. readers but I [am] disgusted by the DMCA.

Your opinion is widely shared.

Hey!

[Grendel Drago]

How come we can post Win2k3 serial keys in the slashdot forums, but no one posts how to get phr33 as in c0ke c0kes? Sheesh. What bullshit.

Come *on*, someone toss a practical exploit in here!

--grendel drago

Re:Hey!

[mkldev]

Well, first you take a crowbar... no, wait. :-)

Re:Hey!

[yack0]

From: The law firm of Dewey Cheatem and Howe
To: mkldev
Subject: Cease and desist

Sir/Madam,

Due to your recent post on the 'news' site 'Slashdot', we issue this cease and desist hereby ordering you to refrain from describing any manner of breaking security methods for refreshment beverage machines. Your suggestion of "...first you take a crowbar..." is in violation of the Digital Millenium Copyright Act.

or something like that ;)

Re:Hey!

[Anonymous Coward]

At my university (we don't use the Blackboard system), people figured out that if you swipe your card, unplug the machine's network cord, buy your drink, and plug the cord back in, you wouldn't get charged. There was even an article in the school paper where a university official warned students that the machines keep track of failed purchases, and they will be caught if they do this repeatedly. A few of the machines had cages around the back to prevent this, but on most of them you can easily access the network cord. I don't know if the machines are connected to the campus internet, but with a machine on every residence floor it would be easy to install a hub, run some cable to your room, and sniff traffic.

You could also get free food, drinks, and laundry if you used the machines when the card system was offline (this happened at the same time every week, I'm assuming the database was down for maintenance or something). You couldn't always get free food (although I once saw people completely clear out a set of vending machines), but when your food purchases failed, it was generally a good time to do free laundry (laundry purchases never failed, even if the system was down - I guess they didn't want people to be unable to dry their wet clothing). It's best to do this when you have no money on your card, then there's no risk of being charged later.

Building security was (and is still) pretty weak. Access is controlled by cards at night (different cards from the vending machines), and I don't know of any way to circumvent this system. But generally, there was at least one door on each building that was never locked (sometimes the doors were locked, but pushing the button for the automatic door opener would open them). Many of the buildings were linked, so one unlocked building could give you access to several locked buildings. IIRC, there are only 3 or 4 buildings locked securely at night.

Re:Another way to go about this?

[Anonymous Coward]

This is a snippet from Acidus' old website. It relates the timeline of events. I hope you enjoy.

Sorry for posting AC but since this does come from Acidus' website ....

Spring 2001 - I got interested in the Buzzcard network on Campus. Based on the AT&T logo, I went to the Internet and soon found out about the system. Lots of Web research done, and fieldwork on the connection between the device and the reader. Locked Cabinet with Multiplexes was opened and photo was taken of insides. Determined which wires to cross to make doors open, laundry machines get credited, etc.

Summer 2001 - Continued exploring the system, called the company (now Blackboard), and interviewed Jim Resing.

Fall 2001 - With Publishing of my Fortres article, increased last minute field research, and finalized my notes. Called Blackboard again to tell them all the flaws I found, was blown off.

Spring 2002 - Wrote Article, and was published in Spring 2002 issue of 2600.

6/2002 - Blackboard learned of my article. The Blackboard Usergroup tried to track me down; finally figuring out I went to Tech, saw my web page and was very upset. Concerns about how accurate my article was are posted by schools around the country to the list-serve. GT tells the list-serve that they are looking into it and they would reply again soon.

GT Police asks to speak to me to determine if crime was committed. GT Police never file charges and indeed I am told there is no long an investigation. Buzzcard Office conducts internal audit of their systems. I go to Buzzcard office unsolicited to try and assist them in securing their system. They were not happy to see me. Office of Information Technology (OIT) on campus starts a test of the Buzzcard system to see if any of the attacks described in article are valid.

Buzzcard office asks that I remove picture of inside of the locked cabinet from my web page (since its hosted on GT machines), which I did. Buzzcard center asks me to remove AT&T cached pages, which I refuse to do. (Its not theirs, if AT&T wants it down, they can ask me).

Buzzcard office reluctant to talk with my about my article, since they don't want to confirm or deny how accurate I was. They do confirm the VTS could be hacked and money can be added to any accounts as I describe. However parts of my article (namely how to clone a card through the VTS), are, they claim incorrect. They ask if I would write a letter for the list-serve that explains what parts were incorrect. I agree as long as my letter will be unedited, and I get to also stress what parts are accurate to let colleges learn what they need to secure. Buzzcard office agrees but continues to cancel my meetings with them and not return phone calls. I am contacted by several colleges that are on the list-serve. They tell me that Tech has all along been posting that they have interviewed me, that my article is totally false. Tech uses such loaded statements as "As any experienced administrator should know, these security holes are not possible." These colleges are concerned Tech is not being truthful, and want to talk to me. I see that the Buzzcard center was stringing me along, and cease my attempts to contact them, or help them fix their pathetic security.

OIT concludes their investigation, and confirm that everything in my article is correct, except about how to clone a card. Tech does not post these results to the list-serv.

Dean of Students is involved, and is checking to see if, while no laws were broken, if I broke institute policy.

my experience with it...

[JimBobJoe]

After I left the Ohio State dorms in 1998 (I'm still a student) the university started to put card readers on the dorm entrances (up to that time either you had a key that opened both your dorm room and the main entrance, or you had two separate keys if you lived in a really big dorm.)

It does offer some advantages, for instance, all people could be allowed into the dorms at some parts of the day, but other times of the day only people who live in that dorm could gain entry.

Though there are some interesting caveats

*the first one, which I didn't really know well at the time, is the fact that making a copy of the card is far easier than making a copy of the key. Remagnetizing magnetic stripes is not the hardest thing in the world.

*the campuswide system runs off of ethernet to the AT&T9000 computer which administers everything. If a particular door gets disconnected with the central computer, it's default setting is to pretend like everything is normal, and let everyone in, and it has a cache of swipes which it would then transmit back to the central computer when the connection was restored. That seems like a sensible kludge given the circumstances, given a network failure it would be more sensible to allow all in as opposed to all out, especially at a dorm. (Higher security places would have their door failure mode set to allow no one.) On the other hand, as a security concept, it just bugged me. (this is explained in the powerpoint presentations.)

*my big concern at the time was the tracking and auditing abilities, and it still is. the key system had no tracking and auditing. The swipe system allowed the university to keep a record of when students come into the building (and implicitly, when they go.) I pointed out that Ohio law prohibited a government institution from collecting information which were not authorized by law, nor required to achieve a particular purpose...and that the system need not perform the tracking, it only needed to perform the authorization.

The response I got was that the system was not designed with a zero tracking/auditing setting, it needed to perform tracking and auditing as part of its authentication mechanism. I pointed out that I can't help that the university bought a dumbass product, and I threatened to sue them, but I was young, and I threatened to sue everyone. :-)

I got a letter from the university lawyers saying "While we ourselves certainly hope never to need the archived data -- and, fortunately, rarely do -- it can be of unquestionable value in
investigating incidents in the residence halls. It is for this very reason that similar systems are in use at numerous colleges and universities
around the country."

I've however pointed out that any idiot who was gonna do something in the dorms would do what everyone else does, and that is follow someone who swiped before you, and not swipe themselves.

I still hope to work on this issue at some point. :-)

Re:my experience with it...

[Kombat]

I've however pointed out that any idiot who was gonna do something in the dorms would do what everyone else does, and that is follow someone who swiped before you, and not swipe themselves.

It's not always that simple. You ignore the case where the person had no intention of committing any mischief when they arrived at the dorms. They showed up for a party, drank a few too many beers, got carried away, raped someone and ran. The next day, they're questioned by campus security and deny having been in the residence at all.

But their card was swiped.

Re:my experience with it...

[limekiller4]

JimBobJoe writes:
"Typical lawyer response, trying to appear I was addressing one thing while I was addressing something else."

It wasn't signed "Iraqi Information Minister," was it?

Re:*cough* Clueless *cough*

[Ungrounded Lightning]

Congress shall make no law [...] abridging the freedom of speech, or of the press; [...]

Sounds to me like "you can say what you want, when you want, and no consequences" to me.

What you want, yes.
When you want, yes.
No consequences, no.

The amendment has been interpreted to mean that the congress can't stop you ahead of time, but can set up rules for punishing you after the fact if your speech meets certain criteria. (Like harming others, soliciting crimes, or otherwise interfering with a "compelling state interest".)

While I'm with you on this one (the GOVERNMENT shouldn't be setting up any content-based penalties for speech, before or after the act), the Supreme Court says otherwise. And there's no appeal beyond the supreme court - which is why it gets to rule on the constitutionality of laws and have the rules stick.

(Oh, well. They say two out of three ain't bad...)

Re:Try dotLRN - the Free and Open Source alternati

[pythas]

You're thinking of another thing called Blackboard.

Way to read the article, champ.

I have a OneCard

[Feztaa]

I'm a student at the University of Alberta, and I have one of these OneCards.

There are various machines around that let you deposit money onto your OneCard, but there is no "university-approved network" of stores that accept the OneCard as payment.

The OneCard is primarily used for borrowing books from the library, and for operating the photocopiers/printers on campus, and there is exactly one vending machine on campus that allows you to pay with your OneCard.

As for people living in residence who have meal plans (like me), there's a separate card for that, provided by Aramark. To get into our dorms, we have keys. Laundry is coin-operated. The OneCard has absolutely nothing to do with the on-campus residences.

For most finals and midterms, we're required to show our onecards and/or driver's licenses as photo ID, but the OneCards aren't swiped through a card reader or anything, it's just photo ID, nothing more.

There are restricted areas on campus that you can access by swiping your OneCard and punching in a secret code, but as a first year undergrad, I don't have access to any of those places so I can't say what it's like (though for most of the places that aren't top-secret nuclear research facilities, it's almost trivially easy to get in by walking in when somebody else walks out -- we're friendly here in Canada, generally we hold the door open for people we don't know).

So, if you're a student at a school that uses Blackboard, do you feel more secure now that the DMCA has tried to stop you from learning about its security flaws?

Gee, I dunno. This is Canada, there is no DMCA here (as far as I know, anyway). Hopefully some Canadian security researcher will hear about this, and continue the research here...

How dangerous will this get?

[immortal]

Forget the financial problems this has, what about personal safety?

If someone can gain entrance as John Doe, then they could gain entrance as Jane Doe. But with the intent of harming, raping, or killing someone. Whether its someone unknown or a jealous ex-boyfreind, the court should be focusing on the company that made this and forcing them to fix the problem instead of ignoring the danger it poses to students on campus.

Its been nearly 20 years since I was at college and I remember using a lock system were you had to remember the 5 digit key sequence to get into your room. Thats a hell of a lot more secure than this card system, and its 20 years old.

The best intermediate solution to the DMCA should add a provision that recognizes when violations of the DMCA poses a clear threat to the safety and security of people. Then later they can tear the whole thing down.

DMCA=Gun Control=Thought Control

[Scot Seese]

So.

Instead of fixing the exploit in their keycard system, the company in question finds it easier to have their lawyers drop a house on the students.

Doesn't "Security through Obscurity" create an environment where persons with malicious intent are free to exercise it?

The students discovering the security hole = The Good Guys. The knowledge they posses equal a Munition (or, a firearm.) They were not planning to use their knowledge maliciously.

Essentially the DMCA has turned knowledge into a weapon to be regulated through the legal system. Just be careful what you know, because speaking of it publicly is becoming the 21st century equivalent of pulling a gun out of your pocket at the mall to discuss it's function with another gun enthusiast.

Of course, we all know the gun paradox. Seriously. Increasingly orwellian gun laws !=less crime. Criminals will always find weapons. On the electronic mean streats, crackers & hackers will always find exploits, but unlike the Good Guys, the Bad Guys won't go to a symposium to divulge the PROBLEM, embarassing the company into FIXING IT. Instead, the Bad Guys will EXPLOIT the FUCK OUT OF IT.

I'm not a philosopher, psychologist, ethicist or sociologist by profession, but perhaps the DMCA needs to be re-evaluated by a panel consisting of a few. Right now it seems to favor only the government and very, very large corporations. Oh, and it makes learning a criminal act.

Do you have a permit for your mind?

A gagged presentation.

[CPgrower]

This is a perfect opportunity to speak about the chilling effects of the DMCA and how it was used in this case as an effective short term "gag" order through a "cease-and-desist" letter. The mere mention of the inability to speak implies too that there's not only something wrong with the DMCA but a security flaw in Blackboard's system. The best solution is to give this presentation as much publicity as possible; only then will the public realize the ramifications of the DMCA. Every such incident should be reported in a big way until it hammers the point into the ground.

rob

Re:Could someone please not be a wuss about this?

[ccoder]

We are standing up and fighting it. In the past 48 hours, the local CBS station (who would be doing more, but needs more validated information which they don't yet have), Salon.com and a few other _news_ organizations have been very interested.

Subscribe to root@se2600.org (root-subscribe@se2600.org) if you want to chat with the locals about this... or have tips. The con organizers for likely reasons can't comment on enough information, but other people have... more information.

-Iridium (on that list)

False advertising?

[BlueFall]

IANAL, but could someone sue the company for false advertising? If they say their product is safe and secure, but you feel it isn't and you are a user, then shouldn't your be able to bring a case against them? At that point, you have to present evidence for your claim and (assuming the court records aren't sealed) the exploit becomes public record.

Trade secrets and the Economic Espionage Act

[Animats]

The Economic Espionage Act of 1996 is worth reading. It's overly broad, and its definition of trade secrets is broader than that of the Uniform Trade Secrets Act.

Trade secrets used to be frowned upon by the law. Patents were legally preferable, so that when the patent expired, the knowledge went into the public domain. A trade secret could be lost easily; any publication by anybody erased trade secret status. All trade secret law really did was to put some teeth into confidentiality requirements for employees. It didn't affect outsiders.

All that has changed in the last decade. Between the Economic Espionage Act, the DMCA, and several court rulings, trade secrets now look more like property rights.

DMCA isn't about security

[Planesdragon]

So, assuming that's not possible -- is the DMCA a viable tool to ensure security?

The DMCA isn't about secruity--it's about copyright. Read the DMCA, also known as Chapter 12 of Title 17, USC, and decide for yourself.

IMO, the law should either be moved to a general security law, or it shouldn't be interpreted to cover anything except the aiding and abeiting of real anti-copyright infringment sale aid--that is, unless a device is intended to protect a document that's transmitted / broadcast, the DMCA shouldn't touch it.

Then again, these are new positions for me--reply and you might change me again.

Re:*cough* Clueless *cough*

[peter hoffman]

It doesn't.

You are not allowed to shout "fire!" in a crowded theater.
You are not allowed to using "fighting words" (words intended to incite violence).
You are not allowed to threaten people.
You are not allowed to libel or slander people.
You are not allowed to be "obscene".

http://www.educause.edu/ir/library/html/cem9732.ht ml

DMCA how?

[Sloppy]

Anyone know what the copyrighted content that is protected by this technological measure, could possibly be?

If it's something within the school, then the makers of the system wouldn't really have a DMCA complaint against researchers; the school (user of the blackboard product) would. (Just as MPAA, not DVDCCA, are the ones who had DMCA complaints when knowledge of bypassing CSS got out. It's the copyright holder of content who gets to use DMCA, not the inventor of a protection mechanism.)

Assuming the blackboard lawyers actually see a way to use DMCA and aren't just trying to intimidate (hell of an assumption), then the copyrighed content must be some artistic expression within the Blackboard system itself, rather than something the system is intended to protect.

If the copyrighted expression turns out to just be the serial number on a card, or something like that, then that would be very (*cough*) interesting.

Re:DMCA how?

[Sloppy]

No. That's a particularly bad example. Even the graffiti in the bathrooms would be a better example than the books in the library.

In my (admittedly perhaps quaint) part of the country, cards are only needed to "check out" books (i.e. remove them from the building). You can still enter a library and access the books, even without a card. Thus, the technological measure does not effectively limit access.

And then there's the issue of who holds the copyright on the books. Unless it is a very special library (i.e. only contains books published by the school's press, itself) it is likely that almost all the books have no conditions for access imposed by their holders.

Patent your exploits

[scrotch]

The only sane thing to do is to patent your exploits before you announce them. :)

Then you have precedence for publishing them, or you just point to the online patent info.

As a bonus, you can sue the companies that fix the holes you're supporting because they've broken that "shall circumvent a technological measure that effectively controls access to a work" line. After all, your exploit controls access, right? Opening a door is controlling access as much as locking it is.

I presume Blackboard is a technical company?

[mykepredko]

Reading through the C&D letter, I have to wonder who approved it from Blackboard's perspective and if anybody technical thought through what may be the result of it is.

There sounds like there is enough information in the letter so that somebody that knows what a 75176 is (I would disagree with the assertions in the paper about RS-485's obscurity), can program a PIC or an 8051 and can use an oscilloscope can reproduce the work done by Messrs. Griffith and Hoffman. Along with this it sounds like the readers are connected to standard cabling via standard connectors.

So, the result I would expect from this letter is, 1) it will be put on the Internet for all to read, 2) boxes throughout the different colleges and universities that use the system will be pulled out of walls and vending machines with many of them stolen or vandalized to see what's actually inside them, next 3) The protocol and hardware will be distributed on a variety of web sites (probably ending with .ru or .iq) and finally 4) Blackboard's reps get innundated with phone calls, emails and letters complaining that their system is not secure.

This begs the question on what Blackboard should have done. (next reply).

myke

Slack-ass bastards!

[foxtrot]

This past week, one of the first comments to be modded up as funny is someone claiming to be the Iraqi information minister.

Now, they could have said something like, "There are no holes in the BuzzCard system, and we have repelled the elitist satan dogs who have attempted to break its security!" and it would have finally been funny!

-JDF

What a strange filename

[Sloppy]

how_to_get_coke_for_free_at_school.pdf? WTF?!? Are you trying to publish a security analysis, or are you trying to help people commit theft? Some people might draw conclusions about your intent, from that filename. And you might not like how they act in response to those conclusions.

Re:What a strange filename

[Acidic_Diarrhea]

Purely for marketing purposes chief. If the suits realize the kids are ripping off the system, the system will get fixed really quickly. On the other hand, how many college kids are going to download security_analysis_of_collegecard_system.pdf? Come on now, it's MARKETING.

With this current administration???

[SerpentMage]

Yeah right, the DMCA will stick and hold for a long time to come. Lawyers are having a field day. Lawyer wrote the law and therefore they will protect the law. Even though the law sucks.

What will be the result? Easy illegal hackers who steal. The DMCA is setting up a black market of crime. Just like how people "steal" cable. And people will not consider it stealing because it is digital. Oh yeah forgot more lawyer work, to prosecute the illegal people. Can we say DMCA is a make work system?

The DMCA will be struck down once people in the mainstream realize it has no effect. This reminds me of the argument with strong encryption....

Add on the fact that governments these days do not care about the little person. Just the big companies with their lobbies....

Re:*cough* Clueless *cough*

[Frobnicator]

Sounds to me like "you can say what you want, when you want, and no consequences" to me.

Not quite true. The first ammendment does *NOT* apply when the speach is contrary to the purpose of the Constitution, which is: [T]o form a more perfect union, establish justice, insure domestic tranquility, provide for the common defense, promote the general welfare, and secure the blessings of liberty to ourselves and our posterity[.]

First, the standard IANAL but I play one on /., and seek legal advice regularly.

Now for an example, yelling about a fire or a bomb in a movie theater is a violation of the Constitutional protection on speech. The courts have been working on establishing the guidelines for different classes of speech that are protect and that are not, such as informational (IE: a book about ways to kill people) and those that are functional, or produce actions (a book that entices people to kill others). Informational speach is protected, functional speach may be restricted.

The same is true for technical issues, although I wouldn't want to be a lawyer in that case. Arguing on first-ammendment lines, you would have to demonstrate that the claims are purely factual, that the research was conducted legally (many laws explicitly allow exemptions for researchers), and that the paper is purely informational and not functional. If the paper were functional, then it might be interpreted as being restricted by the various laws.

But then, as other posters have said, if a student or university does lose money due to this flaw (which is likely) then they can take it back to the company and sue it for not repairing or disclosing a fatal, known flaw in their systems.

[sigh]

Maybe someday we will be free from the IP garbage that has been spewed out over the past decade. Or maybe we'll get a utopian world where everyone will be honest and do the 'right thing'. No more need for security systems, and software flaws will be presented, evaluated, and repaired quickly...

frob.

College students

[BobRooney]

There are 2 things geeks in college have in abundance: free time and the want to break things. Now that every geek with a heartbeat and a B0x0rz knows there IS a flaw in this card system then they can go ahead and track it down on their own. Free access to EE labs is a beautiful thing. Let's wait and see how long it takes before they are ripped off to the tune of a couple million dollars.

Re:Hacking by any other name

[jasenj1]

I almost agree with this post. Almost.

Let's bring this into the physical world rather than the ethereal world of bits and bytes.

Stealing cars is illegal. I don't think there's any debate as to whether or not it should stay that way.

Figuring out how to break into cars and publishing that information is not illegal. (Well, it might be now undere the DMCA.) Especially if Ford makes a car that all you have to do is pull the handle four times real fast, or kick the corner of the door while pushing down the right spot, or some other reasonably trivial method to open a "locked" car.

Such information (how to, and how easy it is or isn't) on breaking into cars is valuable to consumers. They can choose to buy a car from a different manufacturer. They can install an alarm system. They can move to a safer neighborhood where they don't have to worry about people breaking into their car.

The same holds true in the digital world. If I as a consumer put some level of trust in a security system, I want to know how reliable that system is. In this specific case, if Blackboard's security is very weak, then I'll make sure never to have more than $100 in my debit account; as a school, I'll put cameras up to catch students stealing sodas with bogus cards, etc.

The bad guys out there WILL exploit any and all security holes they can find. As a consumer (whether a business buying an enterprise wide security solution, or a soccer mom hooking up to the Internet) it is in my best interest to know that people are out there actively trying to break anything that claims to protect me.

The act of breaking into someone else's machine, or using a bogus ID to steal products, is still illegal. And should be. But people need to know how easy it is or isn't to bypass any security measure so they can make an informed decision how far to trust that measure and what additional measures they may wish to employ.

- Jasen.

Re:Duh

[TheCrazyFinn]

Tim Robbins and Martin Sheen seem to think so. As did the Dixie Chicks, but they learned better.

Re:*cough* Clueless *cough*

[masq]

So which one of your examples is this? He's not yelling fire in a crowded theater... He originally tried to tell the company their theater was on fire, and when they refused to give a damn, he decided to tell the people inside the theater about the fire.

That's when they Cease and Desisted him, and told him that the burning theater was their little secret.

Personally, I'd wanna know, but hey, I'm obviously not normal. Stay asleep if you want, everybody. It's still a free country - but you better check back with me tomorrow just in case.

----
www.whatreallyhappened.com is interesting.

How can I tell if I'm vulnerable?

[Jester99]

I go to Cornell University. I have one ID card that swipes *everything*. Access to dorm hall. Attendance count at mandatory lectures. Meal plan. Laundry account. Snack/soda machines. Credit card.

Some people have been asking "what 'University approved network'" in other posts. At least here, we've got an account tied to our cards called "city bucks" that lets us spend a declining balance at local off-campus restaurants, and I think a couple supermarkets too. While City Bucks is Cornell-specific, I'm sure other universities have similar things.

I think there are other accounts too, but I forget them. The point is, I'd like to know if I should complain to someone in administration.

Anyway, we have a server with the Blackboard Courseware website software on it, but that doesn't mean we've got their card system too.. but how can I tell if we do use their card swiping system? (There isn't a logo on my card that would identify it as any particular brand.)

Re:Wait a second ...

[Corydon76]

They did - or more precisely, Acidus did. This is not the first go-around with Blackboard. Read the FAQ. The first time he published the exploits of Blackboard, they stonewalled him, all the while claiming to their customers, "Anyone with half a brain knows these exploits aren't possible." The only problem was that most of their customers had full brains - and understood that Blackboard was bullshitting them (and contacted Acidus directly to confirm this).

Buzzcards

[X_Bones]

We use Buzzcards here at Georgia Tech. It's been the experience of me and most people I know that the cards are only used for laundry, dining hall meals, and admission to athletic events and facilities. This is the first I've heard of any flaws in the reader system, but to be honest I don't think it affects people too much. There doesn't seem to be many places for students to put money on a Buzzcard, and when someone does, it's usually just enough to do wash their clothes this week and maybe get some snacks from the food court. I just don't see it as being a big issue.

That being said, I don't think that threatening these folks with the DMCA and acting like the situation doesn't exist is the best possible way to make things safer. Hopefully situations like this can help get part or all of that legislation thrown out.

Cease && Decist != Outrage

[badfish2]

You mean a company that creates a software system for financial and student transactions doesn't want an open forum on the security flaws contained in that software to be discussed on campus? What utter tyranny....

If I were a student on that campus I wouldn't want people openly talking about the system's flaws. I wouldn't want people cracking the system and tampering with any of my information that it contained - ESPECIALLY if this thing controls my meals, my dorm room and my exams.

Also, if I were the genius that found all of these system flaws, I would use it as a marketing opportunity to apply for a job at the company that wrote the software, supplying them with a detailed description of the problem and a proposed solution.

Why must this whole thing be so combative? Why is it so critical for this public forum to be held? If you find problems with the system, go to the company about it, not the public.

Re:*cough* Clueless *cough*

[Grax]

Actually you are allowed to yell "fire!" in a crowded theater, provided there really is a fire.

So yelling "that card system is insecure" might be considered bad were it not actually true.

And you are allowed to threaten people. Lawyers threaten people all the time using cease and desist letters.

Awww....

[lysium]

I must be a criminal then, because the thought of breaking multiple laws in a single evening's tinkering is quite motivational. It's the same sentiment that has seen me eating French cuisine lately (which I normally hate), solely because my provincial countrymen hate it now.

Seriously though. Does it ever occur to people that sometimes they have to FIGHT to get things their way? Not fighting in the sense of a debate-club discussion, but rather a nasty bar brawl; you are gonna get hurt a bit, but [hopefully] the other guy gets hurt more.

How did civil rights come about? Did Martin Luther King bitch to his fellow oppressed on the local bulletin board (ahem), write a congressman, and then go home? As I recall, he spent more than a few nights in jail, and eventually got shot to boot.

I'd rather be an insurance guy or something similarly boring then spending part of my life in a 4x6 cell, or even living in fear of same.
Well instead of a 4x6 cell you can have a 100x100 subdivision in some godless plastic suburb somewhere. You'll be safe there, have a fun life!

-----------

Lawyer's info

[Anonymous Coward]

Here is the info on the lawyer that wrote the letter: Gregory S. Smith Counsel, Washington Office 202.383.0454 gsmith@sablaw.com Bio at this page And Blackboard corporate communications: Michael Stanton Senior Director, Corporate Communications Blackboard Inc. Ph: 202.463.4860 x305 FAX: 202.463.4863

Doesn't the DMCA have exemptions for this?

[Newer Guy]

If I recall, the RIAA/MPAA cartel tried the same shit on Dr. Felton didn't they? Then they dropped it when he cancelled his talk and sued them. That went to court and the judge threw it out claiming "No harm done". It seems to me that I see a pattern happening here. Big companies are abusing the DMCA by threatening to sue, which clearly abuses the Educatuional exception that Congress put into the DMCA. Then, once the talk is cancelled, they say: "OOPS! we goofed...we were never planning to sue you!" THEN the court agrees with them. The problem is this is a variant of the "shoot, ready, aim" philosophy. This stuff they're pulling is a dangerous incursion into free speech....but then again, free speech means NOTHING in the Post 911 Bush dictatorship!

Why did they desist?

[MoneyT]

Seriously. If these people felt so strongly about the flaws in this system to hold a public seminar on it, why did they backdown when they got a letter? They should have held the seminar anyways. They might go to jail, but think of what they could accomplish.

1) Get the information they wanted presented to the public.

2) Get media attention

3) Bring the insanity of the DMCA to the courts.

free printing

[strider3700]

We had the Onecard system at my school. Best hack we found was with the printing system. Insert a card with $30 on it in the machine toy print for $0.10 say this is my print job, wait for it to read amount on card. take out the card and put in a card with $0 on it. hit yes to print. $29.90 will be wrote to the card. Everyone I knew had $100 on the card in no time once we "borrowed" a profs card. We also got to print at half price by taking a copy of his card.

People also spent time sniffing the one card network, but as far as I know no one had found anything interesting yet. this was 4 years ago, so I'd assume the entire thing is solved by now.

Re:*cough* Clueless *cough*

[john82]

Hmm... Can't use fighting words or threaten people? And what, pray tell, is the content of that Cease and Desist letter. Sure sounds threatening to me.

On the other hand, claiming that your product is "safe and secure" when it's easily provable to be otherwise would seem to violate any number of state and Federal statutes long on the books before the advent of DMCA, etc. I'd think that you could at least make a reasonable case for several flavors of fraud.

Any REAL lawyers out there to comment on that?

using DMCA to hide problem: easier than fixing it

[jdunlevy]

Reminds me of an episode in "Surely You're Joking, Mr. Feynman!": Adventures of a Curious Character. Richard Feynman pointed out problems with security of file cabinets containing secret documents at Los Alamos. The "solution" to the problem? Easy! Keep Feynman away from the cabinets!

Re:Disgusting

[MalleusEBHC]

RTFA

This is not about protecting the students. This is about Blackboard being too lazy/stupid to fix a flaw that they know about.

Acidus has tried since 2001 to get them to fix this. I'm pretty sure that if I dropped my credit card in 2001 and you told me about it, I would have things fixed by now. By this point, it is obvious that Blackboard is being negligient and is thus putting students at a greater risk.

To put this all in context for you, my school uses Blackboard for our grading system as well as dining services, housing access, etc. I know for one that I am NOT happy about this C&D and feel much less safe now.

On a lighter note, you know the worst damn part about this? We are a stupid Pepsi campus so stealing from the vending machines is pointless!

Re:Could someone please not be a wuss about this?

[EricWright]

Really? How do you know a user's intent? It's been established time and time again that you DO NOT need to decrypt the content of a DVD to copy it. What is inherently illegal about a software DVD player that isn't part of the DVDCCA cabal?

google cache of Acidus' yanked pages

[emcron]

The main page:
http://216.239.37.100/search?q=cache:aCrSrlgFxsYC: www.yak.net/acidus/campuswide/&hl=en&ie=UT F-8

Text document covering network infrastructure, database, servers, etc. for blackboard system:
http://216.239.39.100/search?q=cache:fM1kWpR_dbQC: www.yak.net/acidus/campuswide/campuswide.txt&hl=en &ie=UTF-8

These are the old cached ATT webpages, full of Technical details Blackboard wished weren't floating around:
http://216.239.37.100/search?q=cache:www.yak.net/a cidus/campuswide/oldatt/index.html

Acidus' card system FAQ:
http://216.239.37.100/search?q=cache:www.yak.net/a cidus/campuswide/faq-campuswide.txt

Creative use of cut and paste within the google cache should let you hit any of the other links within those pages that you may be interested in.

embarassment & consequences

[xeno]

As a US citizen, I'm depressed (I should be outraged) at this sad state of affairs. However in-your-face this particular presentation was to be, the stated goal was to expose the flaws of the system through hand-on research & controlled experimentation. Research. It was NOT to distribute hacking tools for actual implementation to facilitate illegal or illicit purposes. But ballsy kids in an academic environment who want to improve the technology and processes that surround them? They're stymied by corporate protecionism ensconsed in federal law. That's sad. It's wrong, immoral, and ultimately ineffectual. But the real tragedy is that it depresses the level of creativity in academia and creates fear for those that think too hard.

As a security professional, the fact that any cheeseball company can successfully hide their shoddy product behind a federal law is an embarassment. It induces even more cognitive dissonance when I work with federal and state goverment security staff who are well aware of good security principles, and then think about laws such as the DMCA which are diametrically opposed to known-good principles of improving security technology and processes.

It's a lose-lose proposition: News of an exploit always gets out, and is propogated fastest within the community which has little fear of the DMCA. But invocation of the DMCA causes relatively-innocent people -- those that were willing to stand up and state their names -- to tremble and retreat. As I said: it's wrong, immoral, and ultimately ineffectual. I spend my days educating people about the dangers of security by obscurity, and exposing the risks associated with snake-oil solutions such as Blackboard's "secure" transactions. I'm doing my part to educate as many people as I can, but with Grand Moff Ashcroft at the legal helm of the country (and with US federal/foreign policy changed to match the prosecutorial principles of "pre-crime"), I'm afraid it's like spitting into the Mojave.

The first time that some predator clones the card of a victim (or a patsy) in order to gain access to a building and rape/murder someone, I wonder... Will the appropriate law enforcement be able to effectively investigate/prosecute such a crime if the computing research community is prohibited from supporting them? Would Blackboard be content to sit on known security flaws and let a patsy get convicted? Again: wrong, immoral, and ultimately ineffectual. It ought to be illegal to *withhold* security flaws, at least from those who depend on/are subject to them. Feh.

J

Restraining Order

[bellings]

I must be missing something. Has a lawyer sent them a cease and desist letter? Or has a restraining order been granted against them by a court?

Because, all the links point to a cease and desist letter, which are as cheap as lawsuits in the United States. Any schmoe can send a cease and desist letter. Hell, I could send CmdrTaco a letter claming that the space aliens he keeps in his laundry hamper are interfering with the workings of my tin-foil reflector beanie. You certainly don't have to do what the cease and desist letter tells you to do, any more than I have to follow instructions from the little voices in my head. Sometimes the little voices in my head give me good practical advice, like "change your socks." But you would be a fool to follow the advice of either the voices in my head or a random lawyer's cease and desist letter without question.

But, I understand a restraining order as an entirely different thing. A restraining is handed out by a court, and unless you're fond of the inside of jail cells you would be well advised to follow it to the letter.

So, did these people actually get a restraining order against them? Or is this just another badly misleading slashdot article?

Re:Restraining Order

[khallow]

It's a ceast and desist letter. Perhaps, it's just a bluff, or an opening move in a nasty legal fight. Note that the letter in question is dated April 11, 2003 the day before the seminar (at the Interz0ne conference) and is directed to the conference chair and not the participants in question. Could you, in 24 hours or less, work out whether you (as conference chair) should go ahead with that seminar given that you probably don't know what the participants in question were doing? Looks like a cheap but effective maneuver to me.

Re:Restraining Order

[ccoder]

Could you, in 24 hours or less, work out whether you (as conference chair) should go ahead with that seminar given that you probably don't know what the participants in question were doing?
What makes you think they did not know EXACTLY what they were going to do? What makes you think the almost 100 times Blackboard hit our website did not warn us? What makes you think that we were not prepared as hell?

With that said, I think it was still a shock, but we come prepared every year. We had well over 10 separate internet connections. If $#1t hit the fan we would have been streaming it live. If some other event "prevented" us from posting the data we would have gotten around that also. As it was, somewhere around 5 minutes after the rant/talk at the con started, we had relevant information sitting in about 5 continents, on at least 15 webservers I knew of. Not counting the untold numbers of relays the information recieved.

Looks like a cheap but effective maneuver to me.

It was very cheap on the lawyers' part. I think they doubted our resolve, our commitment, and our loyalty to our ideals. We had at least a few traitors in our midst, but the funny thing is they did us NO irreperable harm (*watches feds come in and raid me now*) thus far.

I think it was a bluff, but it may or may not remain that way. Keep in touch and stay updated.
support our troops!

Already a zillion exceptions

[A nonymous Coward]

You can't lie under oath.

You can be sued for libel and slander.

Lying in a contract is a no-no.

Making false claims in ads is frowned upon.

Yelling FIRE in a theater is not in the cards.

The Secret Service will come after you if you make threats against givernment officials.

What part about make no law don't you understand?

Re:*cough* Clueless *cough*

[pmz]

An informed public is necessary to maintain ones freedoms, but i guess we already missed the "informed public" boat too early to avoid draconian laws like the DMCA anyhow.

Now that most people get their information from TV, the notion of an "informed public" has ceased to exist. For example, to attract ratings, Headline News now has some sort of worthless "Entertainment Tonight" segment, constant mentions of "We're the most trusted name in news", constant interruptions to learn that Jessica Lynch brushed her teeth this morning, and on and on. If I watch it for more than five minutes, I get angry at how absurd "news" has become and turn off the TV in disgust.

There's a reason Homer Simpson gets so many laughs...it's because he's so damn accurate, anymore, that we are laughing at ourselves!

2600 Magazine

[MarvinMouse]

There was an article in 2600 about 4 issues ago that had complete details on this system I believe, and how to hack into it.

If I can remember which issue it was I'll post it here. If anyone else remembers, feel free to remind me. I remember though it basically showed how with no effort the system can be cracked.

** To avoid DMCA lawsuits, etc. I did not write this article or am involved with it's creation whatsoever. **

Re:How do you know?

[zsazsa]

How did you find out that the system used was Blackboard?

Look for an AT&T or Blackboard logo on the devices that you swipe your ID through. (Soda machines, POS terminals, dining halls, copy machines...)

My university (University of Missouri) has TONS of these things. And most of them are totally unsecure. The RS-485 lines are there, ripe for the picking. I've seen many soda machines and copiers, many in low-traffic areas, simply plugged into an RJ11 jack in the wall with no conduit protecting it. It's ridiculous.

Re:1v1 slashdot shibboleths.

[Frater 219]

On the other, we see slashdot outrage any time a social convention is established / followed that actually attempts to impose social codes of behavior.

On the contrary: what we see here is a moral innovation -- an attempt at creating new and nontraditional codes -- which severely contradicts several established, traditional moral codes.

One of those established, traditional moral codes is called freedom of speech. It holds that it is morally wrong for those in power to restrict others' telling of the truth or proclaiming of beliefs. It does not authorize just any speech: for instance, false speech such as slander is beyond its pale. However, to threaten a person with prosecution for stating the (ugly) truth violates this moral principle.

Another moral code violated here, more recent but still established, is called the public's right to know. It is similar to freedom of speech: it holds that it is morally wrong to allow those in power to hold the general public in a state of ignorance for private benefit. The Blackboard company is in a position to benefit from the public's ignorance if it is not held responsible for its violation of its clients' trust by selling them vulnerable software. If it can suppress the fact of the vulnerability from public disclosure, it is gaining an immoral benefit. Those capable of denying it this ill-gotten gain are obligated to do so.

An instantiation of these moral codes online, a recent but also well-known moral principle, is called full disclosure. It holds that since the harm to the public caused by ignorance of security problems outweighs the harm caused by their exposure; and since vendors such as Blackboard must be prevented from benefiting from the public ignorance; that those who discover security flaws should reveal them in a responsible fashion to the public. One step of this disclosure is to notify the vendor; but when the vendor refuses to take moral responsibility, it is fully acceptable and desired to go to the public with the full and ugly truth.

To advocate protecting the Blackboard company from its responsibility to its clients (universities and students) and the general public is not a moral position. It is precisely an amoral one: one which defends the status quo, or the position of an entity with power, against justified moral claims by others. Please refrain from standing on a pseudo-moral high horse when you are in fact advocating "might makes right" and damning the public's and individuals' rights.

DMCA vs Common Sense

[MisterMook]

The first time someone uses the exploit to commit a rape or murder, the kneejerk reaction of the corportation will be to point at the students who knew the exploit and told officials about it as the scapegoats.

"They told us that we didn't leave our door locked, since naturally it was intrusive to check our door to see if it was locked (even though it affected the security of the people telling us) we told the students to scram and forbid them to tell anyone that our doors were open. Unfortunately yesterday we had a sad epsiode on campus where someone entered through our unlocked doors and commited a heinous crime, sadly the conclusion to be derived from this is definite - those infiltrators that went checking our doors must have relayed the information to their despicable accomplices. The University declines any assumption of guilt or failure of any kind. Thank you."

Face it, people suck and they don't ever stop sucking. The world is run by imbeciles to protect imbeciles, and the intelligent are their favorite food group unless they are creating more ways to create morons or joining the pack in their cannabilistic orgy of idiocy.

Re:Stupid. Typical.

[scenic]

Wow, you have no idea what you're talking about, do you?

The problem with your examples (all of them) is that you assume that what is obscure remains obscure forever.

The problem with obscurity as a primary means of security is that too many people know things, and the odds on one person speaking out of turn or being duped into revealing a secret is non-trivial. Take, for example, the cases of Kevin Mitnick. He got a lot of his information about unlocked PSTN switches by calling up the maintenance centers for Sprint or whatever and impersonating a repair person in the field.

I'm sure the security at Fort Knox is well understood ("simple" circuits, cameras, and locks). If you ask me, the fact that it's a real fort with lots of troops around making it kind of hard to, for example, sneak in a truck or dozen that you'd need to cart of gold (it's kinda heavy :) ) has more to do with the fact that there hasn't been a break in.

The point of the anti-obscurity argument is that relying on obscurity as the main means of security a system is almost never effective against a determined attacker, because obscurity can be eliminated. Systems designed in the light of day, or at least with collaboration outside of a single interested entity, tend to be more secure because it eliminates those "in the know" short cuts.

Sujal

Spend your meal card cash on Beer!

[cookie_cutter]

Maybe readers who go to schools that use such a system can expand on how that system is used.

At my school, the recently mentioned McMaster University, our residence meal plan could be used at local restaurants which had a deal with the Univerisity, like East Side Marios, Pizza Hut, and equivalent places.

Thing was, while they were mainly restaurants, some of these restaurants had bars in them, and we found early on that the system did not discriminate between what one ordered from these places.

So basically, one could use mommy and daddy's meal plan money. I think they eliminated this loophole since my first year, but it was good(by which I mean very very bad) while it lasted :)

18 USC 1029

[Nethead]

This would be one law that very much applies to the topic. The Secret Service provides the enforcement behind the law. I know the law very well, having spent over 3 years in Federal custody because of it. Back in 1987 I was the fourth person charged under the law for finding phone card numbers with a C64 and some off-board chips.

In this case, as in mine, the card number would be the "access device" and the computer (or even a laundry iron) would be "access device making equipment." Since this is a computer network one would also be well advised to read 18 USC 1030, which deals with computer hacking. Did you ever wonder why the phone company hands out cards in the first place? It was to promote the idea that phone card phracking was the same as making your own Visa card (the original intent of the law.) Why else would they embose your phone number on a slab of plastic when there was never a valid reason to run it through a credit card imprinter?

Financing

[uberdave]

Well, if they can convince the ATMS on the campus network to dispense funds through the security hole, they can afford lawyers.

Blackboard Follies

[theoddball]

I go to a school in the northeast that relies heavily on Blackboard. (I also work computing support here, so I know what a pain it is on the backend, but I digress.)

Oddly enough...I had a discussion about this with a CS prof a while back. Turns out he and another tenured prof figured out how to make all the vending machines (which are on the card) spit out free stuff by using a card with purposely malformed data.

This worked so well that the machines would dispense free stuff until somebody came along and unplugged/restarted them...

But anyway, if Blackboard wants to, two highly respected, published CS profs could be prosecuted under the DMCA.

Another problem popped up a couple years ago that never became common knowledge: if your account balance was between 0 and $0.05, you could buy as much as you wanted, and your balance would never change. I'm not sure if that was a Blackboard bug or something else we did here.

Another one of those through-the-grapevine stories that I suspect is true--the host "machines", whatever they are, for the locks operated by these cards communicate via TCP/IP with a central server. Last year a CS student figured this out and started sending a variety of packets at one of the hosts, crashed it, and summarily locked 200 students out of their dorm.

Ah, Blackboard, how I love thee.

And I've just committed multiple crimes under the DMCA, I believe...

ID Card "Security" at UCLA

[gnarly]

I was a member of the UCLA Grad. student gov't (GSA) at a time when the Admin. sent out a mass email to all students in blocks of about 200 students at a time which included in the CC section of the email, the email address and Registration ID numbers of the recipient and 200 other students. By collating a few dozen such emails I and other GSA members were able to obtain ID #'s for over 3,000 unique students.

After we went public, the admin. apologized, but said this was not a security risk because each student's account was protected by not only that 9 digit (now public) number but also a 4 digit numerical password. This didn't make me feel very secure. The ID + passwd combination was used to add/drop classes, find out grades, administer financial aid, etc.

The cards themselves were made by AT and T; you could put money on them over the web using your credit card, then buy food, etc.

DMCA is worthless

[iamhassi]

just the fact that we now know the Blackboard system is flawed is enough for someone to take advantage of the system, so DMCA really didn't change anything, sure they prevented the information from being widely distributed, but now others may become curious and hack the system the same way they did.

So, in effect, DMCA really didn't do anything. Actually DMCA made it worse, since this information probably wouldn't have shown up on /. and other news organizations had DMCA not stepped in. Now there's millions more people out there who know the system is flawed, and perhaps thousands with the knowledge and determination to hack the system for (essentially) free money. I've seen kids hack systems for much less incentive, so no doubt Blackboard is very appealing.

The DMCA just fucked itself. Should have just kept DMCA out of it, let the news lauch quietly, then the owners of Blackboard could have announced a "patch" a week later. Even if there wasn't a patch some people wouldn't bother attempting to hack the system after hearing a patch was made.

It's pretty much the same system used in arcades

[jdeitch]

Most of the card reader systems used in arcades (a-la Dave/Busters, Gattitown, et al) use a RS-485 network as well.

When these units need to be repaired, they are plugged into a "dumb server". This server basically takes ANY card input, and sends back an "OK" to the reader to allow it to start up a game.

The only critical knowledge needed is the location/site ID code the reader is setup for, and (obviously) the format that particular manufacturer/provider uses for their network.

I can't imagine it would be difficult at all to do the same thing for a coke machine, or any other device, on a CampusWide Network.

- litz

Tried that, went to jail.

[SysKoll]

Actually, someone tried that already. He ended up in jail.

In 1997, after four years of research, a French cryptographer, Serge Humpich, found a flaw in the widely used French smart card, which requires owners to type a PIN on a payment terminal for all credit card and ATM transactions. He found that 1.the PIN was verified by the chip on the card, 2. some terminals didn't really check what chip they were talking to, and 3. If the chip told the terminal "yes, the PIN is right", the terminal would blindly accept the confirmation and allow the transaction. Such a card is called a "yes-card"

Humpich contacted the Carte Bleue consortium, an association of 200 banks managing the French smart cards, and told them about the flaw. They refused to believe him. So he made a yes-card out of spare parts and went to a Parisian metro station. There, he bought a few metro tickets and send them, along with the payment receipt, to the Carte Bleue people. They immediately contacted the police.

Humpich was arrested in September 1999 and jailed for several months. In 2000, he was given a suspended 10-month jail sentence and a $2600 fine. All his equipment and documentation was confiscated. Now he has a criminal indictment that bars him from a number of jobs.

Of course, the French and US laws are different. But if anything, I suspect a US court will actually be harsher, especially now that the DMCA has been used in several precedents. Heck, the DMCA makes it almost mandatory to jail you if you figure out a way to program your VCR without reading the obviously encrypted documentation!

So I really don't think it's a good idea to show the problem exists. Blackboard knows, the people who selected them as a supplier know, and if you show them that they're effectively slobs, they'll crush you to cover their asses.

-- SysKoll

Contact the Lawyer.

[mikedaisey]

here's the contact info for the lawyer who sent the cease and desist letter.

http://www.sablaw.com/profiles/bio.asp?ID=000032 25 1170

Homework?

[BrynM]

From what I gather, he was researching his subject of choice in school. Notice how corps are targeting schools lately? Unfortunately, I think this will lead to a "research our product/methodologies only if we're paying you to" attitude from business and government.

I sure hope this won't diminish the spirit of the young researchers out there. These kids are building our future whether we allow them to or not. Stifling their growth will only give us a dysfunctional future.

you don't know police states

[g4dget]

If we lived in a police state, armed thugs would not tell you, [...]They'd just beat the living crap out of you and then go home,

Maybe that's how police states work in your native, ignorant, Hollywood view of the world. In real life, police states don't usually bother with beating people up--it's way too much effort--and it's not necessary. They control people through implicit and subtle threats to their liberty, livelihood, and privileges, as well as similar threats to their families. They only resort to force when people absolutely don't comply--but so does law enforcement everywhere.

You don't agree with the party line? Sorry, you or your kids can't go to college. You don't return from your trip abroad? Well, to compensate the state for your misdeeds, your home will be confiscated; too bad about your family. In some areas of US law enforcement, it's getting frighteningly close to that (drug seizures, computer seizures, etc.).

Police states aren't anarchies. They operate orderly and according to laws, they just happen to be laws that limit freedoms excessively. And it's very easy to move from the rule of law in a free society to the rule of law in a police state.

This was in my fortune today

[oblom]

"A commercial, and in some respects a social, doubt has been started within the
last year or two, whether or not it is right to discuss so openly the security
or insecurity of locks. Many well-meaning persons suppose that the discus-
sion respecting the means for baffling the supposed safety of locks offers a
premium for dishonesty, by showing others how to be dishonest. This is a fal-
lacy. Rogues are very keen in their profession, and already know much more
than we can teach them respecting their several kinds of roguery. Rogues knew
a good deal about lockpicking long before locksmiths discussed it among them-
selves, as they have lately done. If a lock -- let it have been made in what-
ever country, or by whatever maker -- is not so inviolable as it has hitherto
been deemed to be, surely it is in the interest of *honest* persons to know
this fact, because the *dishonest* are tolerably certain to be the first to
apply the knowledge practically; and the spread of knowledge is necessary to
give fair play to those who might suffer by ignorance. It cannot be too ear-
nestly urged, that an acquaintance with real facts will, in the end, be better
for all parties."

-- Charles Tomlinson's Rudimentary Treatise on the Construction of Locks,
published around 1850

Let's remember why we have disclosure

[IshanCaspian]

There's a reason why these security-types choose to disclose this stuff. Let's use an analogy here. Let's say the turnstiles in the subway (you know, the little things where you put the token in, and then it makes the little bar let you through) will just let you through without a token if you give them a fairly solid nudge with your thigh. This is because the turnstile company is making shitty equipment and charging a bundle for it. As a society, we can let the turnstile company slap lawsuits on anyone who is talking about the crappy turnstiles, or we can force them to fix the damn turnstiles. Clever people will figure it out for themselves, regardless of whether it's disclosed to society. Would you rather people stealthily stealing trolley rides forever? Or would you rather have the company who made the shitty turnstiles take the beating? Sure, most companies want to be able to make crappy security and get away with it. They want to be able to threaten people who will make it difficult to sell crappy security, just like the rapist might like to be able to intimidate his victims into silence. Sure, when it hits the news that you can just get into the subway by pushing on the bar, no one's going to pay until they're fixed. Sure, if they hold this press conference, people are going to be stealing cokes (and worse) left and right. However, that's not my problem. It's the problem of the universities who didn't buy a secure product, and the manufacturer that didn't make a secure product. None of that is any reason for me to give up my right to freedom to peacably assemble, and freedom of speech. You can either preserve the ability of corporations to hush up flawed products, or you can preserve our constiutional rights. It's as simple as that.

At My University...

[CowboyBob500]

...we used these two wonderful inventions called "keys" and "cash". I finished my MSc in 2000 so it wasn't that long ago either. All buildings were secure (the keys were of a type that key-copying shops couldn't duplicate) and I never failed to be able to buy a can of soda - provided I hadn't wasted all my money on beer and girls.

Bob

Re:*cough* Clueless *cough*

[Spyffe]

Threat and warning are similar. I would draw the distinction here:

• If I tell you that rocks may fall on your car if you go along a certain road, I am warning you about falling rocks.
• If I tell you my goons will drop rocks on your car if you go along a certain road, I am threatening you with falling rocks.

The company has a choice whether it will prosecute the DMCA violation. This is not a capital crime where the state must prosecute. Therefore, the company's letter is a statement of "we will drop rocks on you" more than one of "rocks will fall on you."