Slashdot Mirror
WiFi Exposes Sensitive Student Data
cfarivar writes "'Like leaving a vault open, the Palo Alto Unified School District failed to place a number of highly sensitive computer files containing student information in a locked location on its network. Using a laptop with a wireless card outside the district's main office, the Palo Alto Weekly gained access to such data as grades, home phone numbers and addresses, emergency medical information complete with full-color photos of students and a psychological evaluation."
Hmmm... according to FCC article 15, this newspaper just openly and admittingly committed a felony. Just getting an IP address constitutes committing this felony, but to access files without the network owner's permission is a strict offense. If I'm not mistaken, didn't a San Diego security company get raided by the FBI for doing the same thing?
WiFi should be banned. In fact there was talk of a congressional hearing on the sad state of security in WiFI. It is insecure by default and the maximum secuirty you can apply to it is flawed and easily hackable.
If this does anything, it should make the gov. smack the hell out of all WiFi consortium members by preventing them from selling any more equipment till they actually get it right. (And giving refunds for all faulty equipment already sold)
Hell, at my high school, I was a junior admin (most bullshit class ever). Each class had a computer which kept grades for the class. Whatever shitty grade software they used stored the grades in PLAIN TEXT LOCALLY. These were win98 machines, no user permissions, freely used by all students. I discovered this fact when one of my teachers forgot his password to the grading program and after a little browsing opened up the raw text file to show us our grades. This all happened in one of the largest (and most inept) school districts in the country too, not some backwater. Actually, from the articles i've seen, it looks like the small school districts have it together more than the large ones as far as tech goes. Our admin was a former chem teacher who spent near 0 time doing anything useful, letting us junior admins do all the grunt work.
Photos.
Did the newspaper bypass security and illegally access copyrighted material?
If so, didn't they violate the DMCA - no matter what their intent?
After all, if the US constitutional right to 'fair use' is not a loophole, why would journalistic investigation be?
/* affect != effect */ void affect(int *thing,int effect) { *thing += effect; }
WiFi is now commonly used throughout hospitals transmitting unencrypted patient information to mobile carts and charting hand helds. Imagine what you could grab just by sitting in the lobby.
This is BS. Most organization don't have public ethernet jacks sitting curbside like a phone booth.
... BUT went unheeded. School districts don't listen to teachers. School administrators are mostly in a world of their own which mainly consists of saving their own asses by kissing the asses of parents (mainly the parents of noisy, disruptive, sociapathic kids (where do you think they get it from)).
The guys who designed WEP just plain fucked up. It was SUPPOSED to be an arduous task to break WEP keys. Instead it's an afternoon of number crunching.
Beyond that, even if you DID jack in to an ethernet in a school system, you SHOULD NOT be able to access private information like grades and student records. The schools I've subbed at (unemployed programmer) have been pretty lax about securing their workstations but their GRADES etc... are secured on Novell servers.
There is NO excuse for the failure of this school district. They are required by law to secure this information. They're lucky a hacker didn't get the info, they would have ended up with a SERIOUS law suit.
PS. I'd bet you money that the paper was tipped off by a teacher who warned the school district
-------- -------- Support Wesley Clark for president!!!
I agree. I am a student in the PAUSD who happens to run a lot of the computer stuff at one of the high schools. Many times, parents (with what I hope are good intentions) try to give us stuff. Usually, it compleatly fails to work well with what is already in place, although they insist that it is perfect for whatever we want to do with it. What is more, we have so many tech parents that all want to set things up their own way, regardless of what anyone else is doing, because they want to "Help the school" that even the tech people for the school don't know how a lot of our equipment is set up. It has gotten so bad that I know of at least two teachers at my school who have said that nobody gets to do anything to their computers without their permission (fortunatly, they both know what they are doing). There are many times when I wish that all the helpful parents would go away and be helpful to somebody else, instead of giving us their old apple 2s or offering to set up that new campus-wide wireless network that is crucial to their child's learning environment.
Sigh. My rant is over now.
My friend and I recently gave a white paper to our school describing all net vulnerabilities. We were able to access attendance and grade records, as well as the faculty folders because they didn't secure one of their servers. Also, there was an "install" folder with copies (serials included!) of all of the install cds for all the programs ever used at our school. Office, Starry Night, the grade program, etc. It was a treasure trove. But, like responsible people, we gave them the white paper. The sysadmin was unaware of any of this.
My school distrist, Fort Bend ISD in Houston, TX, had an IIS webserver that was infected with W32.SadMind. I notified the admin by email who replied with "Uhh.. the server is too slow to run Norton.. so we cant do anything". I laughed and forgot about it for a year.
Then comes a story on slashdot about infected IIS servers, I post a quip about my dealings with FBISD and a couple of Slashdot posters decided to email the district and the local TV station. THAT got it fixed within a day, however the school district was a bit upset at me.
After than, some less than ethical FBISD employee decided to attempt to reset my dyndns.org account password. A while later, I get hits from them to my linux box trying to login to my FTP and protected HTTP pages from them. This is the thanks I get for telling them that they're vulnerable.
As a student, I couldn't really do anything other than publicize what they did on my website and send a few nastygrams back.
Stayed in a uni hotel (part of their conference suite) about a month ago and each room had access to the campus network and Internet via a 100BaseT connection. Hooking my laptop to the network revealed dozens of workgroups, numerous student and uni PCs. About 80% of the PCs had guest login disabled, but among the noteworthy that didn't: 1 PC hosting numerous recent movies including the one where there is no spoon (reloaded) 1 PC sharing 'my documents' with tons of party pics (all very pretty but harmless) Numerous MP3s in about 20 shared 'my music's A smattering of pr0n Almost every accessible PC infected with worms that spread via NETBIOS (Norton AV 2003 went frantic every time I browsed a share) Welcome to the real world L3K
AT&ROFLMAO