Slashdot Mirror
WiFi Exposes Sensitive Student Data
cfarivar writes "'Like leaving a vault open, the Palo Alto Unified School District failed to place a number of highly sensitive computer files containing student information in a locked location on its network. Using a laptop with a wireless card outside the district's main office, the Palo Alto Weekly gained access to such data as grades, home phone numbers and addresses, emergency medical information complete with full-color photos of students and a psychological evaluation."
Should be fascinating to see how people react as they start to find out how often security problems actually occur...
Right way to get attention ....
Wrong way to do it without going to jail.
I guess Match.com and Yahoo Personals will have plenty of photos of young nubile girls to fill the fake ads on their service with.
Who's bright idea was it to Wifi sensitive files...Real bright people these schools have.
Creative Demolition
WEP (Wired Equivalency Protection) uses RC4 encryption which is not very strong. Due to the design of RC4 (it was intended to be used over a synchronous stream), WEP designers had to make the key change with each packet. This means that the keys are quickly reused, and thus a sinffer can eventually - and usually rather quickly in large networks - determine the key loop. The SSID (Service Set ID) is sent over the wire either unencrypted or encrypted using weak algorithims.
WTLS (Wireless Transport Layer Security) was designed poorly as well. It's design limits the effectiveness that a certificate authority like Verisign can have when using WTLS.
Attacks against the WAP WTLS protocol (PDF): Source one, Source two
Security+ primer (lots of basic WEP, WAP, WTLS): Alpha Geek
Remember a week ago when at Senate hearings RIAA people said Peer to Peer that it could put inexpierenced users personal information at risk? My guess is there'll be a similar "Ban the Technology" movement against this for government use because of the potential danger. Except in cases where it would logically be needed, like free public internet access points. Of course, I could be wrong, but it's a thought.
Since when has this country used intellectual elite as a pejorative term?
Hmmm... according to FCC article 15, this newspaper just openly and admittingly committed a felony. Just getting an IP address constitutes committing this felony, but to access files without the network owner's permission is a strict offense. If I'm not mistaken, didn't a San Diego security company get raided by the FBI for doing the same thing?
The district has known about some aspects of this vulnerability for nearly nine months, but failed to take action until the Weekly informed officials of the situation late last week -- a somewhat ironic development given the school board's recent adoption of a technology-use policy.
Well when it comes to information security on Palo Alto networks, they get a big F. Fortunately, a low-level net admin was able to change the grade to an A.
--"The perfect example of the man of action is the suicide." - William Carlos Williams
It's time to introduce some level of legal accountibility for institutions which allow sensative data to be stolen.
The simple truth here is that pointy-hairs and beaurocrats understand one thing: Money. If you threaten to kick them in their budget, they'll respond; otherwise, you'll just keep seeing these articles.
I mean, this is *negligence* or the sort that could easily result in at least a major violation of privacy, or at worst a stolen identity or blackmail. These institutions with faulty IT -- and it's not as if this was some complex cracking job, this is just carelessness -- need to be taught a serious lesson.
(shakes head) It kills me that a college can lose piles of cash for buying shoes for one of their basketball players and a business can get fined for having workers like a box that's 5 lbs. too heavy, but when they expose the private, valuable data of their students/customers, there's no sanction whatsoever....
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
The last thing schools need are wireless networks let alone access to confidential information via a wireless network.
If the dollar is an "I owe you nothing", then the Euro is a "Who owes you nothing." - Doug Casey
I wish my old high school would've had something like that happen to them. I WANT TO SEE MY PSYCHOLOGICAL EVALUATION!
Trent Polack
www.polycat.net
Well, given that it's a newspaper that found this, I can't see that there'll be a big problem as far as non-disclosure on this one. Not to mention the fact that it's been posted to slashdot of course :-)
On a side note, could the newspaper be held liable for this, given that they were intruding on the network without permission? If the newspaper gets screwed over this, it could generate some much-needed publicity and the following public backlash over this BIG problem in the current internet legal scene (namely that if someone finds an insecure network, they usually can't disclose it without getting whacked. Sometimes even if they only tell the company concerned, the company fixes it and then whacks them).
This just goes to show we have a lot more to learn about wirless technology. To a lot of people it may seem like simple common sense to use WEP or some other serious form of protection for sensitive records like that. But getting wiresless is becoming just as easy as getting a cable modem hooked up so more people are doing it at a faster rate and not researching the risks that come with it.
I read an interesting (all be in short) article not too long ago about the risks that does a nice job of explaining things.
... psychological evaluations?
;)
what kind of school is this?
i would never let my school asses me mentaly, that's a major privacy violation if u ask me
besides, im a little crazy...
-judging another only defines yourself
David Lightman, Jr.'s weapon of choice.
"A great democracy must be progressive or it will soon cease to be a great democracy." --Theodore Roosevelt
Where does responsibility lie? Can the school claim it has been hacked and has no responsibility , or is there some law that defines some measures they should have taken?
Are there security standards that everybody should uphold?
Not that the one who stole the data is innocent but can the school be prosecuted by some negligence law? After all
Boy, my school holds a lot of data on me and it is a bussiness school with complete idiots on the technical department. Now i am worried.
Slashdot Sig. version 0.1alpha. Use at your own risk.
Hell, at my high school, I was a junior admin (most bullshit class ever). Each class had a computer which kept grades for the class. Whatever shitty grade software they used stored the grades in PLAIN TEXT LOCALLY. These were win98 machines, no user permissions, freely used by all students. I discovered this fact when one of my teachers forgot his password to the grading program and after a little browsing opened up the raw text file to show us our grades. This all happened in one of the largest (and most inept) school districts in the country too, not some backwater. Actually, from the articles i've seen, it looks like the small school districts have it together more than the large ones as far as tech goes. Our admin was a former chem teacher who spent near 0 time doing anything useful, letting us junior admins do all the grunt work.
Photos.
What do you mean fake? I met my Thai love slave on Yahoo Personals. How much more real could you get?
when it comes to networks.
Not only do they expose sensitive information,
but they run generally insecure servers, and
they pay mercenary network installation contractors
1000 cents on the dollar for old crappy network
hardware.
And the web pages set up by school districts for
employess to use are brain dead.
This one:
http://www.teachinla.com
has a link on the NCLB teacher profile logo
that sends you to a page that will let anybody
that can get a teachers employee number and
birthdate change their professional credentials.
Well, it would, except the form page doesn't work!
From the article, it almost sounds as though it was a wide open access point (no WEP encryption or MAC filtering). If this is the case, there should be no demonizing WiFi - just a sloppy sysadmin.
...that they can "crack" into a school district computer and no one blinks an eye. But the moment a student would try the same thing, he would be expelled.
Jason Lotito
Check out what the person in charge at the school said:
"I don't see this as such a huge news story," Superintendent Mary Frances Callan said the day after the district office abruptly shut down its wireless network and student information program. The real news, she added, was the great progress the district has made to its network plans, thanks to new software purchases, planned employee training sessions and the technology-use policy.
She has absolutely no sense of responsibility of the damage she could have/has caused. Money is the only thing that will get them to take notice.
the press has been held 'above the law' in such cases. Look at Watergate for a prime example.
That is a good thing, as long as the integrity of the information is held to a high standard. For example, if the published all the information they got, that would eb bad and they would be held accountable. If not by a law enforcement agency, then by a civil court. probably both.
The Kruger Dunning explains most post on
The same information was also accessible to individuals using district computers within school sites.
This case shows who or what department that was incharge had concrete policy with regards to information and IT security.
Security was fundamentally flawed, little or no security mechanisms in place, even lan connections had access to the files! Wireless connection only exacerbated the situation.
Well you see, this Wi-Fi stuff is invisible... that is, you can't really "see" those bits. And anyway, if you could "see" them, they certainly don't look recognizable. Now, if you had a stack of papers with this stuff sitting in front of the school with a sign on it, well, THAT we could fix. Maybe we can fund a study to get someone to print out all of this insecure data so we could see if we really have a problem or not? Surly there is some consultant we could hire to investigate the feasablity of this?
Ross Youngblood
This is a general network security issue.
Confidential data needs to have strictly managed flows and storage. It'd worrying enough that this information could be accessed anywhere on campus even without the wireless threat.
When it comes to something like a psych evaluation I cant see why that information isn't kept 'offline' or on a small secured network. There is *no* justification even for allowing all staff members direct access to this sort of thing - it's ripe for abuse. I also cant see any reason why you'd need access to such a report instantly.
I've came to the conclusion that schools are exempt from laws and are not held liable for their own mistakes, hell, Livonia Public Schools (Livonia, MI) Livonia Public Schools" the staff there actually tries to hack into students (and former students) computers.
In time the it will get past the embarassment and all will be well again. Nothing more volitile than blushing data,
Eve Fairbanks says I drive a hybrid!LOL
And you notice, the school didn't fix it until AFTER the paper went public. Where have we seen this before? hint: MS wingeing
And what is a school doing psychological profiling anyway? Like little Jose goes to a Catholic Church, he's used to having his penis touched by priests, hey GLSEN, got a hot one for you! Teenage Jose can't read or write, but he's in touch with his sexuality.
This takes the cake: "I don't see this as such a huge news story," Superintendent Mary Frances Callan said ...
'nough said.
I wonder if any of those evaluations concluded that someone would 'violate' someone who invaded their privacy. I know mine would. :)
Check _this_ privacy policy!
Did the newspaper bypass security and illegally access copyrighted material?
If so, didn't they violate the DMCA - no matter what their intent?
After all, if the US constitutional right to 'fair use' is not a loophole, why would journalistic investigation be?
/* affect != effect */ void affect(int *thing,int effect) { *thing += effect; }
If you were a parent in that district, you probably would have spent well over $1M for a home so you could have been in a "nice school district." Unlikely that you'd also be able to afford private school.
Comment removed based on user account deletion
And you don't get unemployment over the summer. Hardly worth your time volunteering, really.
After you turn 18 you can at any time look into your permament record. Prepared to be shocked though. I was a slight rebel but nothing to serious and my consuler describe me, and I shit you not, as the NEXT HITLER!. Serious, she said: And in this report Nick sounds somewhat like the next Hitler (I wrote a paper saying academic proformence should determe which students got to go to Disneyland.)
Hollow words will burn and hollow men will burn.
I'm a district over from Palo Alto, and it's not surprising to me that the wifi was open. That SasiXP and server shares were open is frightening. But this is what happens when parents are allowed to come in and run roughshod over the plans of the admins. Or when random parents are your admins. Palo Alto has tech people, they should get in trouble for leaving things unsecure, but the parent group that came in and blew a big hole in the existing security needs a solid slap on the knuckles too.
The tech staff that school have are usually underpaid and overworked, or contractors who are juggling the detail of 10-15 districts. I'm still cleaning up from the last time parents got involved, getting everyone connected to the internet.
To every tech minded parent out there: don't give us your used crap, don't come in and 'help,' just stay out of the way. We have a clue (well a lot of us do), but we spend 98% of our time cleaning up the messes left by helpful parents, clueless teachers, and malicious kids. We're trying to get the teachers up to speed, and we're working on making it hard for the kids to purposefully or accidentally fsck things up. But parents are totally deaf to the idea that the help they're offering is really hindering things.
How do you tell someone who wants to help, no. Or better yet, what's a good project to let parents feel good about helping without damaging my network, or my systems?
CIA Industries - Running the world for fun and profit
As the purpose of copyright is to increase the amount of publication that enters the public domain, *can* they actually copyright something that is never published? And school district's .. that sounds suspiciously like Government, who cannot copyright documents either. No Copyright, no DMCA?
or did someone else just glance at the headline and read:
"WiFi Exposes Insensitive Clod Data"
I think I need to lay off on reading posts for a while.
So it's *illegal* for me to mooch net access off of my neighbors? Better go take down that antenna...
Do psychological evaluations. Based on visits to your guidance councilor, and how he or she feels about you. Sometimes your teachers are brought in to further refine the exam. If you never see your guidance councilor, then the evaluation is based purely on your teachers composited feelings.
Which is really, really sad.
Informatus Technologicus
DAs know better than to wreck perfectly good laws they can use for selective prosecution by going after popular prey.
Schools have counsellers, and psychiatrists. They write up profiles of the students they see, and keep notes on them.
How strange is this?
CIA Industries - Running the world for fun and profit
WiFi is now commonly used throughout hospitals transmitting unencrypted patient information to mobile carts and charting hand helds. Imagine what you could grab just by sitting in the lobby.
With pictures and family contact information, e.g., the names of the parents or relatives authorized to pick up the child at school, identity theft is nothing compared to the other abuses that are possible.
E.g., a pedophile could go "shopping" for a victim, then use the information in the file to convince the kid that a trusted adult sent them to pick them up.
Or they could be even more aggressive and add an alias to the list of people authorized to pick up the kid at school. Then they show up and breeze past security that would normally extend from classroom to doorstep.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
Why aren't they using passwords are anything? Let's suppose they are using a Windows Network (don't jump all over me, if they can't secure a WiFi connection, let's assume Linux is way out of their range) Are they stupid to have the server freaking make sure everyone trying to connect is a valid user. Even a paper MCSE knows this. You have to be freakin retarded to let this happen. Not securing your access ports to leaving sensitive data open to anyone who connects. The only way I see is that they sniffed a valid user name and password over the WiFi while hacking it. If it's open to the world without a password, IT department is totally retarded. (I do realize that it's a government organization) DMCA here we come.
visit www.thechampion.org
The average teacher pay in Illinois is $55,000 per year, for 9 months work. Not bad. The tech, disability teacher, and mental health end averages $90k a year. More averages on aft.org.
Overpaid, if anything. And this breach went on for a whole year? Nobody fired? Cushy work, isn't it?
Those who can set up networks, do.
Those who can't, do it anyway.
It takes 3 seconds to set up an access point and about 2 minutes to set it up and secure it. Even my neighbor (who apparently has wi-fi going on I see) was smart enough to secure their network (so much for the extra bandwidth for those huge game demo downloads, while I play online with no latency or packetloss!)
If your network doesn't at least have a WEP kep, how the hell is someone supposed to differentiate your network from any other wide open hotspot? Perhaps he thought you had a hotspot with convenient network shares to store files :)
"Andrew Hannah, a network administrator for the district, admitted security was an afterthought when the first open wireless networks were installed at the Jordan and Jane Lathrop Stanford middle schools and the district office between 2000 and 2002."
This is the problem with DeVry's, et al, ginning millions of Win32-morons out into the world of computer administration. You get a bunch of clownpunchers who know how to press shiny buttons but who don't have a clue about the underlying principles (and responsibilities) of the computer networks they are in charge of administering.
Mod me troll, but I'm tired of the polluted job market, and absolutely sick to death of cleaning up the puke left behind at countless small companies by these nimrods.
I have something in common with Stephen Hawking...
There's just no telling how the students will cope after having been labelled "sensitive."
If brevity is the soul of wit, then how does one explain Twitter?
Didn't the Newspaper break some laws here?
Sig: BEEeeeP,,Please press pound, so I can get on with my fucking life!
Hmmm... according to FCC article 15, this newspaper just openly and admittingly committed a felony. Just getting an IP address constitutes committing this felony, [snip]
;)
:) What's this you say, the network was wide open? :)
Just getting an IPAddress? To get an IPaddress, you have to ask for one. Is it your fault they gave it to you? That's like if you knock honeywell's front door, and ask if you can come in, and they say, "OK, come on in", and as soon as you step foot in their premises, have you arrested for tresspassing. I suppose you could say, you did have permission, because you obeyed all network protocols, where the server has the right to accept/reject your requests. If the DHCP server gives you an IPAddress, and the DNS server resolves the host names for you, and the HTTP server fetches the documents for you, you did everything with permission
Now if they had WEP keys, and an IPSec tunnel, that you had to infiltrate, then thats a different ballgame
so the school systems can tell the government they need an extra $50,000/school year to "secure" their wireless networks, or network in general (I'll be more then happy to accept $50,000 to enable WEP and set passwords and mac filters)
AFAIK pretty much everything that is created is aturally covered under copyright. It's only once you start assigning copyrights to other people and registering them etc. that the line gets blurry.
If I write a program and keep it on my own (home) PC then it is (c) me, even if I don't have a license attached. If you steal it I get all legal on your ass.
/* affect != effect */ void affect(int *thing,int effect) { *thing += effect; }
I think (IANAL whee) that it they are not possibly liable unless they actually circumvented some security measures somehow. If the files were simply open, then they didn't do anything wrong unless they tampered with files.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The article noted that the information was on an insecure location on their network.
I agree, we need laws that protect white hat hackers and setup clearing-houses for white-hat hacks. Such clearing houses would give 30-days notice to an organization in order to secure their network. Then the information would be released publicly.
-------- -------- Support Wesley Clark for president!!!
Check out 18 USC 2701, the Electronic Communications Privacy Act (and possibly 18 USC 1030) they just violated. So yeah, if this case is getting lots of media attention, just wait for the FBI to ring in.
Dammit, if we're going to move over to 802.11? on everything, we at least need to do it the definitively right way, especially if sensitive data is held in machines on these networks. Simply turning on 104-bit WEP will not magically secure your wireless network; I can attest to this, as I used Airsnort to crack my own WEP keys within the window of 5 or so hours with medium to heavy wifi traffic between my nodes and access point.
System administrators should take measures to not only secure the machines themselves, but the transmission of data. So, on top of 104-bit WEP, perhaps we should also be using PPPoE for authentication, and perhaps IPsec, SSH wrappers, or virtual tunneling. (when I say we, of course, I mean those of us with machines that contain, and transmit potentially sensitive information). Shit like this wouldn't happen in the future; but alas, we're lazy.
Oh yeah, read the Spring 2003 issue 2600 article about Kroger's wifi security deficiencies? Another real-world example of "potentially sensitive data" being available to the world, if you consider Joe Sixpack's family pack of Trojan Magnums to be sensitive and private.
-
And the Angel said unto me, "These are the cries of the carrots! The cries of the carrots!"
In all honesty, we shouldn't have legislation for data leaks and the such. Let's say Joe sysadmin sets up a WiFi network. Joe sysadmin locks down said network, board has difficult time accessing network and "orders" John netadmin to reduce the security and make it more "ease of use-ish." Now in the normal IT world there positions aren't filled with morons. In the educational system where tech jobs are filled @ $5.15 an hour, you have the soccer coach, or the part-time janitor doing IT work. Holes open up, since the net/sysadmin knows nothing of what they're doing, they get by.
The question is, would the hole have been discovered? Generally the answer is no, people don't always go looking for security exploits. Hehe, if I had WiFi when I was in HS, I'd be happier about that than anything. It makes me ponder if the news didn't try and get in, would someone have?
I've also worked for the school IT department at my university but quickly quit when I realized the average intelligence around is no higher than a walnut. The one thing I know however, is we don't want the government responsible for private information. Next thing we know is the government pushing DRM and all that other crap.
...shoot the messenger here?
I bet some legal action will be taken against the reporter who did the "hacking," while nobody will even think about holding any school officials accountable for their stunning negligence. I shudder to think what a pedophile with a WiFi-enabled laptop could have done with access to that kind of info. Cripes, it could have really turned into a serious NAMBLA convention out there.
I know this much, if I were a parent of a kid at that school I'd be raising holy hell about this and calling for the heads of people in the school administration. Starting with Superintendent Mary Frances Callan, who was quoted as saying, "I don't see this as such a huge news story." WHAT??? Bitch, you should be on your knees thanking God that this was uncovered by a reporter and not some scumbag who got a kid's address from that wide-open network of yours and found himself an ideal victim!
~Philly
Hmmm, IANAL, but in most areas, isn't doesn't this fall somewhere under electronic tresspass, or electronic wiretap. Like, accessing a computer system that isn't yours and that you weren't authorized to access? Sounds like not only an admission of guilt, but them bragging about it..
Of course, press like this is rarely very good. It's enough to scare lots of people away from new technologies.. I'd be surprised if someone doesn't make a push to bring them back down to paper files for everything.
Serious? Seriousness is well above my pay grade.
This PAW story is totally retarded, as usual. I worked for two years at JLS supporting that network on a volunteer basis. Every sixth grader in the district knows that FUJI is a scratch drive and that anything put up there is NOT SECURE and subject to being blown away every so often.
..."
.... we'll just bury that a safe distance from the headline.
...
... I still have to live in the People's Republic of Palo Alto.
The Weakly even says, "Although the server was not intended for high-security documents
Oh, *although*
In other words, "Although this is no story at all and all the important stuff is locked down, we thought we'd go rattling door nobs to see who left their doors open, then raid the houses. After all, WE are The Almighty Communityist Press."
The Weakly goes on to describe, "a sub-server known as Fuji, which was designed to allow authorized personnel to share files," on a temporary, non-secured basis (but we'll leave that part out; it's not a lie, just not all of the truth).
So the only issues here are STUPID USERS, and CARPING JOURNALISTS, as usual.
1. Did some overpaid adminstriviators put stuff on the scratch drive that they shouldn't have? It sure looks that way.
2. Is PAUSD leaving it's entire network wide open to the world? Definitely not.
3. Is the Weakly off on yet another cynical tangent, this time by driving around rattling door knobs? Definitely.
Since I live about half a mile from the district office, I'm locking all my windows tonight, that's for sure. After all, if I leave my window open, that means I was just INVITING reports to crawl in, right? Hey, it wasn't locked down
Yes, I'm posting as a Coward
I was looking up my old school on the data protection register (uk) they have so much info on the students!
In the uk (as far as i remember from IT class) we have laws protecting our data and ensuring its stored securely, i dont know what would happen if it got out (my school used wifi too) - i.e who i could sue/prosecute to get that lovely lovely free money.. hmm what if i hacked it and stole my own data just to demonstrate? - i could maybe pay off the hacking charges with the money from suing the same people! (if only i wasnt such a lame script kiddie)
The data protection act has to be my favourite uk law, leading to the tv show where mark thomas snoops around dodgy politicians and bosses and then uses the data protection act to demand a copy of all the data they have on him including memos about how they hate him:)
So yeah if your in the uk, just go and demand that companys/schools etc give you your data (i think they can charge a fixed amount for it though)
This comment does not represent the views or opinions of the user.
even if this were a completely physical network not having these files password protected would be just as stupid.
Give me Classic Slashdot or give me death!
Breach of security in regards to medical and psychological data under the schools care, which was known about but not acted on for 9 months? Sounds like some parents are going to get rich quick. Bring on the law suits.
The attitude of the schools staff appalls me; sounds like the poor admin can't even do his job as everything needs to be rubber stamped before it can go in effect. And since when do they think that by securing the perimeter of the network does it make the files any more secure.
GPLv2: I want my rights, I want my phone call! DRM: What use is a phone call, if you are unable to speak?
My friend and I recently gave a white paper to our school describing all net vulnerabilities. We were able to access attendance and grade records, as well as the faculty folders because they didn't secure one of their servers. Also, there was an "install" folder with copies (serials included!) of all of the install cds for all the programs ever used at our school. Office, Starry Night, the grade program, etc. It was a treasure trove. But, like responsible people, we gave them the white paper. The sysadmin was unaware of any of this.
Does this mean they had a psychological evaluation for everyone? Is this common in US schools? It is unthinkable where I come from!
How did they find you? I mean, even if they had your MAC address I don't imagine it saying much. I also can't imagine them finding you based on what your Network name was, unless your network name was your actual name or something, (and yes, I've seen wideopen networks whose SSID was the physical address of the owner's house)...
That's toeing the line between "security" and "protection racket"
If you know the data isn't for you, and it's not advertised for you to get, then you can reasonably assume it's private.
Surfing student records over a wireless connection is one of those things that falls under "We knew it was not public information, and that we were accessing information we were not supposed to be"
ANYONE who accesses my network through some kind of security breach does not deserve any kind of protection.
I happen to go to this school district. Being into technology, I help administrate our high schools networks, and I have personal experience with the gross incompetence of some of the tech people that work here.
I'd like everyone to know that 99.9% of all the tech stuff is done by us students. Now that we're out for the summer, it looks like the district can't handle it themselves.
Oh well, not my problem. The school doesn't have *any* useful info on me at all. ^_^
But we end up with these stupid deliberately crippled algorithms because law enforcement and government security are paranoid about not being able to read everyone's mail, and hold enough sway to dictate what will and will not become stanard.
How long are we going to have to wait for this to change? Will some rebel write a good WiFi protocol suite in the meantime? And if so, will the above-mentioned powers be able to stop it?
I'm your Thai love slave.
I'm a 46 year old white dude. I weigh in at 332 lbs, and I sell pig manure to soy bean farmers for a living.
The REAL jabber has the user id: 13196
What you do today will cost you a day of your life
I grow tired of seeing WiFi get the blame because someone didn't flip a simple switch on a cheap wireless hub that would had prevented 99.99% of the reporters of the world out there from doing this.
WEP exists to stop people like this, it won't stop someone determined, but it will stop the sensationalistic 'news at 11' types
As a rock-in-roll Physicist once said, No matter where you go, there you are.
"We also able to view the district's student information system, SASIxp. "
Out of the box SASIxp uses DBaseIV which you can link a table to in MS access or any other DB prog. So security for SASI sucks ass out of the box!
best not to know! :)
-pyrrho
I do agree that it wasn't WiFi's fault, but I think itâ(TM)s a good thing to have "news at 11" to promote tightening of security. Now that itâ(TM)s been exposed in that district, I'm sure the surrounding area will also investigate their own blatant oversight.
this is my sig, there are many like it, but this one is mine.
Would you like a positive response this time?
If there's a liability exposure, institutions will buy liability insurance, and the insurance companies will be a well-funded central source of motivation and knowledge to improve security.
Steam boilers used to blow up and kill people. Insurance companies started demanding boiler inspections. After that, fewer boilers exploded.
The "U" in the UL tag on electrical equipment stands for "Underwriters".
They do not need to circumvent any security measures. All they need to do is access data that was not intended for them. At least thats how current court cases are going. Still waiting on that issue to be resolved eventually in the supreme court if it ever gets there.
Remember, honey pots are OPEN WiFi units, not locked ones.
Anyway, I doubt if student records are copywrighted material and I do not think that is the law in question here. Of course if there were a few tests on their or answers from certain software test programs etc..
It was done via analog modem, probably 300 baud or so. Some people never learn.......
The article has funny quotations by school people, who all seem to say:
Not to make excuses, but my excuse is that someone else did it, or that we were going to get to it eventually, or that I don't see that it matters....
As you can see, they are clearly trying to dodge the blame. Not only is the person with the top position of the school board trying to do so with her "I don't see this as such a huge news story" quote, but also, her underlings are as well. If these "administrators" had half a brain, they would have realized that a wireless network would need some security measures. This is why I claim that most school "tech guys" are incompetent and just too conservative on the use of security.
They fail to realize that these are the records of students at their schools. By doing this, it is nothing short of just opening up their vault of permanant records to the public.
In this age of identify theft, I think Universities should be held to a high standard of privacy. I know when i attended college, I had a real problem with the University using my social security number as my "Student ID" number. I complained to the Dean of Student Affairs, and was told that it was University policy and there was nothing that could be done about it.
I remember strolling by empty offices of professors seeing the green printouts of class rosters at the beginning of each semster, and thinking that all it would take is somebody to duck into one of these rooms, lift that list, and poof, you've got hundreds of names and valid social security numbers.
I realize that many schools are moving away from using the social security number as a form of student identification, but I wonder if this coincides with a shift in the fundamental philosophies of these estabilishments, or if it is simply a method of saving face. I sincerely hope it is the former rather than the latter.
RFC2119
"PAUSD Technology Training"
:)
"The Information Services/Technology Department supports teaching and learning by facilitating communication and productivity. IST keeps the computers and other technology used by students, teachers, administration, and support staff up and running; maintains the student information (SASIxp) and Human Resources systems; and monitors the network infrastructure."
I'd say they got the part about 'facilitating communcation' right, at least
Expect SASIxp to be gelded soon, if not already...ouch!
There's gotta be. Niether the laboratories nor the schools are demonstrating active security consciousness.
It's that or the reporters in the area are the nosiest SOBs around.
A few years ago I was taking a Cisco course that was offered through out school by the local Tech Institution. I was working on a way to log into a Win2k server box over a modem so that I could do various things from home (never did exactly figure out what as the net connection at the school was crap and the modem never did work), but as I was looking at the network I ran across the schools web page and looked at the server behind it (WinNT 4 with IIS, luckally patched for code red that had been running rampant about that time). I could log onto the sever through FTP as Anonymous and browse through the few files that were there. The one gem I found was a Access database with personal information about every single employee of the district. Beeing the good little boy I told IT (wonderful when the teachers listen to you). The server stoped serving FTP for about a week and then it was back up with the offending file. It didn't get taken back down until they did a major upgrade over the summer and put a Win2k box in its place. (that and half the IT staff got replaced that year). Ahh the stories of our IT staff, I could go on forever.
I bet priests are all over this one. I bet they are going to Wardrive for schools that have this vulnerability, then get the photos and psycological evaluations. They will find the hot kids who are pathological liars. Then, NO ONE WILL BELIEVE THEM!!!! HAHAHAHAHA!!!
I still need to do something to protect the wireless network where I work. I hope they don't think I did it already.
she is a very hot half puerto-rican half german girl, she is the best lover i have had and we love each other like a fairy tales happy ending.
and it only cost me 29.95 and 15 minutes of creating my profile.
what have you nerds got to lose? your virginity maybe?
contrary to popular myth a lot of the girls on there are hotties that are tired of players and want a real relationship without the bullshit.
course sometimes you get a real head case, i met one, but she was certainly cute.
Well, actually, my attorney says no it isn't in my case... Because of the following argument:
Agreed. Intent makes the difference. Confidential information was accessed and stolen, as well.
Yes, that's true. I asked my attorney about this, and I learned a few things. First, the "breaking" part of breaking and entering happens when you break the plane of the door frame; the door could be completely wide open, and you're still breaking the law by walking through.
Second, the "breaking and entering" analogy doesn't apply. The laws governing real estate and the laws governing electronic communication are a bit different. My attorney said that a closer real estate analogy to the situation we're discussing would be the following: You own 100 acres of land, and I go and squat on one corner of your property. There are no signs up saying "Do Not Trespass." You see me squatting on one acre of your property but don't do anything for a period of time (months, years). After a time has passed, your silence effectively means that you've waived your rights with respect to the piece of property that I'm squatting on, because I'm "openly and notoriously" utilizing that land. On the other hand, if you take immediate action to notify me, you've asserted your rights, and any further incident where I trespass at that point is a separate crime.
Now, in the case of my dealings with H*neywell, if they put me on notice at any time, and I continued to access their network, then every separate instance where I connected to their network would be a specific felony. But since I was not notified until well after the fact, and because they took no measures to secure the electronic "gate" to their network, H*neywell is clearly at fault in this case.
If I'd taken any data off their internal network, then they'd still be able to nail me for that. (And I would fully expect them to do so!)
In the case of the newspaper accessing the school's network, confidential data was stolen. If the wireless access point was secured in any fashion, then merely breaking that security to gain access would be a crime, yes. But if no measures were taken to secure the access point, then merely obtaining an IP address by connecting to the access point wouldn't be a crime.
Disclaimer: I am not a lawyer, and this is my imperfect understanding of what a lawyer has explained to me. Talk to your lawyer; don't take my word for anything.
Our real title had escaped my mind when I wrote the post. We were the school, now wait for it ....
IT Squad
Yes the hall passes with that written on them were painful, as was being called the I lowercase t as in It squad by teachers when they checked our passes. I thought I was signing up for a network engineering class, boy was I fucked over.
Photos.
I was involved in a similar situation about 2 years ago. Huge amounts of school information were exposed to the world, and it was all quietly swept under the rug. I was told to keep quiet and to say nothing more of it. I was threatened with termination if I disobeyed. Since I no longer work there, I'm pretty free in saying that their "security system" has a bigger hole than the goatse man. School districts that buy "consultants", which are little more than revolving-door Microsoft salesmen with MCSE's, should be dragged out and shot. All they do is put up a huge line of BS that gets them the sale, then they act like they have done their job. School computer systems are all a total joke.
I'm not sure how this would qualify on electronic tresspass. It's one thing to physicaly or electronicly attempt entry, but when the radio waves are not encrypted and pass through you body?
I mean... if for example I had a WiFI card and I was on campus, which I would consider perfectly out of the ordinary, and I tripped upon a network connection, I would think "oh neet public WiFi". Just like if I was walking down the street and saw a path to a lake, "Oh neet a public lake".
My point is without notice, how do you expect people to know it's treaspass? Or on the other hand, without encryption, how do you expect people to know it's private? Without notice of private property, I don't think it's tresspass.
Common sence should rule in cases like this, as for radio reasonable attempts should be made to protect private communications, and if they are intercepted it's your own damn fault.
There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
you are high
there is no such thing as a natural copyright
copyright must be registered
Is anyone suprised by this, because I'm not... definitely not slashdot worthy...
Wow, you're a smart one. Try reading that link. Here, i'll do it for you:
In general, copyright registration is a legal formality intended to make a public record of the basic facts of a particular copyright. However, registration is not a condition of copyright protection.
My school distrist, Fort Bend ISD in Houston, TX, had an IIS webserver that was infected with W32.SadMind. I notified the admin by email who replied with "Uhh.. the server is too slow to run Norton.. so we cant do anything". I laughed and forgot about it for a year.
Then comes a story on slashdot about infected IIS servers, I post a quip about my dealings with FBISD and a couple of Slashdot posters decided to email the district and the local TV station. THAT got it fixed within a day, however the school district was a bit upset at me.
After than, some less than ethical FBISD employee decided to attempt to reset my dyndns.org account password. A while later, I get hits from them to my linux box trying to login to my FTP and protected HTTP pages from them. This is the thanks I get for telling them that they're vulnerable.
As a student, I couldn't really do anything other than publicize what they did on my website and send a few nastygrams back.
Seriously, though, if your school hasn't fixed the problem, perhaps the local newspaper near your school could pull a similar expose. I'm sure that would get the problem fixed and in the long run it would benefit the students.
I'm really disappointed with this. Not only is it a violation of my privacy, it's not the first.
.. who did nothing.
It's very easy to get a network drop and access files. This is simply ridiculous. Fortunately, I was able to save the day and alert the network administrator
Oh well, at least they opened up port 22 for me
PayPal $$ if you sign up for free offers (eBay, cred cards, e
They just have it too easy. Back in my day if we wanted to change our grades we had to:
1) get in enough trouble to get sent the principal's office
2) make sure secretary gets distracted
3) quickly pull out secret drawer and note password without being noticed
4) go home and bust out the acoustic coupler
Nowadays all you need is to do is get out the laptop...
Don't even get my started on precipitation, inclination and the commute.
Does it really matter??? The fact that its a scratch drive is a useless point. The only point that is worth talking about is that a School let private data get out.
:) Hey RIAA, please go after the fools responcible for the... I might actually enjoy watching that happen. :)
Great your a volunteer, and I dont want to offend you living in the peoples republic of Palo Alto, however sensitive data did get out... and you are somewhat responcible for what happened.
I love it when administrators blame stupid users, instead of themselves because its easier to blame them, then accept the blame that they screwed up.
Praise to the Weekly for exposing this mess!
Lets discuss what should be done to the people responcible.
Anonymous
Mac/Linux System Admin.
Well, logically, ya, you should be able to listen to anything being broadcast at you.. But, look at what they do if you descramble satellite feeds without paying..
But, I don't think they accidently picked up the signal. They said they were sitting just outside of the school's office, with the proper equipment (ya, laptop and wifi card, big deal), but that's intent. Not only that, but sitting outside that office ("Using a laptop with a wireless card outside the district's main office") they sent data to retrieve data ("the Weekly gained access to such data as
Ahhhh, and here we go with the law (I've been busy with work, not much time to play). The summary of this is, yes, they broke the law, and it's punishable by $2,500 and/or 1 year in jail on the first offense, and $10,000 and/or 1 year in jail on the second offense.
PENAL CODE
SECTION 630-637.9
631. (a) Any person who, by means of any machine, instrument, or
contrivance, or in any other manner, intentionally taps, or makes any
unauthorized connection, whether physically, electrically,
acoustically, inductively, or otherwise, with any telegraph or
telephone wire, line, cable, or instrument, including the wire, line,
cable, or instrument of any internal telephonic communication
system, or who willfully and without the consent of all parties to
the communication, or in any unauthorized manner, reads, or attempts
to read, or to learn the contents or meaning of any message, report,
or communication while the same is in transit or passing over any
wire, line, or cable, or is being sent from, or received at any place
within this state; or who uses, or attempts to use, in any manner,
or for any purpose, or to communicate in any way, any information so
obtained, or who aids, agrees with, employs, or conspires with any
person or persons to unlawfully do, or permit, or cause to be done
any of the acts or things mentioned above in this section, is
punishable by a fine not exceeding two thousand five hundred dollars
($2,500), or by imprisonment in the county jail not exceeding one
year, or by imprisonment in the state prison, or by both a fine and
imprisonment in the county jail or in the state prison. If the
person has previously been convicted of a violation of this section
or Section 632, 632.5, 632.6, 632.7, or 636, he or she is punishable
by a fine not exceeding ten thousand dollars ($10,000), or by
imprisonment in the county jail not exceeding one year, or by
imprisonment in the state prison, or by both a fine and imprisonment
in the county jail or in the state prison.
I won't say that the school didn't fuck up, because honestly they did.. But, as any stumbler/wardriver knows, they're not the only ones. It doesn't take a computer expert to get into most networks. They should have done a better job, but failed. This is barely news, it's just a reporter bragging how they broke the law, invaded the privacy of thousands, criminally trespassed, and are flaunting it as news. It's as criminal as if they broke into a bank and took out cash, even if handing it back in the morning, to prove that it could be done.
With that said, ya, my laptop is set up for stumbling too.
Serious? Seriousness is well above my pay grade.
BTW, here's a nice little list of some of the state laws, just regarding the wiretap portion.
. htm
http://www.ncsl.org/programs/lis/CIP/surveillance
Serious? Seriousness is well above my pay grade.
But, look at what they do if you descramble satellite feeds without paying.
Ahh, that's activly *descrambling* the data. That's going above and beyond, theft of services and all that. You need to buy a key of sorts to gain access to these services, unless you are in canada ofcorse.
intentionally taps, or makes any
unauthorized connection, whether physically, electrically,
acoustically, inductively
I do not claim to be a lawyer, but largly based on what i've observed tap, as in wire tap, only applies to audio tapping. As in, it might very well be legal to pop in a security camera so long as it doesn't pickup audio.
Further more, even the law you quoted implies *authorized access*. I would argue strongly that without basic security mesures that all people *are authorized* to access this material. It would be no diffrent, in my minds anyway, if they put up private information on a public web server, esp if google picks it up seeing no robots file in place.
I would further submit the fact that the service of WiFi netaccess is very much common place. For example, my local starbucks coffee offers WiFi access for a fee, and I know of one CAFE that offers public free WiFi access.
Given that this is a service offered in some establishments, a stumbler who accidently comes across access might reasonably assume that this is a service, given there was no security and *authorized access* is granted to everyone by the WiFi router based on a configeration choice by the system admin. My argument, which may or may not stand up in court, would be that because the system authorizes you that no law was broken, even if access to propriority data was made publicly available to anyone who requested access.
We can clearly agree the school fucked up, but I'd argue that they should be held criminaly liable because their WiFi network specificly grants *authorized access* to anyone. Just because it's an automated authorization system is no excuse in my minds eye, no diffrent then asking for propriority records and getting them by fax from an office worker that wasn't told better.
If it was me personaly, i'd say, "oh cool, public WiFi network, I can check my e-mail from here".
There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
WPA will replace WEP as the standard 802.11x encryption scheme. It fixes the major problems with WEP e.g. airsnort won't crack keys anymore, and the implementation is supposedly easeir to use than WEP.
The bad part is its no IPSec w/ 3DES, but its better than WEP and many manufacturers will be able to provice WPA by ugrading the firmware on the card and access point, depending on the model of course.
I believe Windows XP support is already here.
You hear stories every so often about some "hacker" who gets into a system, does nothing, tells the sysadmin, and gets arrested/fined/sued, etc.
But when a newspaper does it, its just reporting? Id be raising hell if I was a parent and some newsie saw my kid's psych evaluation!
The ultimate network admin tool needs HELP!
I would assume the files were on a server. Even a Windows Server requires user authentication. If they were just using windows file sharing that should REALLY be pointed out.
I work at a school district and not only do we need server login, but also a login to the database that stores student records. Two counts of violating digital security...
Yeah right, this is probably just some ploy to hide the real truth.
That real truth being a gang of hacker parents hacking into the school database and copying such information to an unprotected location in order for themselves and other parents to find out their childrens' marks since report cards seemed to be getting "lost" in the mail.
Well, I'm sorry sir. We're going to have to allow Bob Squatter to build a condo on your back 40 because by not verifying that your land was secured, you gave up all right to it.
Actually. If your neighbor builds a fence to seperate your property from his, but decides to build it on YOUR property, you have seven years to notify your neighbor, otherwise, that part of your property is now legally his. I know, because it happened to my parents.
read, think, post.
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
This is not like private property or a parking stall, where you shouldn't be in the first place. This is more like a business.
think of it this way:
Its 2pm on a monday afternoon. you walk down the street, and walk passed a 7-11. All the lights are on, and the door is unlocked. So you walk in. If you were closed, you shouldve said so, and locked the door.
The reason its more like this, is because there are public APs. How do you differentiate public APs from private APs? If you put a web server on the internet, how do you know you aren't allowed to use it, unless you secure it?
That's like me buying out the BedMart at the local mall, to use as my personal relaxation place, and getting pissed and arresting everyone that comes in, because its my "residence", not a store anymore. How were the "patrons" supposed to know this wasn't a store anymore?
I have a friend who has a thai love slave. Well it ended up more like him being her american love slave, but there was definatly some form of love slavage involved.
There are ways to set up windows shares so that they do not reuire a password of any kind. In this case, the data is still publicly accessible. If the reporters were guessing passwords until they got access to the data, this tells us two things:
1) The school needs to require high-level passwords. 2) this reporters was seriously breaking and entering and should go to jail.
Either way, this is serious. If a regular reporter can wardrive around finding out school records (including psychological workups and SS#), then anyone can do it, regardless if he guessed passwords or not. The school should be required to beef up their security, or stop using wireless, which is ridiculous for a school anyway. Wire the buildings.
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
The point is that there is no security to bypass... None, zip, zero, zilch. I live and just graduated from Monta Vista in the nearbye Fremont Union High School District, and the thing about 90% of the District tech guys is that they don't know what they are doing.
I've met an MCSE before that didn't know how to add a user to a Windows 2000 server. Honestly, these people on the most part are the lowest of the low. And similarly in FUHSD they too have an unencrypted wireless network. I can access that network *from my house* that's a mile away, granted we had to pull out a friend's parabolic dish, but we managed to hit the thing, not to mention that I have good line of sight to the entire valley from my house.
These guys don't comprehend that a wireless network does not stop at their walls, and they leave the networks unencrypted to make it "easier" for them. Security is only a concern as long as they don't get caught. I've seen, I've known students that have broke into a Apple File Sharing server with a simple brute force attack, and then they proceeded to delete several students work from the Typing class and move some files around.
This was a situation that was easily preventable by maxing out the number of times a account can attempt to login within an hour, but they didn't do it because it was "too inconvient." Evidently these guys also aren't smart enough to remember their own passwords, so much for security.
~Noodle
Stayed in a uni hotel (part of their conference suite) about a month ago and each room had access to the campus network and Internet via a 100BaseT connection. Hooking my laptop to the network revealed dozens of workgroups, numerous student and uni PCs. About 80% of the PCs had guest login disabled, but among the noteworthy that didn't: 1 PC hosting numerous recent movies including the one where there is no spoon (reloaded) 1 PC sharing 'my documents' with tons of party pics (all very pretty but harmless) Numerous MP3s in about 20 shared 'my music's A smattering of pr0n Almost every accessible PC infected with worms that spread via NETBIOS (Norton AV 2003 went frantic every time I browsed a share) Welcome to the real world L3K
AT&ROFLMAO
Apparently some information in an e-mail list archive became publicly available by accident. Unfortunately this information contained the names and ssn of several students. 9,505 students to be exact. Oops.
Scary thing about this was that it was found out by some students who accidently ran across a cached page of this on google. If you wanna check out the stories that ran in the school newspaper you can click here and here
Dog Barks. ;-)
BTW, Good Luck BMW.WilliamsF1 team on sunday.
... it was some sysadmin or the person who setup the network!
That's like blaming the ethernet for hacking my box!
-- Mike
IMO if you design a network and are considering security, assuming that the network backbone is directly connected to an enormous internet cafe filled with script kiddies, warez doodz, black hats and other undesirables is a good idea.
Good Hunting
CowardI tried to find a comment on this issue, but didn't see one. Sorry if I missed one.
This has nothing to do with WiFi. The data was on the network and not even password protected. Take the WiFi out of the equation, and from what I read in the article, anyone, even a student in the library, could have accessed this info. Teachers shouldn't even have access to the psych evals unless there's a reason and they get permission. The board's own policy says that pictures of the kids shouldn't be stored on the network. The point is those files were supposed to be in a locked down area of the network, and they weren't. Even if they were, the individual files should also have been password protected, in addition to the volume they were on.
And as far as the newspaper getting in trouble, it seems to me that allowing guest access means that you're ok with guests connecting. I don't think there was much 'hacking' involved. If there was, they should get in trouble. Otherwise all I have to do is get a job as a freelance writer for a paper, and then I can do whatever the heck I want, and if I get caught, then I just say I'm working on a story. That's BS.
You want to do this kind of investigating, you should accept the risks. If you want a by-line and glory, you deserve what you get. Sometimes doing the wrong thing for a good reason is needed - but if you don't punish people when they're caught, it's going to get out of hand.
666-607: 6th floor apartment of the beast
is that you?
"WiFi Exposes Sensitive Student Data"
The technology isn't the problem, it's the people. Oh sorry, I guess "People Still Stupid, Film at 11:00" doesn't make a juicy headline, now does it?
I'm not sure how this applies to an accidental WiFi transmission (IANAL), but i'm pretty sure that it would be grounds for serious fees and fines if it happened at any other kind of institution. i'm wondering whether the school will be in major trouble on this account alone. Under the rule, only health providers would face penalties for disclosing medical records- but if the school is a healthcare provider, for example, if they have an on-campus medical unit, they might be held liable.
thoughts, ideas, am i way off base here?
"I'd say 'Have a good time,' but arson is still illegal.
are like a child with a gun.
Healthcare article at Kuro5hin
On a side note, could the newspaper be held liable for this, given that they were intruding on the network without permission?
The school district could go after the newspaper, but that would only gain them more bad press. Not only from the paper that did the investigating, but from all the other media outlets that worry a judgment against it would have a stifling effect on investigative journalism across the board.
Did the newspaper bypass security and illegally access copyrighted material?
What security? There was none -- that's the point.
Also, what copyrighted material? Public school records not only are property of the government and thus uncopyrightable, but something like a list of grades is also a collection of facts, which have also been affirmed as uncopyrightable.
If so, didn't they violate the DMCA - no matter what their intent?
Hopefully they will find that there was no security to bybass.
What is potentially so bad is that the DMCA could shoot the messenger, here. The newspaper wasn't some black-hat cracker, who would have never revealed his/her new precious bounty. The school now knows about the vulnerability, which puts them in a much better position than before.
Healthcare article at Kuro5hin
Those words don't mean what you think they do.
I'm sorry, but what did you just say there? I know it's still early, and my brain isn't in gear yet, but fuck me!
Good point as well. But maybe we bring it to the school administration first before publishing it.
To me that's what it appears that they do.
As a rock-in-roll Physicist once said, No matter where you go, there you are.
I won't say too much about who they are...I would like to go back there someday, replace my ex-boss, and clean up that stinkhole. It is a small town, and the newspaper won't publish anything "inflamatory" (their words) like that. Irrespective, they would do the same thing they did before, when a few people realized that they were open to the world, and were getting their e-mails and files read; they will claim it's been fixed after the expenditure of $50,000 or so by their expert Technical guys. When in fact nothing at all had changed...It's just really sad.
While concepts of permissions and network based storage may be simple to those of us who are experienced computer users they are not easy to explain to a room of teachers. One on one training is the most effective way of helping teachers grasp the concepts neccesary to make them self-suficient computer users. I have taught several classes only to have the teachers who are already comfortable with these concepts pay attention. Those who need the most help usually sit there and chat or knit. They have the same defeatist attitude about computers that they try to discourage in their students. Many teachers, have an irrational fear that they will somehow break their computer by doing anything they are uncomfortable with. When teachers ask "How did you learn all this stuff?" I encourage them to 'break' their computer (softwarewise that is :) and then try to fix it.
Solutions. I think many of these issues will fade as younger teachers who are more comfortable with technology replace the older teachers who are less willing to change. New teachers are now required to take quite a few educational technology units in order to get a teaching credential. User interface standards must improve throughout the software industry. Most of these programs make sense to the nerds who designed them but more testing and better design is needed to make them usable for your average teacher.
This particular instance in Palo Alto appears to be an issue of user ignorance as opposed to the incompetence in the IT department. Quite simply, someone placed private documents on a public server.
Obviously I'm making broad generalizations for the sake of discussion but they are based on first-hand experience. Just relax and take 'em with a grain of salt.
Shouldn't that really be "dumbass sysadmin exposes student information"
And really; with all of the unemployed admins in the area, you'd think the school district could pick and choose one that was competant.
The title is completely wrong. While WiFi is the medium, the obvious lax security is the real culprit.
I wonder why we never see sensationalistic headlines such as "100baseT Exposes..." or "Frame Relay Exposes..." or perhaps "Ethernet Exposes" ????
10 MD
The best analogy I have seen walking down a street where all the houses are for sale, and none of themhave doors up, to facilitate people coming in and looking at them. You decide to buy one and do so, moving your stuff in, BUT NOT BUYING A DOOR. (As in not even attempting to install any security, not just installing inept security)
If you do this, and then refuse to buy a door, or put up a no-trespassing sign, or do anything else to indicate that people can not enter, then when people come up, it is not trespassing. It is not in fact surprising if people come in, sit down on your sofa, watch your TV, - for all they know this house is like the others, only set up with furniture to make people more likely to buy it. They may even say to themselves, what a nice neighborhood, where the realtor can leave a cool place like this unguarded and nothing gets stolen.
If you make NO, nada, zero, one minus one, one greater than negative one, effort whatsoever to create security or at least indicate that this is private property, then people are legally allowed to enter your area property and look around.
Note, they are still not allowed to TAKE anything. That means it would be illegal for the newspaper to publish any of the secure information, such as names, pictures, grades etc. In addition, if they did not at least make reasonable efforts to inform the owner of the system before they pubish, they could be charged with encourageing criminal actions. But they are allowed to look at it, and definitely allowed to publish the fact that they looked at it.
excitingthingstodo.blogspot.com
Also, what copyrighted material? Public school records not only are property of the government and thus uncopyrightable, but something like a list of grades is also a collection of facts, which have also been affirmed as uncopyrightable.
What makes you think the DMCA has anything to do with copyright? The DMCA is a tool. One that allows those with power/money to stop those without power/money from doing anything that those with power disapprove of. Things like making refill ink cartridges. Or taking a sewing pattern out of the trash and reselling it (without any copies being made).
I'll see your senator, and I'll raise you two judges.
The point is that there is no security to bypass... None, zip, zero, zilch.
What do you mean? They encrypted the data in binary and then broke it up into TCP/IP packets.
Just because the journalist could listen for the SSID of the network, connect to it, browse/download sensitive data, and then decode the binary data into a format that he could understand doesn't make it right. In fact, this should be protected under the DMCA or the DMCA should be reworded to include things like this.
On another note...what's the difference between the above scenario, with someone viewing data on an unencrypted wireless network from the one where someone finds a phone number of a modem, dials into a system, and downloads sensitive data? The former is considered OK because the data isn't officially encrypted and protected under the DMCA whereas the latter was illegal because of ignorance and fear. In my mind, they are the same thing...
in the CS faculty, you could connect to a public ethernet jack in a computer lab, and gain read/write access to all the students', professors', TAs and technical staff's home directories. Needless to say these include a lot of personal data and grades, which could be manipulated before being sent to the more secure permanent stores.
They absolutely should be held accountable for their own mismanagement.
However...
That doesn't make it okay for someone to access the information in this manner without authorization.
Yes, it was broadcast over public airwaves... but that doesn't automatically make it public property. Intent plays a large part, ie: if you KNOW they don't realize it's set up that way, and you KNOW the data is not for you, then you are doing something wrong.. if not legally then morally.
But, the law is not the computer, and it's not pure logic.
You can say "Well I sent a request for an IP address, and it gave me one, therefore it authorized me to look at all information available on their network". Yeah right.
Judge: Sir, were you aware these were school records, things that are usually confidential? (by virtue of the fact that you reported it as newsworthy, obviously you were).
Reporter: Yes, your honor, I was aware of this..
Judge: Therefore you admit you accessed confidential records without authorization.
Access to information is not everything. If I forget to lock the door to my office, and you come in and rifle through all my files, are you going to tell the judge that because the door opened when you turned the knob, that authorized you to read all my files? That, because you knew the door technically should be locked, then obviously if someone left it unlocked, it was meant as permission? I doubt anyone is going to buy it.