Slashdot Mirror
Disclosure of Major Software Exploits by Students?
school-hacker asks: "I am a U.S. university student who has recently come across 2 remote exploits for a homework program used by colleges nationwide. Both vulnerabilities allow students to give themselves arbitrary scores, and possibly execute arbitrary code. To further emphasize the scope of this vulnerability, I have written and -selftested proof-of-concept exploit code. Naturally, I want to share this information with their software engineers, and would even be nice enough and suggest a means to fixing it. However, with the state of current intellectual property and reverse-engineering laws, I hesitate to do so out of fear of litigation or academic disciplinary action. As an ethical geek, what do -you- do?" While the responses from an earlier story might prove useful, here, there is always the possibility of the university making things harder for the person reporting the problem. How can students avoid both legal and academic trouble, when trying to notify their university of security problems?
duh : anonymous email with a threat to go public.
Like the big boys do it.
You could always try approaching your advisor or some other trusted faculty member.
...anonymity is the key. My crystal ball (i.e. an application of Murphy's Law) states that if you try to formally inform the universities of the flaw, you'll get hushed up, blamed and generally blusted. Just write anonymous letters to the companies who develop the software and the universities about the problems. If they don't take action, then feel guiltfree about giving yourself arbitrary scores. Remember: if you don't get caught, it's not illegal.
Bash script for FP whores
Unfortunately the law is set up so that you're nearly as likely to get in trouble for reporting a problem as you are using it for personal gain, so from a cost-benefit perspective, one might argue that it's better to keep the secret for your own uses.
Yeah, what he said. Do you have a prof that you respect & have a good relationship with? Hey, maybe thats a dumb question, but I went to a small school. Anyway, you can potentially turn it into a proof of knowledge in subject matter & get credit. Also, having a faculty member on your side should mitigate the potential downsides of the administration saying "and tell us again why you were hacking into the system in the first place?"
You choose a different nickname from "school-hacker" :-)
Since you've done work for someone else--that they should be willing to pay for--I would argue that you should be compensated. However, I would also recommend legal counsel as to how you can present this offer without it sounding like extortion. And, even if you're willing to give it away, I would still seek said counsel--consider charging the application manufacturer only enough to cover your counsel.
I would watch it, because you could certainly get into legal trouble--I believe that the Russian hackers mentioned a while back only wanted to work in IT, but made clumsy attempts to break into the field. It's easy to take a genuine offer as an extortion, although I think by rights you are due compensation.
--
$tar -xvf
As much as I would love to say go tell someone and show that there is a fault. Just the fact that you know about it might implicate you and make any of your marks in suspect. University bureaucracies are known for making stupid decisions.
If you can send something anonymously then I think you have done what you can.
Don't jepordize your future over a good deed.
Also: what do you have to gain, aside from some kudos? You have far more to loose if someone takes what you do the wrong way.
Remember: Good deeds don't go unpunished.
You could always pull a frame up an have it look like a group of students pulled of the exploit. Or find someone that you really don't like, who doesn't like you, drop down your grades and accuse them of tampering with them.
In all seriousness we live in such a paranoid culture that there isn't really a right answer that anyone can give you. It's nice to see that someone out in America has a conscience but my paranoid mind is telling me that if a student came over and told me that there were exploits in the software, I would begin thinking that he might have done something about it. You might just try an anonymous note to the people in charge of the program.
Here is some advice..
Remember you wil be dealign with two or three groups that have different motives for their existence; ie IT group of your college, college Management, and the software vendor...
You do not have enough power or pull to report this on your own and should not do so as it woudl put your college studies in danger, head this warning!
Waht you need to do is find a tenured CS faculty member that will be a guinea pig fro a blind computer experiment..blind in that he or she does not know ahead of time the directions you will be giving..
The directions must be in the form of question of:
Waht happens if I do this what will occur..in other worsd you are leading the faculty member on the trail of discovery..
Once they get to the end its is then their responsibility fo reporting the security hack and thus your college studies are protected..
Don't Tread on OpenSource
If history is any guide: They aren't going to take you seriously unless you release a working exploit. If you tell 'em about it they'll just try to silence you with threats -- and then you can't choose anonymous release, because they'll go after you.
If you release the exploit anonymously, you'll get things fixed. If you release it with your name attached, you'll get things fixed and bring a shitstorm down on your head -- your choice if you want the notoriety and its consequences.
You should forget about the whole thing. There is no good that can come of this. I understand wanting to be a good samaritan and all, but some people just don't take kindly to that. Considering the risks here (if the company gets pissed off at you, you end up with a computer crimes charge on your record and are basically blacklisted from the industry) I'd say you should delete any copies of any proof-of-concept code you have and forget about the whole thing. Either that or sell it to a fraternity or the football/basketball program at your school.. I'm sure they'd LOVE to get their hands on something like that.
if it is about this blackboard software portal then it is a significant finding. The code is java based and i havnt come a lot of exploits for java based architectures.
Siggy Say, Siggy Do
And you'll wind up with a very freaked out administration. What you want to do is to bring the problem to the attention of one of the techies that run the system, they might react sanely.
What's even better is to send the developers an anonymous bug report (not from a university IP etc.), and, if they don't react, to BugTraq or another security list.
You might also want to wait until you're graduated :)
Is there a professor that you know well enough to approach about this? I would tell them the facts and ask them what to do.
It is highly likely that they will be willing to approach the PTB about the issue--leaving you entirely out of it. At most universities, such a software vendor won't try to get your identity from a prof, they know where their bread is buttered.
If all else fails, drop me an email at roberts period six-two-eight period osu period edu. I'm a prof at Ohio State and I'll be happy to lend a hand.
Have you NOT figured it out yet...THERE IS NO ANONYMOUS on the net...sorry guys, I assure you SOMEONE has logs, your ISP the border routers along the way, If someone, say the government or a deep pockets corp wants that, they will pull an RIAA and get it...If you want to REALLY be anonymous go to the library, use a type writer, send a snail mail from another zip code and DON'T go into the post office to do it...otherwise just get a business license and approach them as a LICENSED contractor with a proposal at the business level...or just watch it all FALL TO PIECES...
:( Thanks DMCA, brought to you by the US Gestapo, protecting our homeland from ourselves...
Remember even LAME infant like encryption is now a federally protected item
errr....umm...*whooosh* *whoosh* Is this thing on ?
A lot of people here have advocated alerting people about this anonymously. Whether or not you feel this is the correct thing to do, consider including a PGP public key with whaterver submissions you turn over to relevant parties. This way, if it becomes advantageous at a later time to take credit for your actions, you can prove that you were the anonymous whistle-blower.
Don't ever change your score, even if you give yourself a lower score, even if it's just for a demonstration. Any university will go berserk if a student does that, even if he acts in good faith.
If you decide to pursue the route of getting something done about it, I'd suggest:
Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)
If you're worried about repricussions, then use a public library terminal and a new hotmail type free mail account. Most public libraries intentionally do not keep traffic logs these days anyway (because of the privacy issues involved with turning over those logs if they are subpoenaed).
But, I'm a security admin at a university... I occasionally have students bring vulnerabilities to me. Often I already know about it, but I still welcome the input and am thankful for the extra eyes watching the network. I've just got too many nodes to keep up with to catch every computer.
----------
perl -e 'print(pack("H*","646176652e7761676e657240676d616
I would argue that there are several answers depending on the poster's goal. Is he interested in working for Blackboa...I mean, the software he is discussing (and/or any other company) and wanting to show his prowess? Or is it truly out of the kindness of his heart? Regardless, I would completely bypass the school. Contact the software company directly as they understand the issue better. It would be your luck that a random administrator at your school would hear about this and label you a h4x0r and a menace to society -- remember that people hate what they cannot understand.
This is my digital signature. 10011011001
With the current political climate, your best bet is to do absolutely nothing. People are arrested for expressing opinions, others are denied due process for free speech, and still others are deemed terrorists for even the slightest questioning of a government's actions. Corporations mandate what can and cannot be done and are happily funded by a more sheepish and numbed people, armed with a more sheepish and willing set of so-called representatives.
Do nothing. Sure, you can pat yourself on the back for your ingenuity, but file your discoveries away in your mind. The world cannot tolerate them now.
Sad. But true.
- As the previous poster said, an attempt to solicit compensation from the software vendor for "work done" could constitute attempted extortion, and as such could be illegal.
- Even if you do this in a legal way, you stand a good chance of being portrayed in the media as an evil money grubbing bastard.
- If you get branded as evil, other people who are looking for a exploits as a genuine public service will also tend to be "tarred with the same brush". That is likely to put them off doing this important work, which would be a BAD THING!!
If you are nervous about the whole position, your best bet is to inform your school. (Do it in such a way that you don't give them any evidence they could use against you until you know that they will treat you fairly.)Your school has a vested interest in not having students hack the marking software they use. They won't want their grading schemes to be publicly called into question. They should also have the resources to deal with the question. If they decide to ignore the issue, they may get into legal trouble later on when they are sued by ex-students whose degrees have been "devalued".
You don't report this. Simply you don't. You are too vulnerable.
After you graduate, if you want to report it, send hard copy source listings to admins of the system at the college, the company that runs the software, and several professors in the technical areas of your college. You then forget this and don't ever think of it again.
Destroy the computer the harddrive the printout you had was created on. This is so you cannot be determined to have cheated at your degree if you ever DID get "located".
I suggest wiping it with the software that PGP comes with then taking a road trip to celebrate graduation to a couple states away. If you're in California, visit Iowa. If you're in New York, I would have to say GA is nice in May. Leave it in a dumpster somewhere mixed in with nothing else of yours.
I think in 10 years there will be a system of computer ethics, or a government board that you can report this stuff to with a condition of amnestey. Its all too new to too many people for that to work right now, so you just have to practice silence.
Want to see every step I took to start my company? http://www.rowdylabs.com/blogs/pitchtothegods
Doing good coding can get you some nice job references (as per your teacher at University), and some good friends down the line, but it doesn't excuse you from the rules per detention, etc. (what the detention was about is a different issue, so I just won't go there).
Encrypting the code is, at best, bad karma. It could come back to haunt you years down the road when an important contract is nixed because a friend of a friend remembers what you did way back when. Relationships are one of the most important things we have in life, and when you burn enough bridges life just gets less and less pleasant. I'm sometimes shocked by where the contacts I've built up over the years have taken me.
BTW: If you were actually paid to develop that school code that you encrypted, my guess is that the only reason they didn't sue your ass of is that you didn't have any money in your pants.
Free Software: Like love, it grows best when given away.
Your assessment of Microsoft's interest in security is not accurate. Full disclosure did not cause microsoft to give a damn about security. Security became important at MS when customers started saying "we care about security, your shit sucks, we're not buying it anymore". MS doesn't give a damn about a bunch of egotistical self-serving "researchers" that are looking to sell their name as a brand and shop around for consulting dollars. Security is a priority now at MS because customers have finally said that they want it, and are willing to pay for it. It's that simple.
MS doesn't as a general rule try and make poor software. It doesn't try to make insecure systems. I'm sure MS loses more sleep and money over its security problems then you do. When you own 50 million lines of the worlds most widely deployed code and never have to issue a security patch, im sure MS will pay you whatever amount of money you can think of to tell them how to do it.
Incidentally, the ideal system from MS' point of view is staggered disclosure -- exactly what you describe.
Even people on full disclosure lists are starting to play along with this and realize that releasing exploit code without giving vendors and more importantly people running the affected systems time to patch first is doing the entire internet a huge disservice. It simply isn't responsible, and people making this an emotional or idealistic issue rather than a pragmatic one are the sort of "security people" that i hope eventually fade away...
My opinions are my own, and do not necessarily represent those of my employer.
Sending notice to third parties is INSURANCE. What local paper wouldn't love a feature story about the local school screwing over a smart, observant student who was only trying to help them? Sure beats covering the local dog show... again. This goes double for the STUDENT paper.
Freedom: "I won't!"
The traditional reason for not listening to anonymous sources has been that they tend to be unreliable; however, if you provide a working exploit when you write to the school, press and/or officials they will have no reason to doubt the veracity of your claims. They might doubt your motives, but that's a different matter - if there's something broken and it's been proved to them, then regardless of the source they may wish to pursue the matter.
"'I pass the test,' she said. 'I will diminish, and go into the West, and remain Galadriel.'"
- JRR Tolkien.
well, you can tell he never took french, or it would be voila, as you have pointed out. You can also tell that the original poster is a pile of shit who I would never want to work with. He might have some coding skill, but he has no business sense or ethics. Basically he is a failure at life, and i s a load that should have been swallowed.
If your College/University has a law school then you might be able to look there for advice. If the university has such a school then it is possible that they may have one or two professors who can advise you in this matter. Unlike the School's Legal staff they are not bound to protect the school in the same way.
I would still be wary when approaching them, you don't want one of them to cause trouble any more than any other. But it might be a good direction to turn.
I've been in the same situation before.
My school used to use RM (a supposedly security enhancing program) to keep people from using too much space and running every program they wanted to.
I found several very critical bugs in it, that allowed me to do anything, change people's settings to browse and change things on the server. I told my comp. sci. teacher (this was highschool) and after hefty explaining, he watched over my shoulder as I proved it. With a little more tinkering I found other ways of getting in, and ultimately changing everything from schedules to marks. Most teachers understood and trusted me not to share this, and I didn't until they switched their systems.
Except for one teacher.. who tried to get me kicked out. She is a comp. sci. teacher, though she has no clue what's going on. Started to accuse me of stealing, and of messing with the system. Thankfully nothing happened, because most other teachers knew me. School approached me and asked me what to use, I said use Linux, it's free, and waaay more secure then all this.
They ended up using WindowsXP (and depleting most of the comp. sci. budget), with an addon called Visual Castle. Well.. I've found several bugs in it again, and I can see marks and change anything I want. I haven't.. and never intend to do so, and don't intend to tell anyone I can do this.
My suggestion? clear your hands of it all, and forget about it. Not worth loosing your future over this, whatever they change, probably won't make much of a difference. There is always another bug, or misconfiguration lurking.
This story from The Register records what can go awry with a plan to inform someone of their security weaknesses.
The short of it: The lad's served his 18 months and is appealing to rescue his reputation.
Be Careful.
Help stamp out iliturcy.