Student Attempting To Improve School Security Suspended

TA_TA_BOX writes "The University of Portland has handed a one-year suspension to an engineering major after he designed a program to bypass the Cisco Clean Access (CCA). According to the University of Portland's Vice President of Information Systems, the purpose of the CCA is to evaluate whether the computers are compliant with current security policies (i.e., anti-virus software, Windows Updates and Patches, etc.). Essentially the student wrote a program that could fool the CCA to think that the computers operating system and anti-virus were fully patched and up to date. 'In the design of his computer program, Maass looked at the functions CCA provides and identified vulnerabilities where it could be bypassed. He wrote a program that emulated the same functions as CCA and eliminated some security issues. He says that the method he chose is "one of six that I came up with." Maass says his intent was not malicious. Rather, the sophomore says he was examining vulnerabilities so that they could be fixed. "I was planning on going to Cisco with the vulnerability this summer," Maass says. '"

Comments

University doing a favor

[Anonymous Coward]

It seems obvious that the suspension is a favor done by the university. A person of this caliber could do better in the workforce or a better university instead of TEACHING the university...

Re:University doing a favor

[bfizzle]

I wouldn't want to hire someone who wrote a piece of software that clearly violates University Policy and used it for 6 months. Its one thing to write the software, distribute it as a proof of concept and let Cisco or the University fix it. Its a whole other to write the said software and use it to exploit the hole for an extended period of time then claim you were going to tell Cisco months later. His actions sing a whole different song than his words.

Re:University doing a favor

[rblancarte]

I don't know if I would fully agree with not wanting to hire this guy. He is clearly smart and knows what he is doing. As a programmer, he could be a valuable employee.

NOW, that being said, I am the first that will say - if you do something like this, know that you are breaking the rules and be prepared to pay the consequences (the guy is ROTC, and probably is going to own the Air Force some money). If you stumble upon something, that is one thing. But to blatantly break the rules for SEVEN months - bad idea.

And the guy can say "I was planning on going to Cisco with the vulnerability this summer," But that is just talk. Yes, it could be true, but it also could be something he is saying to try to cover his butt since he was found out. Sorry, paint me skeptical.

RonB

Re:University doing a favor

[cheater512]

I'm not sure exactly what the Cisco software does so I could be on the wrong track.

At my uni we are given a pathetic 150mb/month internet quota and we are charged $7/gig extra.
I naturally found a way to get free net and I really dont have any problem using it for personal use.
I dont abuse it or anything either.

If the Cisco software put constrains on how the guy could use the computer then I would hire him in a instant.
The more you try to lock something down, the more people try to fight back.

You'd be stupid not to hire the people who beat the system - especially since we are talking about a Cisco system.

Re:University doing a favor

[Romancer]

Totally agree. Regardless of what his intentions were, he did make the entire network less safe against the specific will of the administrators. By bypassing the security check he opened up a door that they were trying to keep closed. He states no gain from bypassing these checks that would offset the risk created by using his code. So there was no benifit other than making the network less secure.

Now imagine that a virus got in through this hole and deleted all their e-mails on campus. What would the opinion be then? Even if he had contacted Cisco I think that they would have told him in the second line to not run the code because it would cause a vulnerability. IE:

Thanks for contacting Cisco. Do not run that code on any network that you do not own.

Proof of concept is a totally different thing than what happened here. He is trying to cover his ass.

Re:University doing a favor

[Anonymous Coward]

If you implement/code security software with holes in it, you deserve to have them exploited. If this university was truly devoted to research they would take this as an opportunity and challenge other students to exploit the system. This isn't a national defence system or even a corporate accounting computer. This is a university, their primary concern should be research, their secondary concern should be education, and security shouldn't even enter into the picture.

Re:University doing a favor

[kimvette]

I wouldn't want to hire someone who wrote a piece of software that clearly violates University Policy and used it for 6 months.

Keep in mind that some universities require that you run only WINDOWS on machines attached to their network, including computers connected from your dormitories. Sometimes policy is stupid and ought to be ignored, just as unjust laws ought to be broken.

Re:University doing a favor

[EveLibertine]

Wrote a piece of software that clearly violates University Policy and used it for 6 months... His actions sing a whole different song than his words.

The biggest offense that you can sight in his actions is that he gave the software to a few friends and a professor. When developing a piece of software such as this, one might be best served by testing it on a variety of different computers, especially if you plan on presenting it to a potential employer. In fact, this sounds pretty close to what he said he was doing with it, so his actions speak pretty closely to his words. You don't just write software, guess that it works, and go run off to a company to demo for to them. Unless you're some kind of fan of untested, broken, and poorly designed software. I wouldn't want to hire anyone who who did anything less. Regardless, I imagine giving the software out to a professor was probably not the brightest of his ideas, as it was probably installed on a school owned computer that probably (if my own experience is of any value here) crashed, broke down, and did all sorts of other unsightly things that required the services of their local IT support. Upon their latest maintenance of the machine they would find this strange piece of software. At least that's how it played out in my mind when I read that he gave the software to his professor.

Hanlon's Razor comes to mind:
Never attribute to malice that which can be adequately explained by stupidity.

Re:University doing a favor

[lpw]

security shouldn't even enter into the picture

Have you any idea how much confidential information lives on university networks? Many university researchers sit on loads of proprietary and/or highly sensitive data with confidentiality and nondisclosure agreements up the yingyang. Public health, national security, and defense research come to mind. Security MUST be part of the picture, lest the university loose the trust and the funding from external sources that value the privacy of their data.

You must be new here (the universe, not Slashdot).

Re:University doing a favor

[iamhassi]

"He is trying to cover his ass."

Shame he wasn't a CS major and when he brought it to a professor he should have brought it to the head of the Arts & Sciences department. They usually have a little pull and instead of getting suspended they would have probably contacted Cisco and said "WTF?! Fix this!"

Re:University doing a favor

[hazem]

Many university researchers sit on loads of proprietary and/or highly sensitive data with confidentiality and nondisclosure agreements up the yingyang.

Believe me, UP is a nice school, but it's not one of those.

Having worked with some of these particular IT people, they're mostly ignorant and get very nasty about any who tries to point it out. They are only coming down on him so hard because he made them look bad. It's being done to make him an example to anyone else who might make them look bad.

They really don't care about security - only the illusion of it.

Re:University doing a favor

[alisson]

So what you're saying is: never use any software, ever, or you deserve to have the holes that are present in ANY pice of software exploited. That's brilliant!

Now, was it pretty cool that he did this? Definitely. But he was an idiot for not coming forward with it sooner. It completely strips his "I was going to tell Cisco later!" argument of any credibility. If you want students to study vulnerabilities in software, you do it on a closed network; not one that is used by other students and faculty.

This is a school. Their primary concern should be education. That's why it's called a "school." If they have a research department, it's concern is research. And all the while, security keeps records confidential, and personal information secure.

Re:University doing a favor

[OakDragon]

If you implement/code security software with holes in it, you deserve to have them exploited.

It was all that thar University's fault, yer honor. Iffen it didn't want its data exploited, it shouldna been showing off them purty security holes!

Re:University doing a favor

[rblancarte]

Three words - Social Security Numbers

As someone who has fallen victim of University ID theft (SSN taken from a University computer), this guy could have been putting information at risk. Sorry, do not pass go, do not collect $200.

RonB

Re:University doing a favor

[rblancarte]

He was an Electrical Engineer and he was discovered and locked out of the University network. He never "came forward" about his discovery.

RonB

Re:University doing a favor

[hazem]

Actually, it's the University that's putting the information at risk by choosing to use an insecure program and calling is security.

There should be no connection between computers in dorms, labs, and classrooms, and any computer that has secure/financial information. They shouldn't have to rely on a crappy program from Cisco to give them the illusion of security.

Sorry about your ID theft. I'm a veteran who uses the VA, and I'm sure my SSN was one of those 26 million that were recently compromised. Got a nice letter saying they were sorry but I shouldn't worry. Of course, no credit monitoring, no ability to "freeze" my credit reports... just sit back and wait and hope nothing happens. Kind of like the University in this case... but not by choice.

Re:University doing a favor

[macdude22]

Clean Access Just runs a check for antivirus software and the latest Windows Patches (there is a mac client in beta). Clean Access doesn't put any constraints persay, but it certainly makes the network a much safer place by making sure folks are properly protected.

Re:University doing a favor

[alienw]

If you implement/code security software with holes in it, you deserve to have them exploited.

So, if you don't have bars on your windows, you deserve to get robbed? If you park your car on the street, you deserve to have it broken into? If a girl dresses slutty, she deserves to be raped? Yeah, great argument you got there.

This is a university, their primary concern should be research, their secondary concern should be education

Exactly. Securing their network against attacks by their own students is neither research nor education.

Re:University doing a favor

[NNland]

The software he was using merely allowed him to access the network and internet from his own computer. If his computer became compromised, it would be his computer that was compromised, not the entire network. This is about client-level security and verifying that (Windows) clients are patched, have virus scanners, etc.

Also note that there exists a piece of open-source software that offers the same access that the the student wrote, has already been reported to Cisco, and is available as a binary for Windows computers: http://kevin.sourceforge.net/

Re:University doing a favor

[hxnwix]

Somehow, I doubt that he'd want to work for you anyway.

Re:University doing a favor

[cheater512]

Well its completely possible that a virus can do what he did.
Its good that he got the flaws out in the open.

Re:University doing a favor

[tomhudson]

You obviously didn't read the articles. He did nothing that people with Macs or Linux or BSD on their computer are allowed to do. Its only Windows computers that they force users to run Cisco Clean Access ... and they also force them to us Symantec Antivirus instead of letting them choose ther own AV product.

Considering that Symantec AV is not the only antivirus out there, if you were running a different antivirus, you would have to bypass CCA as well.

Check out the article - CCA was taking up to 20 minutes to load - who wouldn't bypass that?

Also, it is not clear that it "violates university policy" to write such a program, if you're a computer major, and your class work involves looking at vulnerabilities in software - which is what he learned in class. Then again, those who can, do - those who can't - teach.

FTFA:

Maass was charged with "violations of the Acceptable Use Policy, the Network Security Policy, disrespect for authority, disrespect for property, disorderly conduct and fraud," according to a letter he received from the University Judicial Board

"Disrespect for authority?" "Disorderly conduct?" Aren't they part of what yo go to university for - to question the "accepted wisdom"? Or are universities becoming enclaves where they'll start teaching that women have fewer teeth then men, because Aristotle taught that, and it must be true... (in this case Aristotle was clearly an idiot - he was married - twice - and never bothered to check!!! Sort of like the university's VP of IT, because they don't understand the difference between a program a student runs on his own computer, and "hacking their system.")

So, are they going to suspend every student who goes on a kegger? Flips the bird at a politician? Refuses to let their computer be hijacked by a buggy program? Sounds like a great place not to get an education.

BTW - his actions exactly suit his words - of course he'd withhold giving it to Cisco until he was ready to ask for a summer job / internship. Your uninformed criticism of him, on the other hand, shows you're real university administration material.

Re:University doing a favor

[tomhudson]

But he was an idiot for not coming forward with it sooner. It completely strips his "I was going to tell Cisco later!" argument of any credibility.

If you were a student, you'd have waited until you were ready to apply for a summer internship, that is, if you had any brains or business sense.

BTW - there were students who wre not required to run CCA - they were using macs or linux. There's a lesson there - Windows is not suited for use in schools.

Re:University doing a favor

[alisson]

But, he should have come forward to a professor or administrator first; or just not used the bypass. THe way he did it wasn't exactly his best idea.

And, is windows really suited for use anywhere else?

Re:University doing a favor

[smitth1276]

So your saying that this submission is better evidence of mindless groupthink on the part of Slashdotters than bad behavior on the part of the university? Unthinkable.

Re:University doing a favor

[AmigaBen]

I have read some of the most inane and unintelligent drivel on this thread. Unfortunately, some of it disguised as thought-out responses. The scary part is that these might actually have been "thought out".

Also, it is not clear that it "violates university policy" to write such a program, if you're a computer major, and your class work involves looking at vulnerabilities in software - which is what he learned in class. Then again, those who can, do - those who can't - teach.

Huh? So you think that because he's a computer major, the _production_ network is his personal playground? NO. The production network is only for precisely whatever IT designates it for. And all their policies are not in place just to piss you off. You may not know the reasons they're in place, and they may or may not be good reasons, but there are probably actual reasons. And those reasons probably have a whole lot more history and politics behind them than you realize.

Additionally, has it occurred to you that the reason only Windows computers were required to run the CCA client is because they're the only computers that could potentially cause the kind of problems that CCA is designed to help prevent? And additionally, it makes absolutely no difference whatsoever what you think of the policies, you don't get to ignore them just because you don't like them. And 20 minutes to get on the network sucks, but then a network with haxxored windows boxen on it sucks even more. And as for the Symantec thing.. you think the IT department automatically has the resources to support any software package you want to use in any manner you want to use it?

Grow up

Re:University doing a favor

[tomhudson]

"But, he should have come forward to a professor or administrator first"

Well, he did give it to one of his professors. Looks like the professor also found it useful to get around the hassles of CCA ...

"And, is windows really suited for use anywhere else?"

I highly recommend all sorts of windows - casement, sliding, patio, even X Windows (or just "X") ... just not Microsoft Windows.

Re:University doing a favor

[tomhudson]

First, any computer user can get around CCA just by using Firefox and using the user agent switcher to say that its running Linux - and this is very well known, has been for a long time, so CCA isn't about security; its about promoting a cover-your-ass mentality.

Second, CCA is part of the problem, not part of the solution. CCA isn't a cure - it's a "feel good because we're doing something about it" thing. A cure, on the other hand, will only come about if people get cut off the network because their Windows box is p0wned. Then maybe they'll switch to a real operating system, and everyone will be ahead. The longer people continue to insist on their "right" to use a proven crappy toy operating system, and the longer its tolerated, the harder it gets to fix everything.

Third, nobody was asking the school IT department to support "any software package" - if you had bothered to follow all the links, and then do some more research, you'd have found out that the VP of IT is despised by students and faculty, in part because of the crappy "support" for essentials (like half the computers in engineering don't work, AND they're not available after hours), but still finding time to force everyone to use CCA spyware.

Fourth, he wasn't "hacking a production network." He wasn't trying to break into a database, or steal sensitive information, or access the network on conditions different from any mac or linux user ... or any windows user running firefox and user agent switcher. Get a grip. Be less pompous. CCA is a piece of shit. Its KNOWN to be a piece of shit. Anyone who thinks they're secure because they run CCA is incompetent and should be fired - which is what a lot of people are saying about this particular VP of IT, for this and other problems.

Fifth, its a university network. If its not there for the student's education, WFT IS it there for? (aside from downloading pr0n, that is). Its already "insecure" (CCA is readily bypassable by the firefox user agent trick) so what's the harm of pointing out other ways that CCA fails in its purpose? Or are you one of those who actually believes "security through obscurity and SLAPP lawsuits" works?

Sixth, we already know that monocultures are a bad thing. Requiring that all Windows users use the same brand of antivirus is just f*cked up. This was a stupid decision, because CCA can be configured to accept a list of AV packages. Bypassing CCA in this case is necessary if you want to avoid the problems of a monoculture within a monoculture.

Re:University doing a favor

[Tassach]

Have you any idea how much confidential information lives on university networks? Many university researchers sit on loads of proprietary and/or highly sensitive data with confidentiality and nondisclosure agreements up the yingyang

Confidential information should not be on a computer connected to an untrusted network, nor stored in an unencrypted format. If your data is that confidential, if you have any network at all it needs to be completely isolated from the outside world (no internet connection AT ALL, not even through a firewall, bridge, or proxy)

Re:University doing a favor

[Oligonicella]

"The biggest offense that you can sight in his actions is that he gave the software to a few friends and a professor."

Au contrair. The biggest offense was signing the policy and then using his software on a system that was not his to bypass security assessments.

Who the hell thinks that this guy wouldn't do the same damn thing, were he hired by a securities brokerage?

It's a cannard that he was only testing it. It worked. There was no reason to continue the subtrefuge. He should have expunged the objects, then informed Cisco immediately. Not "sometime this summer".

Re:University doing a favor

[someguy3925]

For the amount of information they have, Universities really do have poor security. Even as a first year student worker in one of their IT departments, I had ridiculously easy access to SSN's, grades, and financial aid data all because the higher-ups had no idea that windows shares on servers needed passwords. My experience with clean access is that it has almost nothing to do with security. It checks a computer's antivirus definitions and then gives it an IP address- basically saving the network support people from having to track down infected computers that flood the network with broadcast traffic. It is also unreliable and often refuses to give IP addresses even when definitions are up to date. If clean access was anything like it was at my school, the student probably wrote it merely so he could get online to check his email one day when he couldn't get an IP address- and the school probably freaked out because all the other students would want to use the software too- leaving their network admins with more work when the next virus comes out.

Re:University doing a favor

[AmigaBen]

Wow, and you call me pompous. I especially like the part where you "quote" me, and in fact I never said that.

Again, your points sound great on the surface, but they make the assumption that you know more about their environment that they do, on top of other arrogant assumptions.

I'm neither defending CCA or even Universities. But for the love of electrons, *you* need to get a grip. The University took the exact right action in this case. The student did the exact wrong thing. Sorry.

Re:University doing a favor

[DerekLyons]

Also, it is not clear that it "violates university policy" to write such a program, if you're a computer major, and your class work involves looking at vulnerabilities in software - which is what he learned in class. Then again, those who can, do - those who can't - teach.

The problem is - he wasn't looking at vulnerabilities in software. He was actively bypassing security software, an entirely different ball of wax. 'Looking at security' is something you do for a day or two. Running a program for six months is breaking security.
 
[rant]
I swear - "I was just looking at security" is the Slashdot equivalent of "think of the children". Every time someone is caught like this individual, they play that card and the hivemind goes into full on apologist mode.
[/rant]

Re:University doing a favor

[DavidTC]

The important thing to note here is that all the software he 'bypassed' did was verify that software that kept his computer protected was up to date.

At no point did he magically get priviledges that any other computer wouldn't have, or that he couldn't have gotten just by running AV software. This isn't a security breach in any meaningful sense of the word.

It's just a demonstration that if you make random people run antivirus on their own computers, and have a program to check that which is, again, running on their own computers, another program on that computer could simply be faking being said antivirus and fool the second one.

Which actually is a security breach if viruses ever started using it.

However, this headline is wrong. He wasn't attempting to 'improve' anything. He was just someone who didn't want to use one of their antivirus products. We don't know if he had his own antivirus or had a Linux box that was being ID'd as Windows (Supposedly there's some sort of HTTP user agent checking going on.) or what.

Frankly, the concept is stupid. There already is a logical way to track down virus-infested computers on a network, it's called watching for abuse like spamming, and you have to do that anyway. The way they do it, they get a lot of irate users who have to set up some program they don't know anything about when they first set up their computer on campus, instead of just having to deal with students as they cut them off cause they're infected. And, as I said, it removes possibility of viruses doing what this program did and faking the antivirus checker. (This isn't that farfetched, viruses already are out there that attack antivirus programs, usually by breaking their ability to download updates.)

Monitoring the network is really the only option at schools. It's not rocket science, because the main abuse is spammers hijacking computers. Of course, nothing requires that virus infections use the network and get detected, but, really, the ones that don't aren't the school's problem.

Re:University doing a favor

[arminw]

......a piece of software that clearly violates University Policy.......

Does that mean that a student who owns a Mac won't be allowed on the University Network since Macs don't need, or at least very few of them have any anti-malware crap? Does that mean Mac users, or even Windows users are forced to run all sorts of garbage software, just so they may use the University's precious network? I'd find myself a more enlightened place to spend precious education dollars. What business is is of anybody to search my PERSONAL computer for whatever software or data it contains? Let them install a decent firewall and spend a few dollars on educating users how to avoid malware by not clicking OK on every dialog box and opening every email.

Re:University doing a favor

[arminw]

....So, if you don't have bars on your windows, you deserve to get robbed......

No stay out of bad neighborhoods. Dress modestly and park the car in your garage.

Computer translation: Run any OS other than Windows. For the University: Install a good firewall between the Internet and the internal network and educate users about safe computing. Keep confidential data on isolated networks.

Re:University doing a favor

[Raideen]

So what was he doing with it for 7 months? Bypassing CCA for the hell of it, tweaking his code, or making sure that it still works? I wouldn't want to go to Cisco only to demonstrate a hole that they patched 3 months ago. If they patched it, I'd want to know if it could be broken some other way. Distributing the code was probably the most irresponsible action that he took since he couldn't be sure of the others' intentions. A bug report would've been a better course of action rather than sitting on the exploit until the summer and would've proved that he was a good citizen. (It's not his problem if Cisco doesn't patch the hole or if the IT department doesn't update their firmware/software.)

Re:University doing a favor

[pallmall1]

But, he should have come forward to a professor or administrator first;

Yeah, well maybe you and all the others who self-righteously say this kid should have told someone in authority about his activity should have READ the fine article:

Additionally, he gave the program to several friends and one professor.

The University's IT department got it's ass kicked by a student -- a sophomore no less -- and now they are really embarrassed, as should be those who defend the University's actions. They are all money-grubbing IT shills afraid that the someone's going to bust their systems and show how full of shit they really are.

Their mantra: better that one student be ruined than our reputation suffer.

Re:University doing a favor

[FrankieBaby1986]

Not to be a troll, but couldnt the network be made safe by not allowing technologically illiterate students to use their own computers on the network? Simply require them to only use lab computers, and supply lots of 'em, nicely locked down, virus scanned,updated, etc. Require users desiring personal computer access to pass an Internet safety exam first.

I've said it before, and I'll say it again: computers are NOT appliances. They require knowledge to use carefully and correctly. Just as one needs a license (and pass basic skills tests) to drive, perhaps one should need a license to use the UNI network? Large Universities would obviously have a problem here, simply due to scale, but hey, it could be done. If you're intelligent enough to go to University, aren't you smart enough not to "PUNCH THE MONKEY!!!... BUY C1AL1S!!", etc ??

Re:University doing a favor

[pallmall1]

Who the hell thinks that this guy wouldn't do the same damn thing, were he hired by a securities brokerage?

All the students, faculty, and the Engineering Department that intervened on his behalf?

Re:University doing a favor

[sheepweevil]

My University (South Dakota State University) uses Clean Access Agent as well. There is an extremely easy way around the program: simply use another operating system such as your favorite Linux distro. The school network lets me in with a simple username/password.
So why go through the trouble of trying to subvert Clean Access Agent? It is simply there to protect the school network from one unpatched computer distributing virus unwittingly.

Re:University doing a favor

[pallmall1]

I'm neither defending CCA or even Universities... ...The University took the exact right action in this case.

It's funny to hear all the fear coming out of the IT shills. How many scholarships do you think that Universities could give for what they pay for this kind of easily bypassed software? The shills are terrified that people will start to ask, "why are you spending millions of dollars on all this IT software when it doesn't work?" or "how much of the latest tuition hike is really going towards paying for ineffective software?"

The shills never even touch the subject that the software is what's really fraudulent. They only say "the kid violated his service agreement, and needs to be severely punished with life-altering consequences." And,"the network is only for what IT says it's for, and IT doesn't have to explain shit to the user." The shills are terrified and will do anything to distract people from the fact that the high-priced software the University uses is dogshit. They'll even wreck a good kid's future.

All these shills remind me of the line in the Mel Brooks movie "Blazing Saddles". The part where the governor (Mel Brooks) says, "We've got to protect our phoney-baloney jobs!"

Re:University doing a favor

[Hal_Porter]

It's probably better for his career to get kicked out for this than for raping the lab animals for example. Or getting wasted on random chemicals and waking up in bed with the Dean's wife who's for some reason very dead.

Shit, this guy will be ok in a couple of years.

Re:University doing a favor

[hazem]

No. But I think anyone who wants to be in the business of storing personal and sensitive information should engage in actual security, not just the illusion of it.

The situations are completely different. An individual does not have the responsibility to resist criminal acts perpetrated upon them (though it's probably a pretty good idea). An entity like a school, who wishes to store personal information is legally required to resist criminal attempts at compromising that information. Basing your security on the idea that all the client computers will be secured is pretty weak. Going back to your bad analogy, that's like making men when buttons that say "rape-safe" and expecting that it will really protect women from being raped.

Re:University doing a favor

[kramulous]

He would probably have been looking for a decent job over the holidays. Better than flipping burgers over a hot oven. Give the kid a break. This industry thrives on people like him. Don't squash him under your sizable boot.

Re:University doing a favor

[AaronLawrence]

150 millibits per month really is pathetic! They could at least let you have a full bit. Those bastards.

Re:University doing a favor

[tomhudson]

"'Looking at security' is something you do for a day or two." Running a program for six months is breaking security.

He's said he found 6 different ways to get around the CCA software. Do you believe that he should be able to find and test all of those in a day or two? Think about it - maybe given another 6 months, he'd find another 6 ways ...

If "looking at security" is "something you do for a day or two" you've got a great future ahead of you as a coder at Microsoft.

When I'm rewriting code at work, I try to always keep in mind the usual suspects - memory allocations without corresponding frees, too-small buffers and buffer overruns, avoiding weird casts just to suppress compiler warnings, "clever tricks" that only give a marginal performance benefit but have too much chance of being misunderstood by others ( or myself 6 months later ) ... and all this is directly related to the security and stability of ANY program. And yes, this program has been running 24 hours a d ay for years ... a 6 month timeframe,or any timeframe, is irrelevant.

As I pointed out, running an antivirus monoculture (which is what the university's misconfigured CCA program enforced) is breaking security. The program, which allowed people to report back that they were running Symantec when they may have been running McAfee or AVG or another antivirus, actually enhances security.

Rather than being suspended, its the VP of IT who should be fired for cause, because this is just another in a L-O-N-G series of snafus.

Re:University doing a favor

[tomhudson]

BTW, my quoting you was 100% accurate:

You wrote:

Huh? So you think that because he's a computer major, the _production_ network is his personal playground? NO. The production network is only for precisely whatever IT designates it for.

... and I said to get a grip, and stop being so pompous.

The "production network" in question is not for "whatever IT designates it for" - its for the use of the university and its students, who, by the way, PAY for it. The mis-configured CCA software promotes insecurity by requiring an antivirus monoculture; there are plenty of methods of defeating it, such as the firefox user-agent switcher, so even the CCA software is only "security through obscurity."

And while you're at it, why not leave trolling to the pros :-)

Re:University doing a favor

[tomhudson]

The funny thing is we're looking for coders at my day job, and as someone who is obviously an independent thinker, curious, isn't willing to stop at the first "solution" (he found 6 different holes), etc., he'd have more of a chance than, for example, the VP of IT, who obviously "doesn't get it" (is "VP of IT" a code phrase for "I can't read or write code worth dick?")

It was probably this sort of thinking that got the student to thinking that maybe if he didn't say anything to too many people, he could leverage this display of talent into a summer job at Cisco. They obviously need him.

And really, what did he do that was "fraudulent?" Did he "steal" access by "forging credentials?" Nope:

In criminal law, fraud is the crime or offense of deliberately deceiving another in order to damage them - usually, to obtain property or services unjustly

He already had the right to those services - he had paid for access in his student fees.

So how about civil fraud>

A civil fraud typically involves the act of intentionally making a false representation of a material fact, with the intent to deceive, which is reasonably relied upon by another person to that person's detriment.

Again, any "forged credentials" to bypass the CCA software were not used to anyone's detriment, but rather, to obtain that which was already lawfully his - net access he had paid for.

He should look into filing a criminal complaint for slander (false statements) and libel (written statements). The uni would have to prove that they were harmed, AND that he obtained services he wasn't entitled to.

Re:University doing a favor

[lysse]

"He did nothing that people with Macs or Linux or BSD on their computer are allowed to do. Its only Windows computers that they force users to run Cisco Clean Access" ...so wouldn't the legitimate way to avoid having do to so be to use a different operating system to connect with the university network, running some form of emulation software for such Windows software as his course mandates, if any?

Re:University doing a favor

[Wanderer1]

Perhaps he was busy doing schoolwork, living a life, or otherwise busy. This simply isn't a major issue for him, and shouldn't be for anyone in his position. It really isn't a critical component, and he has no obligations or deadlines.

CCA is one tool in a toolbox that a competent IT department would employ to protect a network. Its compromise should not by itself lead to a less "safe" network, which isn't really a good use of "safe," but rather a less predictable population of networked clients. The risk posture will change, but the network will not become "wide open" as a result of failure. What will happen is that a population of computers that represent themselves as presenting a level of protection may not actually live up to that claim. If they don't, in theory, the network access devices would not have admitted them to the network, and perhaps that is where the real issue is.

If the school's policies demand that attached clients present credentials that claim their computers meet minimum requirements for admission to the network, and this student faked the credentials for one reason or another, he may be in the wrong with regard to their policy. Violation of policy itself is the reason for suspension, possibly along the same lines as academic integrity. I don't agree with that stance since I do not equate the university networks as important as academic integrity -- university residence networks are often subject to bizarre and experimental traffic which may saturate available bandwidth -- and they should be engineered to cope with that, not to stifle students with security policy. "Policy" is what corporations use to balance a reasonable cost of protection (personnel, equipment, software,) against the needs of the business to consume IT resources in a manner which may risk the stability of those resources. In a college, where students are learning the consequences of their actions - the consequences should not be the result of a violation of "Policy" but rather the primary consequences of their actions, with regard to computer resources. A computer network is not the equivalent of academic fraud or risking one's own life or the lives of others. It is a collection of devices which forms a semi-shared utility, and one that now has effective and robust mechanisms for maintaining availability despite unreasonable loads.

Therefore, while I believe the student did nothing technically wrong, he is probably viewed as acting dishonestly with regard to the published policy. I don't agree with that policy, but I don't believe the IT community should be looking at him askance because he exploited a weakness in one component of the university's network. This knee-jerk reaction is all too common and damages our overall security by reinforcing the idea that those who threaten the network will be discouraged by the threat of retribution rather than a network which does not fail under attack.

Focus your energy on making resilient networks, not on damaging smart kids.

Re:University doing a favor

[NNland]

You are pretty much right.

However, while earlier versions used only web browser User-Agent checks, recent CCA Server software uses TCP/IP fingerprinting techniques to be more or less impervious to simple browser-based bypasses; though any emulated OSes that can gain network access are sufficient, or the software that I pointed out (which changes Windows TCP/IP settings, uses OpenSSL, and spoofs a browser).

I've talked about much of this before on my own web page, as my university (UC Irvine) has installed the Cisco product, I (and others) have spoken out against it, and have been accused of policy violations under similar "rules". Of course three graduate students in three different computer science disciplines (different department chairs) have a better chance against a (clueless) administrator than the undergrad listed in this story. Joe Feise talks about this: http://www.feise.com/~jfeise/blogs/ As do I on my blog: http://chouyu-31.livejournal.com/243263.html and on a web page devoted to this kind of bullshit: https://nerp.net/~jcarlson/cca_.html

If the kid would have gone to a UC, he would be able to submit a public records act request for records of every email sent between those that were working on his case. He could verify his suspicions that the people who ultimately decided were overly influenced by the admin, etc. Of course, had they spoken with him before throwing the book at him, they may have been able to get their desired result (the student not using or distributing the software) without needing to suspend him and put his university funding in jeopardy.

Re:University doing a favor

[AmigaBen]

Funny, that's NOT the quote you gave the first time around. Wave your hands all you want, it doesn't make your lies truth.

'Whatever IT designates it for' is by definition what the University designates it for. If the University truly has some IT department that has hijacked the network, then they have the power to change the people in the department. And again, I make no defense for CCA. What I make defense for is the action taken as a result of a DIRECT and INTENTIONAL violation of AGREED UPON terms. It's a simple concept that has absolutely nothing to do with technology. You can't see that because you're so blinded by your technological prowess and hatred of those who would prevent you from playing with your tech toys.

I do not know about this University and this IT department. But I KNOW in others, it's just as likely that year after year after year that the IT department has been denied the resources it requires to successfully provide a fraction of the services demanded of it (even if those 'requires resources' were for decisions/solutions that even you would agree with). In a situation like that, you will end up with 'rules' that don't seem to make sense upon first inspection, as well as a technological infrastructure that has seemingly incompetent things going on, like half of the computers in engineering not working, or some such as that.

And guess what? The fact that the University TOOK the action of dismissing the student means that, at least on some level, they AGREE with what the department is doing. So don't present it as if the wild west IT department dismissed this student all upon their own authority or something. If there were a juxtapositioning of what the University wanted and what IT was doing, they sure as hell wouldn't have dismissed a student upon IT's request.

Now... that all having been said... most of the time many of the people working in any given IT department ARE morons making idiotic decisions, whether idiotic things have been forced upon them from above or not. So when evaluated with the ACTUAL situation in this case, there's as good a chance that we're both arguing for absolutely no reason as there is that one of us is right, in relationship to this case.

Re:University doing a favor

[tomhudson]

"Funny, that's NOT the quote you gave the first time around. Wave your hands all you want, it doesn't make your lies truth."

Try following the "parent" links up the chain. You'll eventually get back to where you said it here

My post (that you now accuse me of misquoting you) is the first one under it.

You might want to leave the trolling to the pros. You're really, really, really not any good at it.

Re:University doing a favor

[tomhudson]

I agree 100%. Thats why I said elsewhere that CCA is part of the problem, not part of the solution. As long as people continue to wste their time trying to make Windows a viable platform, we're all at risk from botnets. A university should be the best place for people to learn new, safer skills.

Instead, we're seeing universities giving credits for knowing how to use MS-Office, etc.

That's a farce. Higher education me arse! :-)

Re:University doing a favor

[DavidTC]

You are pretty much right.

I actually was assuming that he was running CCA and using some other software to fake it out, not simply faking a computer that doesn't need to run CCA. But close enough.

Reading about it, I can see why people are upset. It's one thing to assert 'University students can only use the network in ways we want', which is somewhat true, and certainly some rules need to exist to keep the network usable, and 'You must run this piece of software that lets us do anything on your machine.' might be okay. (But only, apparently, if you're running Windows.)

While requiring students to run privacy invading software is not good, if they actually had specific written rules the stated in advance about what software they were looking for, and only reported back 'This machine meets the requirements' or not, I might be somewhat okay with that.(1) Running software that can tell them anything is something else...the school has no right to know what software I'm running in general, or what file I might have. They have the 'right' to know what passes over their network, and that's it. But CCA even goes past that and let them run stuff.

Remote management and control of known, owned computer in a business is a great thing, and CCA seems somewhat useful for that, although I will point out that Windows has a lot of that built in if you set it up right. Remote management and control of student computers, however, is an idea so full of crap I have no idea how it even got to this point.

1) For a while, a local school considered with not enabling network connections until the RA actually looked at your computer and verified you were running some sort of antivirus program, or not running Windows. I don't mind that idea, and it's a good deal less invasive than a software program, because the students are the ones demonstrating it and they know no one is poking around in their computer. The school eventually decided not to do it, though, I don't know why.

Re:University doing a favor

[AmigaBen]

Maybe I'm so bad at trolling BECAUSE I'M NOT TROLLING.

Your quote that I was referring to was this:

"hacking a production network."

*I* never said that. *I* never used the word 'hacking', period. You lie, again.

Re:University doing a favor

[tomhudson]

Sure you are ... you out and out stated that what he was doing was wrong in a "production network" and I told you to get real.

You said that the network is for whatever IT says its for, which is pretty damn pompous, and I said that is total bullshit, the whole "raison d'etre" of the network is the students, since they are the ones who are paying for it, and without them, the university would close their doors.

I also pointed out that what he did wan't harmful, and in fact was beneficial on several levels:

1. it helped avoid the antivirus monoculture that the badly configed CCA software was trying to enforce
2. it showed that there were many (at least 6) different ways to get around the system
3. it showed that he was reasonably responsible, since he did in fact give the code to one of his professors
4. it exposed the VP of IT (who is much despised by faculty and students) as being a total ass (again) who buys into the whole "security through obscurity" thing, and as such, should be terminated for cause (incompetency)
5. it brought out the "contol freaks" on slashdot who think that IT exists for the benefit of those running the network, and not those who pay for it

So tell me, why is helping IT promote an AV monoculture somehow "the right thing," when its bad in every other field. Or would you agree that, under the circumstances (an engineering department with half the computers not working, etc.), the VP of IT should be fired?

If this guy ever wants to move to Canada and he has a half-decent knowledge of c/c++, I know of at least one place where he'll get a chance to interview. He sounds like someone with initiative and curiosity.

Seriously, come off it ... this guy did absolutely no harm, and probably a fair amount of good. The reaction of the "powers that be" was way overboard, and they need to stop doing so much crack, because its making them obscenely paranoid (and that's giving them the benefit of the doubt - if they act like this and they're NOT on crack, they're REALLY f*cked up and need to get some perspective - or they're so cowed by the people THEY report to that they will do the wrong thing, knowing its wrong, rather than piss off their bosses).

Re:University doing a favor

[alienw]

You don't get the point, do you? Just a hint: it's not the victim who's the guilty party.

Re:University doing a favor

[alisson]

I almost get the feeling you are the student in question here, given your irrational hostility. Here's the problem in simple terms:

He did something against the rules, he got caught, it's his own fault.

Don't do security research in the US

[Anonymous Coward]

Anyone in the software biz should know: don't do security research (look for vulnerabilities) in commercial software or commercial websites if you want to be in the US. If you find a vulnerability, like a website that lets you launch missiles by putting &loggedIn=true in the URL, the best thing to do is to laugh to yourself about it, and forget it. Failing that, use some secure anonymous service and post the vulnerability somewhere. Doing the responsible thing, like informing the vendor, is absolutely thankless and likely to result in nothing but problems. Be smart, don't be a hero. Don't try to improve the security of others.

Re:Don't do security research in the US

[iamacat]

commercial != educational. I am sure we agree that we don't want security research to be done on city's traffic light system or nuclear missile control.

Re:Don't do security research in the US

[strider44]

So you instead just pretend or blindly hope that they're secure and simply wait for the first person to come along who actually *wants* to cause traffic chaos or launch nuclear missiles?

Using the Ravenous Bugblatter Beast of Traal method. All we need to do is arrest anyone who points out your obvious idiocy then the obvious idiocy will obviously disappear.

PS IAASR, though a relative beginner at the job.

Re:Don't do security research in the US

[iamacat]

Nice sentiment, but in practice it's hard to tell if the intruder is going to cause harm or just point out the flaws until it's too late. I think in the case of university computer (especially your own one in the dorm) and in case of nuke control, preemptive responses should be quite different.

Re:Don't do security research in the US

[Anonymous Coward]

I did the responsible thing. I was walking down the street checking the front doors of my neighbors. Of course I wasn't in my neighborhood being as how that area was boring to me. I found an open door and felt it was necessary to check the house to see if they had left anything else unlocked or exposed where someone who was malicious could find it. Unfortunately the police showed up and as I tried to explain that I was just helping by relocating the valuables to a safe location until I could inform the owners of their security diffect. They refused to believe me so I came here to tell my story so I could get the support I need. Thanks guys.

Re:Don't do security research in the US

[kcbrown]

Doing the responsible thing, like informing the vendor, is absolutely thankless and likely to result in nothing but problems. Be smart, don't be a hero. Don't try to improve the security of others.

Exactly.

Open source software is an entirely different thing, though, and vulnerabilities in that should be reported to the author immediately, preferably with a patch.

If enough people contribute security fixes to open source while not contributing anything at all (including information) to proprietary vendors, in the end open source software will be by far the most secure and reliable software available, and that'll make it much more appealing to anyone who cares about their data.

In short, we win, they lose, and they'll get exactly what they deserve as a result of them shooting the messenger too many times. They'll be fully exposed to the black hats without getting any help from the white hats.

And I say it can't happen soon enough.

Re:Don't do security research in the US

[strider44]

So then they should do an amazing thing and actually *pay* a security researcher to test the security under controlled conditions in a non-production system! Did you really think I was suggesting that they should do nothing when someone's trying to break into a nuclear power reactor? That is black hat attacking, not security research. It's illegal and unethical. I was simply suggesting that it's naive and idiotic to think that doing security research on systems where security is so vital is stupid.

The real problem comes when commercial vendors, when someone points out a flaw the vendor tries to sue the researcher to shut them up, using stupid things like the DMCA when the security researcher did nothing wrong nor dangerous, and was just trying to make the programs more secure.

Re:Don't do security research in the US

[fucksl4shd0t]

You're right up to a point. The point where you start being wrong is where the rubber meets the road. No matter how much money you spend, or how good/bad equipment you buy, you will never build a lab that simulates the real world. Security testing must be done on production networks because that's the network you need to know is secure. Your lab might be the securest place in the world, and it might be running a perfect replica of your production network, but you don't know your production network is secure until you test your production network.

I'm not supporting the guy or chastising him, I frankly don't give a rat's ass about him and his situation.

Re:Don't do security research in the US

[Prune]

like a website that lets you launch missiles

Please, what's the URL? I won't tell anyone else, I promise!

Re:Don't do security research in the US

[strider44]

That's true, nothing's perfect. I don't believe that all, every single one, of the web sites and applications that I test for security will have perfect security later, but that doesn't mean that it won't have *better* security.

Ookaaay then

[FlyByPC]

Guess I *won't* be doing that automated WiFi stumbler as a senior project...

Getting past two imflammatory headlines

[Lockejaw]

TFA isn't really clear on what sort of "break-in" this was. It looks like it was, at most, a proof of concept break-in, and may have been as little as figuring out how to break the system without actually doing it.
In any case, he didn't go around giving out exploit code, and he even worked on the problem of patching the hole (as well as solving other problems with the CCA software), with the intent of full diclosure of the patch and upgrades. This isn't really a punishment for breaking things, it's a DMCA-style punishment for figuring out how someone might break things.

Re:Getting past two imflammatory headlines

[oninojudo]

It looks to me like he was annoyed with how long the CCA software took to load on his machine, looked for vulnerabilities in the program, and wrote something to spoof the "this machine is OK" message and skip the loading times. Then handed it out to students and professors. So he probably did subvert the security policy, at least, not to mention aiding others in doing so.

Re:Getting past two imflammatory headlines

[yali]

In any case, he didn't go around giving out exploit code...

From TFA:

"I was planning on going to Cisco with the vulnerability this summer," Maass says. Maass' program was in use for approximately seven months before the University froze his UP account. Additionally, he gave the program to several friends and one professor.

Also from TFA:

Moreover, [fellow student] Vandermeulen said, many people are frustrated with CCA. CCA has sometimes taken up to 20 minutes to load on Vandermeulen's computer, he said. "I hear so many complaints (that) I'm not surprised that someone would go ahead and try to write something that would completely bypass it," he added.

I don't think this guy deserved the punishment he got. But the whole, "I was just trying to help them" argument sounds fishy. Seems more likely that the uni put cumbersome security requirements on students, this guy tried to circumvent them, and the IT folks caught him and overreacted.

Re:Getting past two imflammatory headlines

[mantm]

"In any case, he didn't go around giving out exploit code"... Really. From TFA: "Additionally, he gave the program to several friends and one professor. As a result, they suffered judicial consequences including having their account frozen, residence hall probation, writing a 3-4 page reflection paper and having their computers inspected by IS to get network access back, according to Maass." That separates him in my mind from just doing "a proof of concept break-in"...

Re:Getting past two imflammatory headlines

[Zekasu]

The major defining point of proof is "... he gave the program to several friends and one professor."

If you had malicious intentions, not even a monkey would be stupid enough to give it out to anyone, especially a professor.

Again, this sounds like a case of IT staff embarrassment. More than likely there was either a reason he foregoed telling the IT staff, and waited to inform Cisco, or he had some strange hopes for Cisco to give him some kind of kickback. (Which, if either was the case, he does somewhat deserve to get something, although not necessarily a one year suspension.)

Re:Getting past two imflammatory headlines

[RealGrouchy]

the whole, "I was just trying to help them" argument sounds fishy.

That's because what he said was: "I was planning on going to Cisco with the vulnerability this summer,"

When what he probably meant was: "I was planning on going to Cisco with the vulnerability this summer, if I got caught."

It's a fairly common first defense, but it needs to be corroborated. The evidence you (PP) cited seems to not corroborate his claim of benign intentions.

- RG>

Re:Getting past two imflammatory headlines

[stephanruby]

It's a fairly common first defense, but it needs to be corroborated. The evidence you (PP) cited seems to not corroborate his claim of benign intentions.

You're also making a fairly common assumption, that he needs to corroborate his benign intent somehow. How would one go about doing that? The network wasn't actually hurt by this, it would seem. It's not proof that his intent was benign I agree, but at least -- it corroborates that his story might actually be true in this case.

I can only equate this to catching someone trespassing on your land, and finding no damage and no missing property. Either you believe that the trespasser was malicious in his intent, or you don't and believe that his intent was benign. It's a judgment call for the most part.

Re:Getting past two imflammatory headlines

[RealGrouchy]

In this case, the person has been camping out on my land for months, and inviting his friends over.

It doesn't sound like he was going to tell the landlord about the hole in the fence.

- RG>

Re:Getting past two imflammatory headlines

[stephanruby]

In this case, the person has been camping out on my land for months, and inviting his friends over. It doesn't sound like he was going to tell the landlord about the hole in the fence.

I shouldn't have used that analogy, I should have known people who didn't read the article would get creative with it. The guy wrote a program that would allow one's computer to lie to the network about being up-to-date. That's it. And yes, he violated his Universities IT Terms and Services, and yes he distributed his program to other people, and yes -- the University can do pretty much do what they want with him. But let's not get carried away, he was a tenant of this "landlord" in question. It's not like he (or his friends who were also legitimate users of this network) used additional resources because of this.

Not impressed

[Adam Zweimiller]

When I started at as a freshman at the University of South Carolina 2 years ago, they were already using CCA. It's main intrusion was the fact that the University demanded that we use McAffee regardless of any other (superior) software we may have already purchased. Personally, I used Symantec Antivirus (Corporate) that I got through my internship. Regardless, it forced McAffee down my throat. I couldn't use the two side by side, as XP would freeze on startup with both installed. I noticed that the policy for CCA usage only applied to Windows computers, and that Linux and Mac users were exempt. So I booted my SuSe installation and launched Firefox to discover a web-gate type login, a form that I had to put my CCA user and pass into. Once entered, it said I was logged in for 7 days. I thought, well there's really only one way they're seperating out Windows, Mac's and Linux boxes: the user-agent. All it took to bypass was a custom Firefox deployment package pre-configured with User Agent Switcher. You didn't even need CCA installed. Every 7 days you got the web-gate login. All you had to do was switch to the pre-configured Linux user-agent and login, upon which you could change back to the default and continue on your merry way for 7 days. In about a week everyone in my dorm was using it, and it still works today. They just ban the user-agent when they catch on, and we come up with new ones. I'm not sure this guy's University may differ, but it really shouldn't take any kind of sexy software hackery to bypass it. PS. wtf is up with slashdot's server? It took me like 15 minutes to get this posted

Re:Not impressed

[bahwi]

Well, there's not really just one way to split up the OS'es, see nmap TCP/IP OS fingerprinting, but it's kind of disheartening that Cisco is using the UA for that, as it's the least secure thing you could possibly do. Kind of a name badge, "Hi My name is: CEO of Your Company" and security letting him pass without a card swipe or ID check because he says it so it must be true. Nmap OS Fingerprinting is really very cool if you haven't checked it out before. OpenBSD hides itself pretty well and FreeBSD does ok with certain switches turned on. But of course the detection just gets better each time too.

Re:Not impressed

[logan@bitsmart.com]

Heh... I reported this via Bugtraq on August 19, 2005, and CISCO responded to it 3 days later...

http://www.securityfocus.com/archive/1/408603/30/0 /threaded

As in, they've known about this for at least 20 months...

Re:Not impressed

[pete6677]

Cisco "security" software is complete and total crap. There are hacks on the internet for just about all of it. They secure a computer about as well as Norton Internet Security. Its only purpose is to make people feel safe and to satisfy auditors, most of which are MBAs who don't even know what a packet is.

Re:Not impressed

[Atlantis-Rising]

There was something vaguely similar that happened when I was in University.

I found that, rather than booting into SuSe, I was better off just grabbing firefox and telling the User Agent Switcher to represent me as a Mac or Linux, or anything else, really. I never had a problem after, never needed to download the software, and I passed on this tip to dozens of individuals. Six weeks after the beginning of the semester, Network Operations came to me (I had intervewed for a part-time position there) and asked me quietly to stop passing around the tip. They said that while it was fine if someone came up with it on their own (because it indicated a sufficient grasp of understanding network security, I imagine), they did not want it passed around to those who didn't understand security principles.

I stopped passing it around, and that was that.

Re:Not impressed

[hxnwix]

Adam Zweimiller, violator of policy, you are a bad man!

University policy exists for a reason and must be followed!

Think about how many viruses would be caught if everyone were like you! None! What would we do then?! Why, we would be unable to justify our salaries!

Adam Zweimiller, we are obligated to bring the hammer down upon you!

Re:Not impressed

[KnowledgeKeeper]

Speaking of OpenBSD, its firewall (pf) has an option to filter packets by originating operating system (very useful if you're adventurous and willing to add something like ' block in quick on $ext_if from any os "Windows" ' :) ).

Find out more about it here.

Heh

[Ant P.]

I bet he's reconsidering helping them now.

Do schools have a policy about this?

[DaveWick79]

I was wondering whether or not schools had written policies about this type of thing, and whether this punishment was according to the book or just made up out of thin air.

It seems that most of the time when school officials are faced with an issue like this, they have no idea what they ought to do and either let it slide completely, or overreact and deal a much harder punishment than necessary. This case seems like the latter, as there doesn't appear to be any malicious intent.

Re:Do schools have a policy about this?

[acidrain69]

I don't get it. Is this a client that runs on your personal machine? Or something installed on University machines?

If the former, then yeah, the kid had it coming. You don't bypass security on computers that aren't yours. Punishment was too harsh, but it sounds like he did break policy, and the university is in the right to do something. If he didn't have permission to bypass security on their network for research, then he has no excuse.

Now if it was the latter, and he did this on his OWN machine on the university network, then unless they state somewhere specifically that you "MUST BE RUNNING CCA TO ACCESS OUR CRAPPY NETWORK!!" then the university doesn't really have a case.

IANAL, but I am in IT. We are slightly lax about what we allow our employees to do with their machines, since we have less than 200 employees. But if they bypassed security? Break of usage policy, case closed.

The article is vague, how exactly did he "patch some holes" by bypassing CCA?

Re:Do schools have a policy about this?

[acidrain69]

err, switch "former" and "latter", I got them backwards.

Cisco Clean Access Agent...

[TheGreatHegemon]

The article goes over it pretty well, but Cisco Clean Access Agent, in my experience at my college is more of a headache than it's worth. If someone has the slightest problem with Anti-virus updates, they get locked out every week, (I actually have to download the smart installer for them, and then patch it manually). Plus, a lot of good antiviruses aren't recognized by CCA agent as being acceptable. I currently run Windows 2003 server as a desktop, and CCA agent doesn't play nice with me either - I have to trick CCA agent by using a virtual machine for logins. Frankly, if there was a link to this program, I'd be using it right now...

Re:Cisco Clean Access Agent...

[pathological liar]

That's not a problem with Cisco Clean Access, it's a problem with whoever setup the policies it's using, and their decision that if you don't have antivirus X, you get locked out. Complain to your admin staff, but don't hold your breath.

At this university the rules only enforce that you've got McAfee and the EPO agent installed, that your patterns are up-to-date, and that you're at a reasonably recent patch level for Windows. They're only set to restrict systems we can reasonably expect to enforce policies on. Macs and Linux machines obviously are exempt, as was Vista for a while. (it wasn't supported properly by McAfee)

Re:Cisco Clean Access Agent...

[NNland]

http://kevin.sourceforge.net/

Glad he didn't use his powers for evil...

[WarlockD]

Though, its starting to sound like anyone who tries to use their hacking powers to show vulnerability's, they are suddenly the bad guy.

Well duh.

[orclevegam]

I'd like to say I'm surprised at a school acting like this, but honestly it's about the expected behavior. Companies, schools, and institutions in general typically take the approach that if they deny it exists it will go away.

On a completely unrelated note, did anyone else notice that the read more page seemed to be down? I was getting 503 errors clicking on it.

Am I Nitpicking

[Soporific]

Maybe it's just me but isn't the statement that he was going to inform Cisco sometime this summer pretty vague? What was holding him back?

~S

similar

[reddcell]

I pointed out 2 widely known vulns in my universities network and I'm still serving my suspension...2 semesters left!

High quality reporting from school newspaper!

[loimprevisto]

Article links to what looks like a student newspaper, "The Beacon". It's nice to see articles of this quality in a student publication; the first link does a good job explaining the situation and reporting it without bias, while the second is a well written editorial style piece that criticizes the university response.

The only problem I can see with their site is that the poll "How did you spend most of your Easter Break?" is missing a Cowboy Neil option...

Read the second link

[JohnnyComeLately]

The first article didn't really clarify and actually confused the issue(s). They did indeed do more than just set him back a year. If he's on a full ROTC scholarship, they likely just yanked his funding by suspending him.

If you look at it out of context, their decision makes some sense, however, as soon as you apply ANY logic to it, their reaction is way too far. What is the result? I would never do research there or even TOUCH anything security related. Imagine if you got suspended because you left your lab's back door open, while there was still a guard on duty. Someone COULD break in, but there's a guard. This is similar to what he did...the security was never compromised, it may not have been the MAX (which is also a farce, because the university itself wasn't up to the most current version). Using their own logic, they should suspend their director of IT for one year for knowingly having a system not most up to date (which is what the kid did).

This summer?

[ArcherB]

Rather, the sophomore says he was examining vulnerabilities so that they could be fixed. "I was planning on going to Cisco with the vulnerability this summer," Maass says.

While I'm all for white-hat hacking, it's unfortunate that every time someone is busted, they suddenly put the white hat on. In this case, I have to ask:
Why didn't he go to Cisco with the vulnerability YESTERDAY?

Re:This summer?

[mark-t]

Well, if he gave it to Cisco, he'd lose control over what happens to it, and Cisco may well release a patch but that wouldn't mean that his school would obtain it right away. He probably wanted to talk it over with the school first to make sure his own school's interests were covered before letting it get out.

And for this loyalty, he gets suspended.

Typical.... absolutely typical.

Re:This summer?

[mark-t]

....or.... I could *READ* the TFA and discover he had been using it for seven months and given copies to his friends.

I take back what I said before.

The idea that he was about to tell Cisco about it is a pretty weak cover story, given his behaviour.

Re:This summer?

[dgatwood]

OTOH, if he were smart enough to break this thing and he were malicious, he would have instead sold it to some Russian hacking group to put into new viruses. He didn't. He didn't crack anybody else's machines with it. He didn't run it on university equipment. He didn't do any of the thousands of truly malicious things he could have done. Based on that, I see no reason to believe that the guy didn't intend to tell Cisco about it... but probably not until after he graduated so that he wouldn't have to deal with a bug-fixed version of the software that disabled his workaround....

Instead of using the software maliciously (which would have been relatively easy by comparison), the guy just ran it on his own personal machines and gave it to other people to willingly run on their own personal machines so that they could use the network without the interference of an overbearing piece of security software. All the guy did was write software that made it look like he was running the stupid tool that the uni required him to run in order to use the network without actually having to run it. That's hardly malicious behavior, and if the guy was running reasonable antivirus protection software and was keeping up-to-date with security patches without the "assistance" of the tool in question, it really didn't create any significant security risk, either.

No, this is a typical knee-jerk reaction by bureaucrats. I would expect nothing better from most universities, but it's still a shame every time someone's life is needlessly wrecked because of a bunch of pencil pushers.

Re:This summer?

[Oligonicella]

Somewhat of a non sequitor on your part, ain't it? I mean, the software is the type to do cracking of other machines. It's the type to fake out security assessments. When you sign a contract, then purposefully break it, that's not malicious?

Re:This summer?

[zymurgyboy]

I think our analysis is dead on, but I'm not sure his life has been wrecked. Disrupted? Unquestionably. Was it his fault? Damn straight. Is he getting way too much time in the penalty box? Yep. Is his life ruined? Hmm, that depends on what he learns from this and how he deals with it.

He obviously has no ninja skills -- giving it away to friends and professors and posting a facebook page was retarded. If he creates a similar situation for himself down the road, he'll modify his approach if he has any sense and took anything away from this experience.

Sucks he might lose his scholarship. Too bad he put all his eggs in the ROTC basket. But there are other ways to finance an education at least.

If it comes up in a job interview, he comes clean about it and has behaved himself since then, the only people he'll have to worry about are idiot bureaucrats who hire other idiot bureaucrats. He's maybe closed a few doors for himself, but they are probably doors that are better to have closed in the first place.

A lot of people do stupid things in their teens and twenties. If it doesn't become a pattern, and he's honest about it (assuming it even comes up -- TFA said no laws were broken) it may not matter a whole lot in few years.

Stop instituationalizing young people

[iamacat]

It's unavoidable that a bright C.Sci student will bypass some university security measures, for some of the following reasons

• Bypass cloying "for your own protection" software that he and his computer-literate friends do not need anyway. Besides, what security updates if you have Mac/Linux?
  
• Impress a girl by resetting her lost password or re-enabling account in her undergrad school
  
• Explore a realistic network structure and challenges of its administration
  
• Repair the system when it's down, admin can not be bothered and final project is due tomorrow at 8:30
  

Steve Jobs openly admits to phone phreaking and calling the Pope. Both he and Bill Gates eventually dropped out of school. It's clear that, to become a person of substance, you have to be willing to challenge authority once in a while. Are we trying to raise a generation of corporate drones who are so obedient they can never pose a competitive threat to existing oligarchy. Are we so insane we let disturbed students stay in school and own guns, but suspend ones who are merely using university's property, paid for by their tuition, more efficiently than average?

Re:Stop instituationalizing young people

[curious.corn]

well said

Re:Stop instituationalizing young people

[Ant P.]

In my high school I had to break the brain-damaged "security" just to get my work handed in on time; the only way I could get files onto the system was via http and anything not txt/pdf/doc/etc. was blocked - the system deliberately killed the browser process to prevent me downloading a zip file. With my work in it.
I ended up opening it as a text file in dreamweaver and fishing the file out of the cache folder.

I'll spare the complaints about the rest of that whole experience as they're offtopic, but I will say those working conditions would be completely fucking illegal in the real world.

Re:Stop instituationalizing young people

[Myopic]

Are we trying to raise a generation of corporate drones who are so obedient they can never pose a competitive threat to existing oligarchy.

Depends on what you mean by "we". If you mean the powers that be, the average person, the democratic mean, then... yes, "we" are. If you mean you, or me, specifically, then no "we" aren't.

PS I wonder: you ended your sentence with a period instead of a question mark; was it a rhetorical question.

Re:Stop instituationalizing young people

[gknoy]

Are we trying to raise a generation of corporate drones who are so obedient they can never pose a competitive threat to existing oligarchy?

Yes.

Re:Stop instituationalizing young people

[hamelis]

Are we trying to raise another* generation of corporate drones who are so obedient they can never pose a competitive threat to existing oligarchy.

It certainly appears that way. We started quite a while ago, say around a hundred years ago. The '60s were just a minor bump in the road, flattened quite effectively by a few well-placed bullets.

*note minor revision.

Re:Stop instituationalizing young people

[Achromatic1978]

Bypass cloying "for your own protection" software that he and his computer-literate friends do not need anyway. Besides, what security updates if you have Mac/Linux?

If he was running Mac/Linux, he wouldn't have been running CCA anyway, now, would he?

Re:Stop instituationalizing young people

[the_womble]

Besides, what security updates if you have Mac/Linux?

According to other comments, the system used does not check for updates if you have a web browser with a Mac or Linux user agent.

Re:Stop instituationalizing young people

[Prune]

LOL, I hope you have better ways to impress girls...

Re:Stop instituationalizing young people

[iamacat]

You mean like my daughter? Right now I might try running some blinkenlights type program with cute sounds. Oh, you mean in college? Well, in this case, I see nothing wrong with showing off whatever you are good at. If you are a baseball pitcher, go a head and show off your muscles. If you can make room lights in the dorm form a heart sign, I don't see why it wouldn't work either.

I hope he has his assertion well documented

[John Harrison]

He should have talked to the campus IT guys about this "research" before conducting it on live campus systems. I worked in campus IT at Stanford and my experience is that they might be open to seeing what you're working on and allowing it.

The article summary posted here on /. conveniently left off the next paragraph:
Maass' program was in use for approximately seven months before the University froze his UP account.

So he ran this thing for most of the school year and gave it away to his friends and put up a facebook page about it without telling Cisco? At some point it starts to look like the, "I was about to tell Cisco!" claim is just an excuse to get out of trouble. Once he had a working demonstration he should have approached Cisco, not distributed it while he put off talking to the vendor for half a year.

Still, it seems like the uni is going overboard on the punishment.

Re:I hope he has his assertion well documented

[TheLazySci-FiAuthor]

Still, it seems like the uni is going overboard on the punishment.

I agree with your post, save this line. I'm starting to sound like an old man, but examples must be made.

As you allude to, he may indeed not truly have intended to go to Cisco with this vulnerability - how much further would he go if not caught? He knew of 6 other methods apparently.

At any rate, I'm starting to sound reactionary so I'll cut it there.

Nonetheless, it seems that a computer science major would have the resources available to try out his vulnerability theories on a test environment.

When the lock is broken on the girls showers, you should probably not wait until summer to tell someone: though who could really blame you for delay?!

Re:I hope he has his assertion well documented

[pembo13]

like campus IT guys know anything

Re:I hope he has his assertion well documented

[dgatwood]

Normally, what one do on his/her own personal machine is that person's business and nobody else's, including the network administrators, unless and until he/she causes harm to the normal operation of the network or other systems on the network.

Okay, maybe putting it on a facebook page was stupid....

When will people learn..

[BalanceOfJudgement]

Nobody wants things to work right or work well, if it means upsetting the status quo.

They'd rather things disappear and get bitten in the ass for it in the future, than deal with it now, if it means someone's going to get embarrassed. There's no intellectual honesty anymore..

Schools...

[pavera]

And I thought school was where you went when you wanted to learn about things, test things, build new things, and in general broaden your horizons and expand what you are capable of doing.

Wait, that is the lie people have been telling us forever.

School (high school and univ) in my opinion is a very poor excuse for "preparation" for the real world. In all of the jobs that I've had, identifying, working through, and solving problems is what its all about. Of course in school, the students are rarely if ever tasked with the first step of identifying a problem (the professors assign the homework), working through problems is an exercise of taking notes (not thinking about the problem just verbatim listing what the professor says), and solving problems normally is left to the TAs to babysit 90% of the students through anything that requires even the slightest bit of rational thought.

This guy is guilty of breaking that mold, he identified, worked through, and solved problems all on his own with no intervention from the school. Thus proving that the school is indeed useless. Because he proved that the school was a redundant and useless institution they had to punish him.

Re:Schools...

[BalanceOfJudgement]

If you stop thinking of school (all school, from kindergarten through college) as "where you went when you wanted to learn about things, test things, build new things, and in general broaden your horizons and expand what you are capable of doing" and instead start thinking about it as a way to keep people busy and out of the work force for awhile, then the whole thing starts to make alot more sense.

Imagine what the job market and the economy would look like if everyone in our overpopulated civilization who could work, had one.

Re:Schools...

[Rakishi]

As I have said often in the past: Just because you went to shitty college, took shitty classes and didn't take advantage of the available opportunities doesn't mean everyone is a dumbass like you.

College (and life) is what you make of it, don't complain about being spoon fed everything when you never showed any ability to eat on your own.

Re:Schools...

[ephedream]

Right, tell that to the kid in the ghetto who goes to the crappy public school with boring classes where they memorize things instead of learning so that the school can scrape by and get those required standardized test scores with their overworked teachers and crappy under funded schools. This replaces "learning" and naturally kids (especially intelligent ones) will be bored to tears by this unnecessary, forced, rigid hoop jumping. The goody goody positive attitude, closed-minded, cheerful, conformist rule followers will do ok though, cuz they have that sunny, authority loving attitude. Just keep on churning that work out until it's done...

Re:Schools...

[Rakishi]

I was talking about colleges and universities, lower schools a somewhat different matter. Second of all the problem 95% of the time isn't schools (almost all, even "magnet", middle and high schools are rigid) or the nature of the student but parenting (or rather lack thereof). Now I'm not blaming the parents per say but simply saying that there are tons of options to get out of the hell hole of a system if you are determined enough.

Likewise children should be taught to do the damn work, contrary to what you may believe in real life you all too often need to do bitch work and you can't cry or throw a tantrum or get bored. I remember fondly how in 6th grade after realizing that every math assignment was from the book I simply took a few days and did all the assignments till the end of the year. Doing them all at once on my own was mildly interesting and gave me 2+ months of no math homework. A few friends even got into it and we had a sort of implied competition on who could finish the problems the fastest.

Re:Schools...

[pavera]

Look, I dropped out of college and have never looked back, I am very good at math, CS, physics, chemistry, basically all math/science/engineering fields I was good at in school. My favorite was CS, and I dropped out when the opportunity cost of staying in college was too much (offered a job making 65k at 19, benefits, high paced environment, or stay in school and keep paying 20k/yr to learn slowly and be bored). I don't regret it now, I have 8 years of experience, and I can very easily move between jobs. I haven't been tied into a crappy job or been unemployed for more than 2 weeks since then. I have friends who finished college who still make 50% of what I make (experience is more valuable than school). I'm not 75k in school loan debt like my peers. I do meaningful work, and I am very good at what I do.

I complain about being spoonfed because I don't need that. I taught myself calculus from my dad's college texts when I was 12. Every time I tried to "take advantage" of opportunities in school I was discouraged from doing my best, from applying myself, from trying to advance faster than "average" students. I am 100% confident that given the chance I could have graduated from college at the age of 18 or 19. Unfortunately every teacher, counselor, professor, department head that I ever spoke to about moving faster, or getting in a more advanced course would discourage and slow me down (even though I always maintained 3.8-4.0GPAs).

School is a joke and a waste of time. Not to be too cliche but Will Hunting said it best in the quote about doing some thinking and realizing you spent 250k on an education you could have got for $1.50 in late charges at the library.

Re:Schools...

[pavera]

real life certainly has its boring parts, but it isn't 100% boring like school is for a decently smart person.

Yes, in any job there is paperwork and boring repetitive things that aren't fun. But, in school for me I would be assigned 50 math problems, I could do 2 or 3 and I would know the concepts and understand how to apply them to various different problems. I could based on those 2 or 3 problems get 95%+ on tests. Unfortunately, if you can't stand to be completely bored for 2 hours and crank out those other 47 or 48 problems, you won't get good grades in school.

In my experience in the real world (at least in CS and IT) my job is probably about 30-40% really interesting, 10-20% somewhat interesting, and the rest, maybe 50% boring. That is an acceptable balance, I can handle being bored that much and get through it. In school as you can see from my above example, it was about 5-6% interesting and 95% boring. And from what I could see and do there was no way to increase this interesting/boring ratio in school.

Re:Schools...

[Rakishi]

I'm not 75k in school loan debt like my peers.

If you're smart you'd have gone to a good school, good schools generally leave you with little if any loans to pay off. Add in some scholarships or fellowships, after all if you are smart you would have done lots of outside of school research in HS.

offered a job making 65k at 19, benefits, high paced environment, or stay in school and keep paying 20k/yr to learn slowly and be bored

*shrug* If I had wanted to I'd probably be making 110k at 20 with a masters degree but I took it slowly in school and preferred to enjoy life (you can only take so many advanced classes while maintaining sanity). For various reasons college degrees lead to higher salaries so over your lifetime the cost of not having one (except for a small group of people) is much more than the cost of getting one.

I have friends who finished college who still make 50% of what I make (experience is more valuable than school)

Everyone is different, thinking that how your friends do is due to college or your experience simply shows your own (and your friend's) stupidity.

I complain about being spoonfed because I don't need that. I taught myself calculus from my dad's college texts when I was 12. Every time I tried to "take advantage" of opportunities in school I was discouraged from doing my best, from applying myself, from trying to advance faster than "average" students. I am 100% confident that given the chance I could have graduated from college at the age of 18 or 19. Unfortunately every teacher, counselor, professor, department head that I ever spoke to about moving faster, or getting in a more advanced course would discourage and slow me down (even though I always maintained 3.8-4.0GPAs).

So you had shitty luck and no one fought for you, which doesn't mean much really. You don't ask for permission from schools administrators, you do and then tell them to "fuck off" afterwards. Knew calc at 12? You should have taken the AP exam, passed it and then told your school to either provide math at your level or exempt you from math. Add in implied (legal) threats of various sorts and letters to every single person above your school principal and finally you'd get a letter from high enough above agreeing with you that your school has no choice but to concede. Want to take more advanced math? Talk to local colleges and universities until someone lets you sit in on classes (or has a program that lets you). Bored during the summer? Send apps to every single college level research program you can find till one agrees to accept you. Bored in school? Talk to local universities and professors and try to do research with/for them. 1 in 200 may agree but you only need 1, for some reason Indian professors were nicer in this regard.

Granted most of this requires your parents to help you or do it for you but that's life.

Also to paraphrase my dad, the sign of an intelligent person is not how hard they work but how little they work. Work smart not hard in other words.

School is a joke and a waste of time.

First of all if you cannot understand that everyone is different and that school exists for a reason (for the vast majority of people at least) then maybe you should have gone to college just to learn that if nothing else. To add to that, college is in many ways about learning about life not the material. This included making connections and the like which will help you throughout your life.

Not to be too cliche but Will Hunting said it best in the quote about doing some thinking and realizing you spent 250k on an education you could have got for $1.50 in late charges at the library.

Not really, since you've never taken any decent college level courses in your life nor have you ever take advantage of any of the other things offered in school (research being a high one on the list) your opinion is essentially worthless (as its based on nothing). There is

Re:Schools...

[pavera]

Also to paraphrase my dad, the sign of an intelligent person is not how hard they work but how little they work. Work smart not hard in other words. Um, this sentence comes right after a long diatribe about sending in hundreds (if not thousands) of applications just to try to get 1 person to say "Ok, I'll take a risk on you". It was much easier to send out 3-4 resumes and get a job. In fact, I didn't even have to send out a resume, I was doing some contract work on the side while in school and I caught the eye of a company and they came straight to me and offered me a job. While my professors at university while acknowledging that I had extraordinary talent and was smart, continually said "no you can't advance faster than X". The company said "Oh you want to learn all this stuff? Ok, here we'll give you a $5000/quarter training budget go to it!"

Besides the fact that every application I ever filled out had an application fee (usually 200-300 bucks) and suddenly filling out 100 applications becomes completely impossible, much less thousands.

The schools I went to were not crappy, my high school was listed in the top 100 high schools in the country while I was there, the university I attended while not Ivy league is the top school in the state, and certainly in the top 5 in the region (Nevada, Utah, Colorado, Idaho, Arizona).

School is just 100% about becoming a drone and following the herd. People who get out of line are punished. Unless you have lots of connections, or the time, money, and energy to pester the institution for months on end you aren't going to get anywhere. The system is designed to create copies, not to create individuals.

Re:Schools...

[Rakishi]

Um, this sentence comes right after a long diatribe about sending in hundreds (if not thousands) of applications just to try to get 1 person to say "Ok, I'll take a risk on you". Applications? Uhmm, all I sent out for research was emails and most of those were similar to each other. Research programs were apps but those were free and I only sent out a couple. Worst thing was fighting the BS middle and high school administrators but that was also free.

It's called investment, if spending 10 hours to save 100s of hours of work in the future isn't considered "working smart" by you then you're simply lazy.

It was much easier to send out 3-4 resumes and get a job. It's even easier to work minimum wage at the local pizza joint.

In fact, I didn't even have to send out a resume, I was doing some contract work on the side while in school and I caught the eye of a company and they came straight to me and offered me a job. While my professors at university while acknowledging that I had extraordinary talent and was smart, continually said "no you can't advance faster than X". *shrug* Not my fault if you can't find the right professor or properly argue your point. My HS principal said to my face that I shouldn't be graduating (due to some BS about how no one ever graduates early from that school) but he couldn't stop me (he'd already signed the paperwork and I've secretly made sure to meet all the reqs). If you accept what someone says then you've already lost, you need to fight for what you want.

Besides the fact that every application I ever filled out had an application fee (usually 200-300 bucks) and suddenly filling out 100 applications becomes completely impossible, much less thousands. Only apps I ever had to pay for were college apps and standardized tests (AP, SAT, etc.). The rest was free.

The schools I went to were not crappy, my high school was listed in the top 100 high schools in the country while I was there, the university I attended while not Ivy league is the top school in the state, and certainly in the top 5 in the region (Nevada, Utah, Colorado, Idaho, Arizona). When you picked colleges did you try to find one that was accommodating to gifted students? Did you email a dozen professors before hand to see if any were interested in doing research with you when you got there? On pre-admit weekend did you do all the BS activities or did you meet with professors?

If you expect things to be handed to you on a silver plate then that's your shortcoming not the worlds. You will get screwed over at some point and have no idea what to do.

School is just 100% about becoming a drone and following the herd. People who get out of line are punished. Unless you have lots of connections, or the time, money, and energy to pester the institution for months on end you aren't going to get anywhere. If you don't want to fight for what you believe in then you are a sheep even if you don't notice it yourself. God knows I learned more from fighting against my middle and high school administrators then I did from anything else in life.

Re:Schools...

[pavera]

Different strokes for different folks. Personally, fighting for an education that I'm paying for sounds really stupid. On the other hand, getting paid to get a more advanced education sounds like a good idea. Since this thread started I got a promotion to management, I have a great job, I don't work harder than average (40 hour weeks), I have benefits, vacation time, and a very nice compensation package if the company goes public or gets bought.

Obviously everything isn't about compensation, but I am also very happy, I have a house, a wife, a child on the way. I have been happier since I quit school, I haven't regretted it at all. I have good experience, I ran my own company for a couple years, I really don't think I missed anything by not doing research at school. I do research every day in my job, yeah maybe I'm not going to invent a solution to the traveling salesman, but that really doesn't get me excited, or interested.

If you like school and think it is good for you, more power to you. I just found the experience completely frustrating. I thought if I was paying, I am the customer, I should be treated better than I was. Maybe that is a naive approach, however, it has always served me well, if I am paying and not receiving what I am paying for, well, I take my business elsewhere.

lets just suspend ALL students and save time

[TheGratefulNet]

story after story, its "this student scared us - lets git 'em!".

why is this country SO AFRAID of students and so into controlling them? I'm not sure I could survive in a modern high school or even college environment now. I'd be too angry all the time at how badly they are mismanaging our youth.

I am quickly losing all my faith and trust in the so-called 'education system' we have in the US. its becoming not much more than babysitting and nannying.

and I fear for the kind of young adults we are going to produce from this brainwashing factory we call 'school'.

anyway, what good is there in suspending this kid? what does that accomplish? the fact that he found YOUR security flaw embarassed you? is that a reason to punish him?

perhaps the school does not DESERVER your funding. yes, YOU fund the school - they work FOR YOU. its not the other way around. YOU are the consumer. if school-A is giving you crap, why not take your business elsewhere? yes, school IS a business - very much so.

Re:lets just suspend ALL students and save time

[Anonymous Coward]

That reminds me of something that happened back in sixth grade.

I was fortunate that in the early 80's, Apple had donated some computers to my school district. I was in the "gifted" program, so we got to use the Apple computer lab at the junior high school once a week. My mother was a teacher in the local district, so she was able to borrow a computer during the summer, and at about the same time my father bought a TRS-80 from Radio Shack. The end result was that at about the age of five, I started learning to program these computers.

Fast forward to sixth grade. By now I had plenty of experience with Apple computers and was starting to learn some of the more advanced things you could do: peeking and poking memory, getting programs to boot from floppy disk, etc. Well, one of my science classes studied computers for a few weeks and we used the computer lab on a regular basis. Being the type of person I was, intelligent and all too happy to question authority and mess with adults, I wrote a program that when booted from floppy made a bunch of beeps on the computer and flashed some bogus alert/warning message.

I set the teacher up such that when he sat down on a machine and powered it up, he'd get this scary warning message. Sure enough it worked, and the teacher got freaked out. Unfortunately, when he learned that it was just something I had rigged up, he got mighty pissed and banned me from the lab for a while.

One thing you can count on is for adults to misunderstand the youth and fear that which they don't understand. Rather than having to acknowledge a youngster on a personal level and try to understand their motivations, they simply react and try to punish the kid like you would a "bad" dog.

Re:lets just suspend ALL students and save time

[oohal]

perhaps the school does not DESERVER your funding.

I'm thinking you should have spent more time listening in your english classes, rather than complaining about how the system is broken.

Re:lets just suspend ALL students and save time

[TheGratefulNet]

this is slashdot. ideas count MUCH more than spelling.

you must be knew here (grin).

Re:lets just suspend ALL students and save time

[Oligonicella]

Yes, kids who do bad things should be "understood", not treated like any adults who do bad things. When you mess with adults, it's an adult game with adult rules. Don't like the rules? Don't enter the game.

in use for seven months

[arabagast]

TFA says he was running this program for seven months, and was planning on alerting cisco "this summer", and he also spread the program to his friends. Doesn't really sound like security research to me, more like bypassing the security for your own convenience. You really don't "research" a security flaw for seven months, and even spread it to other people.

Cisco adjusts its default settings in wake of this

[alphadogg]

Here's a more detailed follow-up on this story: http://www.networkworld.com/news/2007/042607-cisco -nac-unversity-portland.html?t51hb

We avoided situations like this...

[Cylix]

Early only we ran into some policy issues at the university.

The solution...

Take the engineering department off of the campus network and maintain it ourselves.

It worked out fairly well when I was there, but resulted in some equipment deficiencies. We ended up getting the backend of the upgrade cycle, but that was fine as we were allowed to "blow them up."

This would not have worked without volunteer work and when I had returned I was already a competent admin. It probably wouldn't scale too well, but it's a good learning experience for some.

It does lead to issues though...

At one point, a professor proclaims the network seems to be having issues and at that point I poked my head up.

"Um, no it's not... I'm putting in dDNS... because it looked like fun."

Things were back up momentarily. (Hey I was young!)

The best was probably the day I rooted the servers and updated the motd.

"Under new management -- cylix"

This was of course the policy for gaining administration for maintaining systems. The final system I had to social engineer my way into... sorta... I basically made it into the server room with the prof maintaining things and he left to go get some papers. He knew I was after the final system and just wouldn't let me take it over without a fight. He had to know what I was going to do and probably just wanted to see how fast I could get my hands into the system. The moment he stepped out I tackled the keyboard like it was a drunken cheerleader.

The only catch was no denial of service. So, if you were going to bring something down... no one could notice.

Fun times!

Re:We avoided situations like this...

[dbIII]

The solution...

Take the engineering department off of the campus network and maintain it ourselves.

At a university where I worked that is exactly what happened. Unfortunately the mail servers were still on the main university network - and when the head of electrical engineering mandated setting all mail clients to pop the mail server every second there were a few hiccups at first and then the unintended consequence of sixteen thousand people without email for two days. Outlook not so good.

No, I was not a sysadmin there - I was busy in another department intentionally breaking things and teaching students how to break them (and plot the results etc). Now I stop people from breaking computers instead.

Tell people before doing this type of project

[HockeyPuck]

Let's see, if you're writing a program that will circumvent security measures, if he had gone to IT and said "I'm writing a program to test CCA..." he wouldn't have been in deep water as opposed to trying to explain why he did it "No, I wasn't trying to hack the network, I was writing a *test application* and then go to cisco"..

If he had nothing to hide in the first place, then he shouldn't have hid it in the first place.

University of Portland

[pclminion]

U of P is a Catholic school with no particular engineering focus. I think he would have stood a better chance of a reasonable response had he been attending a "real" engineering school. There's nothing wrong with Catholic school, or in studying engineering at such a school, but I think this poor guy should have seen it coming... If you're going to do research like this, do it at home. If he wanted to inform Cisco of the problems, he should have just done so directly. I feel bad for the guy but it's not surprising.

Re:University of Portland

[Wormholio]

Agreed. He should transfer to Portland State, which now has a good CS department.

Re:University of Portland

[pclminion]

I can attest -- class of 2002. And from what I hear it's even better since then!

To be honest...

[HuguesT]

If I did something like that and got caught I would say I was planning to come clean as well.

wow, excellent points

[JohnnyComeLately]

Your reply hits many points, dead on (pardon the pun when combined with the guns reference). Technically, I "broke" Sprint PCS security policy by showing them a hole in 3G data services (around 98/99). The security guys were certain they were applying the layers of security but forgot about a fundamental shift in types of traffic (tunneling within a tunnel) used in 3G. I said, "OK, if it's secure, how is it I can ping the billing server from my "public" computer".....I could technically have been in the same boat as some others (not this kid...he was clever).

Which brings up your main, and correct, point. It's sad when we penalize so harshly for students just being clever. Would they have suspended him for a year for putting a penny in the dorm elevator (in effect locking it on a single floor during early morning rush time)??? I often joke, and I'm sadly accurate: If I did half of what I did 20 years ago in highschool and later college....today...I'd be a multiple strike felon...and yet no one or any property was really ever hurt

Re:wow, excellent points

[ScrewMaster]

When I was in college thirty-odd years ago, my University only allocated 2,000 minutes per quarter per student of mainframe time. Not enough (obviously) and they refused to give me any more. So I wrote a simple fake-login program that would log the user's name and password, and cough up a realistic "system is down" message. Matter of fact, I exactly duplicated the normal logon procedure, including any nominal pauses and delays that occurred. Even fooled the system operators a couple of times. I ran the thing on forty or fifty terminals simultaneously, and I would watch in case someone called one of the admins over to ask why the system wasn't working. Whenever that happened, I'd hit a key on my terminal that would immediately log all the other systems off, so it would work normally at the next login attempt. It wasn't often: most people just shrugged, got up and left to go about their business. Occasionally some busybody would call an administrator over, so I had to keep an eye on things.

In under a week I had captured the accounts of every active student user on the system, plus all the supervisory accounts. It was pretty unbelievable (as in, "holy SHIT Jesus Mary mother of God" unbelievable) and I couldn't understand why there were no precautions taken against that sort of thing. Needless to say I had no problems with account time after that. That was on the one mainframe: there was another guy, pretty sharp coder, that figured out what I was doing. At first I thought I was screwed, but he was delighted by the idea and duplicated it on the bigger system (this was years before the word "pwned" came in to the popular lexicon but it's no less applicable.) No surprise, a few days later and he had the run of that machine. So far as I'm aware, nobody ever figured out what we'd done. The big system was the one that had everything administrative on it from student grades to paper clips and we could have wreaked havoc if we'd wanted to. As it was, though, we just wanted more computer time to do our homework.

A couple of years later my father testified in front of my State's legislature regarding a new "computer crime" bill they were shopping around. It was one of those ridiculous "zero tolerance" laws that make the lawmakers look "tough on crime" but end up shafting a lot of people that don't deserve it. Dad pointed out to these idiots that, if passed, their brain-child would immediately criminalize 90% of the best and brightest students in our engineering and computer science curricula. They backed off in a hurry and came back with a more reasonable bill, which never got passed anyway.

That was then. Nowadays, I don't think our lawmakers would bat an eye if they put half our smartest engineering students in jail. They're just engineers, after all, and ... who the fuck needs those.

Re:wow, excellent points

[jotok]

Question for you: How do you spin this statement so it doesn't appear as if, using your special knowledge, you in turn shafted all the other users of the system?

And how exactly does this apply in this case? From your story, you did not go to the administration and point out the flaws--you exploited them for personal gain. In TFA the student did not attempt to improve the security of the system and is obviously lying about it. Not very trustworthy, either of you.

Of course, that's just surface impressions.

When I was in school we had metered bandwidth. It was awful...except for the handful of students who figured out how to beat the system and hog bandwidth. So, Jimmy English Major gets dicked because...drum roll...someone is smarter than him.

I know that's how the real world is, but I don't see how power can justify itself. Just a thought.

Re:wow, excellent points

[DerekLyons]

A couple of years later my father testified in front of my State's legislature regarding a new "computer crime" bill they were shopping around. It was one of those ridiculous "zero tolerance" laws that make the lawmakers look "tough on crime" but end up shafting a lot of people that don't deserve it. Dad pointed out to these idiots that, if passed, their brain-child would immediately criminalize 90% of the best and brightest students in our engineering and computer science curricula. They backed off in a hurry and came back with a more reasonable bill, which never got passed anyway.

I find it pretty sad that they backed off actually, because being among the 'best and brightest' shouldn't be a 'get out of jail free' card.
 
 

That was then. Nowadays, I don't think our lawmakers would bat an eye if they put half our smartest engineering students in jail. They're just engineers, after all, and ... who the fuck needs those.

Engineering students are pretty bright - after a few got jailed the rest would wise up and learn that there are things that you may not do. (Which they should have learned from their parents.)

Re:wow, excellent points

[Coward Anonymous]

Things didn't change 20 years later. When I was a student, 10 years ago, I setup a similar fake login system on a Novell login/network on DOS computer farm - it would reboot the DOS machine after an attempted logon to avoid detection.
I later also implemented a TSR key logger that would persist after I logged out and transmit (over IPX) keystrokes to a console I ran on another machine in the lab, pretending I was doing homework. The console could display about a dozen loggers at once and would log and filter the data to make username/password collection easier. It also had a "boss screen" in case someone would look over my shoulder.

I was so successful that I scared myself and stopped playing with it shortly after I started. I never really did anything with the logins I obtained except testing a couple to see that they worked.

Re:wow, excellent points

[ScrewMaster]

Question for you: How do you spin this statement so it doesn't appear as if, using your special knowledge, you in turn shafted all the other users of the system?

You don't. We weren't trying to analyze the school's security, we weren't trying to be helpful and do their security people's job for them. We did it because wanted more time, and if anyone had asked us that's what we'd have told them because that's exactly what we were doing. See, back then all students were granted 2,000 minutes each quarter whether they used it or not, and all were required to login once and change their default password. So, by the end of the first quarter anyone that still had, say, 1,997 minutes left was probably not a heavy user and we only only used those accounts. Admittedly, that was less because we weren't trying to screw over anyone as we figured those people would never notice. And they didn't.

And how exactly does this apply in this case? From your story, you did not go to the administration and point out the flaws--you exploited them for personal gain. In TFA the student did not attempt to improve the security of the system and is obviously lying about it. Not very trustworthy, either of you.

I'm just trying to elucidate the changes in the legal/educational climate in the past thirty years. When I was in college, even if I had been caught the most that would have happened would have been a wrist-slap. Now, that would have been more than enough because neither me or the other guy that was involved were exactly hardened criminals. That did happen to other students that did things with the mainframe they weren't supposed to and they, too, learned to behave. I suppose the guy that did the same thing on the administration system might have gotten in more trouble ... but probably not. I don't know of any cases where a student was expelled or otherwise suffered serious academic harm. Like me, they went on to finish their studies and get real jobs and that is what school is all about. Severe punishment for minor transgressions (first offenses, at that) serves no purpose.

Things were, in many respects, a lot more relaxed in the seventies than they are now. A lot more. You could get pulled over and be a little drunk, or even a little high, and the cop would ask "how far do you have to go?" and you'd answer "just a couple of miles, officer." and they'd laugh and send you on your way. Try that now and you end up in the clink on a serious drug charge. Hell, in my State right now the cops are using high-gain microphones to listen in to conversations in passing cars: if they hear words like "pot" or "marijuana" or "joint" they pull you over and search your car.

Things are very different now, and if I were eighteen again, there's no way in hell I'd pull that stunt.

Re:wow, excellent points

[ScrewMaster]

I find it pretty sad that they backed off actually, because being among the 'best and brightest' shouldn't be a 'get out of jail free' card.

The law in question was directed at real white-collar criminals (the kind that crack bank computers and clean out accounts) and just incidentally, due to bad wording, would have ensnared a lot of other people who really weren't performing criminal activity. You can say, with apparent ease, that you're sad they backed off: but a felony conviction is a hell of a thing to lay on someone who was probably just showing off. That is why the lawmakers backed off: that wasn't what they were trying to do.

Furthermore, I'm dead set against this idea that we need to bitch-slap anyone that steps even a little off the beaten path. That's not right: people (even smart ones) make mistakes. Lives can be ruined when an errant legal system driven by irrational fears and political posturing goes overboard and crushes a young person like a bug.

Re:wow, excellent points

[ScrewMaster]

It's interesting how secure IT departments try to make things - the harder they try to make it, the easier it actually becomes to bypass it.

Yes indeedy.

Again, way back in 1981 or thereabouts, I was contracted by a local hospital to write a terminal emulator for the Apple ][. This was to allow comparatively inexpensive Apple systems to replace the expensive Burroughs terminals that the hospital used with their Burroughs mainframe.

Anyway, as part of that project I had to work with one of their in-house programmers. They had just finished a comprehensive "security audit" from Arthur-Andersen, and were (of course) found to be woefully inadequate in that area. So they followed AA's recommendations, and he showed me how they were now required to type in three separate passwords on three separate screens. Secure as it might be it was really annoying.

What the Arthur-Andersen folks had failed to realize was that these were smart terminals, with little things called "macro keys". So everyone in the department agreed to use one particular key as the universal login key, and programmed this key to spit out the user name and three passwords in rapid succession on every terminal. So all you had to do to log in anywhere in the department was press one key.

Sure, from a security perspective that was foolish: but then again, no system can be made foolproof because fools are so damned ingenious.

Re:wow, excellent points

[jotok]

I'm just trying to elucidate the changes in the legal/educational climate in the past thirty years.

Gotcha. FWIW I didn't miss this point, I just wasn't clear on some things.

It's hard for me to decide what activities like this require in terms of "punishment." On the one hand, in a certain sense, the university should be a place where this kind of activity only gets a "wrist-slap" because it is not exactly "the real world." On the other hand, if this kind of thing is wrong, then it's wrong, period. Gripping hand...I dunno. You gotta leave room in life for Merry Pranksters.

Anyway, good post, sir.

Re:wow, excellent points

[JohnnyComeLately]

That's not right: people (even smart ones) make mistakes. Lives can be ruined when an errant legal system driven by irrational fears and political posturing goes overboard and crushes a young person like a bug.

Which was the point I originally brought up and agreed with the post I originally replied. I was trying to be brief, but this was part of the reason I brought up the elevator. You probably do more real damage sticking a penny in an elevator (not sure this still works, but in 1988 it did at the Kerr Dorms at Oklahoma State University). Productivity was affected (people were late), resources wasted (staff getting calls "elevator is stuck again), and other affects I probably never could guess, however, it's not worth a feloney. However, with computers it goes to an automatic knee jerk reaction to the "worst case scenario" and you've got your first strike (3 in Cali and you're in prison for life...the next one could be something as little as walking out of a store and forgetting to pay for a slice of pizza).

It's easy for the under-achievers and people without imagination to sit back and say, "it serves you right," because they'll never strike out in a new direction. I would point out the reference awhile back to an experiment where three monkeys were put in a room with a ladder and a cluster of bannanas hanging in the middle of the room. Everytime one monkey would reach for a bannana the other two would get a shock. I won't go through the whole thing, but through socialization and replacement, it got to the point where monkeys who never got shocked would still beat the hell out of any monkey who even reached for the ladder (for fear of the shock...which they themselves never got). I'd even say you could extend it to the event that founded our country (at least in folklore)....throwing away a major, exportable resource...or tea in Boston.

They'd be felons using this same logic. Innocent actions often have unintended consequences. I'm sure when they threw the tea, they were more pissed than intending to spark a revolutionary new country. And from Britains perspective, I'm sure they were a nuisance that deserved a long spell in the slammer. I'm sure it, "would have served them right," from many Britains' perspective.

Let's see....

[MBCook]

And now... the university's decision process:

• Finding security holes in our expensive software: -1 point
• Fixing security holes in our expensive software: -1 point
• Giving the program and information to a professor: +1 point
• Giving the program and information to other students: -3 points
• Mentioning this online: -2 points
• Planning to tell Cisco: +1 point
• Not telling Cisco immediately: -2 points
• Using the software for months: -2 points

Total? -9 points. Not good. The university had no choice. For reference, here is the scale:

• +10 or better: Scholarship
• +5 or better: Award
• +1 or better: Acknowledgment
• 0: "We'll ignore this"
• -1 to -3: Chiding
• -4 to -6: Write in your file
• -7 and -8: "You're in serious trouble"
• -9 or worse: Suspension

Too bad the guy may lose his scholarship. He presented it wrong, especially giving it out and not telling Cisco immediately, along with running it himself. But it doens't deserve a full suspension for a semester.

CCA

[michrech]

To those who are saying "CCA doesn't recognize perfectly good antivirus packages" (and other sorts of comments). Most, if not all, of that is configurable on the backend. If your school forces McAfee, they likely removed (or never added) other products to the CCA server. The college for which I work supports Symantec, McAfee (which we give away to students), AVG, and at least a few others.

If your CCA isn't acceping an antivirus scanner you like, why not go through the proper channels to find out *why* it's not supported and see about getting that fixed?

Re:CCA

[nologin]

That's right. Essentially, the CCA policy server can be configured to accept different anti-virus packages on the client. As to why it was only configured to accept McAfee, I can only assume that either this was part of their policy, or someone administering the CCA policy server misconfigured it that way.

In this case, the student in question created a program to fool the CCA and used it for seven months before being caught and using the excuse that he was doing security research. Unfortunately, that justification just doesn't work as it is very unlikely the university gave him permission to do any security research on their network and he distributed his exploit tool to staff and other students on that network.

A look inside

[Anonymous Coward]

http://www.mgridley.com/rogueUP/Rogue_Blog/Archive .html

the article doesnt mention....

[Anonymous Coward]

I just finished working with the CCIE who implemented the CCA at U of P today and he said the student wasn't suspended for circumventing the CCA but rather distributing it to other students, which in my book is malicious. And for the record I work for a University around 30 miles away from U of P.

Re:the article doesnt mention....

[tomhudson]

How is it malicious? Because he didn't give it to the GP posters buddy, who could have made some $$$ selling it!

From the misleading headline department

[peacefinder]

Many of the arguments we use to - justly - defend security researchers seem like they may not apply in this case.

* He used the software to bypass the security check for seven months
* He distributed the software to several other students and a professor
* He did not disclose the vulnerability to the vendor before releasing his exploit
* He did not ask permission

Now, this is not to say that the University's use of CCA is wise or it's reaction was reasonably proportionate to the damage done. (If the damage and the policy violation is as minimal as the article claims, a 1-year suspension is insane.) But Mr. Maass did not do a good job of covering his ass, either.

Let this be a lesson to the next guy.

Re:From the misleading headline department

[DerekLyons]

Many of the arguments we use to - justly - defend security researchers seem like they may not apply in this case.

Slashdot defense of 'security researchers' is pretty much a knee jerk reaction, no critical thinking involved. "I was just researching security" acts on the average Slashdotter like "think of the children" seems to among the general public - it makes them blind to the facts.

Re:From the misleading headline department

[Skapare]

He used the software to bypass the security check for seven months

So ... he was giving it thorough testing. That is something that seems to not be done very much by the commercial software industry. If this was a genuine issue, the university would have cited specifically the theft of usage, and downplayed the existance of the program. Instead, they focused on the existance of the program, regardless of whatever it was even used.

He distributed the software to several other students and a professor

That's done all the time in academics. It's called collaboration.

He did not disclose the vulnerability to the vendor before releasing his exploit

Having a closed group of people help in testing is not a release. if he truly released it, show me the URL (if you can, I really will check to see if it is valid).

He did not ask permission

From whom? His professor? Grace Hopper will be turning over in her grave from this. You know damned well that if he asked the school administration or the IT department, they would blindly and ignorantly just give him a template "no" with absolutely no basis whatsoever for it.

Of course, Mr. Maass could have, and should have, been wiser about how to handle this. The lesson to learn here, though, is just how utterly stupid the people are who do make it to administrative levels in school environmnets. And it's not just college level. Our high schools have even worse problems with so many of its administrators and even teachers being absolute idiots, especially with technology.

Most politicians are fundamentally corrupt and/or evil people that want to prey on and/or control others. But when you mix that type of personality with low intelligence and stupidity, you get a person who is unable to gain that control over adults. So they are unable to be successful as politicians and have to find easier people to prey on. They end up being school administrators. And to that I add that not all school administrators are bad. I've met 2 in my life that were good people. But based on the random samplings I've seen overall, I'd say the percentage of bad ones is definitely over 50%. Right on the heels of lawyers.

If the Air Force is wise (and I sure as hell hope they are), they will consider this matter based on its merits and offer Mr. Maass the opportunity to delay his ROTC scholarship based education in some meaningful way that works, to the extent he is forced to delay it. It should help him with positive references to get into another school with an Air Force ROTC program. Should it turn out not possible for him to continue with school for a while, it should offer him the opportunity to serve in the Air Force for that interim period, with work in some communications security or low grade intelligence assistance position (e.g. where he provides technology to intelligence staff, without being in the loop of the intelligence information itself). Our country needs people like Mr. Maass working on our side!

Re:From the misleading headline department

[peacefinder]

"So ... he was giving it thorough testing."

Careful, at that kinda RPM it might be difficult to hold onto the straw you've grasped. :-)

"You know damned well that if he asked the school administration or the IT department, they would blindly and ignorantly just give him a template "no" with absolutely no basis whatsoever for it."

What I know damned well is that it wasn't his system.

It is customary for pen-testers who wish to be known as "good guys" to ask permisssion of their targets. Mr. Lamo is a notable exception, but he ended up paying a rather steep price for the Pure pursuit of his Art. So too is Mr. Maass paying such a price. That price is a direct and predictable result of unauthorized pen-testing.

Although it is usually easier to ask forgiveness than permission, sometimes forgiveness is much harder to actually get. If one believes some system managers think their data is so valuable, and their security is so fragile, that they are unwilling to grant a student pen-testing authority, why ever would one also think they'd be forgiving about an unauthorized pen-test that makes them look bad?

Mind you, I'm not saying the UP system managers were wise or justified or reasonable in their response. I'm just saying that their response was predictable. If you want to play white-hat go right ahead. But either do it right, with asking (and actually getting) permission and the whole nine yards, or be prepared to face the maximum consequences the target can throw back at you.

This program was overkill.

[eeg3]

My University uses CCA, and to bypass it... you can either not use Windows, or use Firefox and install a plug-in that allows you to modify the User-Agent to identify itself as if it were running Linux/OSX. This might not work in all cases, though.

Re:This program was overkill.

[Virgil Tibbs]

you know what would be funny?
what would be funny would be if he WAS the author of that Ff extension.
-that bypasses it etc, thats online...

Re:This program was overkill.

[Christophotron]

Who says you even need a plugin? Just go to about:config, right-click and enter a new string that is named "general.useragent.override" and for the value enter anything you like. Examples of user agent strings can be found here.

Blue Squads of Death

[Evilest Doer]

This whole fiasco reminds me of an old BBSpot article:

Gates Announces Security Death Squads

Catch me if you can

[electrosoccertux]

Clearly you haven't learned from the movie "Catch Me If You Can".

These people can outsmart you every minute of the day if you give them reason to. Why not just employ them and get on their side?

Oh right, this isn't about security, this is another stupid power struggle.

Re:Catch me if you can

[ez76]

The issue the university has a problem with isn't his talent, it's his ethics.

Say what you will about the campus' network security and policies, but the bottom line is that he agreed to abide by the campus network's terms of service and then flouted them ... because he wanted to.

What about this fellow's actions suggests that he would be any more trustworthy or rule-abiding as an employee of any company (other than perhaps his own sole proprietorship)?

Re:Catch me if you can

[arminw]

.....more trustworthy or rule-abiding.......

It's strange that you use these terms together as if they were synonymous. Someone can flout every stupid artificial rule and still be totally trustworthy. Someone who thinks and analyzes the rules and then decides which ones are in keeping with the goals of the company and which ones are just there to protect lazy or incompetent managers is usually a very valuable employee. A totally compliant yes man, who scrupulously obeys every minute detail of every rule can be a disloyal liar and a cheat. The University was too lazy or too incompetent to secure their NETWORK. Instead they chose to try to protect their users computers.

It is much better to deal with intruders while they are attempting to enter your yard than when they are already halfway in your bedroom. It is much better to protect the networks and their gateways that to try to protect every single student's computer.

Re:Catch me if you can

[zCyl]

Say what you will about the campus' network security and policies, but the bottom line is that he agreed to abide by the campus network's terms of service and then flouted them

Does a one year suspension from an entire university strike you as an appropriate punishment for violating the network terms of service in a non-harmful way?

Re:Catch me if you can

[StikyPad]

If he'd done something like this once he was commissioned, he'd receive (at best) a letter of reprimand, essentially ending his military career. So yes.

This illustrates "transitive trust" fallacies

[malcomvetter]

Regardless of the student's ethics (or lack thereof), this illustrates a fallacy of trust in computing that often goes overlooked, especially in software security products: transitive (implicit) trust.

Think about it logically for a second ... If the administrator (of the University, some enterprise, or even a home network) cannot state anything about the trustworthiness of an unfamiliar computer, how can that same administrator trust the output of some software program designed to assert the trustworthiness of an otherwise untrusted computer?

Trusted input (e.g. Cisco Clean Access)
+ Untrusted computation (unknown host)
!= Trusted output (i.e. an assertion from the CCA that the computer is trustworthy)

The nature of this equation is that the untrusted computer is implicitly trusted to compute its own trustworthiness. What ramifications does that have on the real world analogies?

Banker: Can I trust that you'll repay this loan for $1 Billion?
Some joe off the street: [Hides "will work for food" cardboard sign behind his back.] Uh, sure.

And yet, how many NAC/NAP vendors actually try to challenge the unknown host (java applet, activeX control, native code, etc.)? Answer is: nearly all of them, unfortunately. Even if Cisco fixes this hole, what will happen next? This is not unlike Cisco trying to sell a perpetual motion machine-- this simply defies the "natural laws" of security.

--
NAC is not the answer. How about those good ol' 3270 connections?

Generally I would say 7 month's use = malicious

[280Z28]

But more malicious = forcing me to uninstall the A/V I know and trust and install some crap before I can access the #1 source of malware (the internet)?! I'm doing just fine on my own, thank you. Congrats to the student for not tolerating that crap.

"go to Cisco?" then he's documented his code then

[Locutus]

If this "kid" REALLY intended to bring his findings to Cisco, then he should have been documenting not only his intent but also his findings and techniques used and this should be enough to prevent a suspension. Unless he came up with this idea of 'going to Cisco' after he got busted.

I have a hard time believing his story without some proof he'd been discussing visiting Cisco or interning there well in advance of getting busted for spoofing their APIs.

LoB

RTFA before commenting...

[msauve]

"There was nothing in [the policies] that stood out to me that I would be in violation of," Maass said of his thinking at the time he authored the program.

Maass was charged with "violations of the Acceptable Use Policy, the Network Security Policy, disrespect for authority, disrespect for property, disorderly conduct and fraud," according to a letter he received from the University Judicial Board...

"A lot of these policies are written to be very vague and flexible so that they can be [used] in whatever situation they (the University) need to use them in," he [Maass] says...

Goldrick [ vice president of student services] declined to comment on issues concerning policies.

Would you care to quote the policy you claim he broke?

No, it sounds like he embarassed the University IT administration, so they closed ranks and used a kangaroo court to express their displeasure. Dean Wormer put him on double secret probation first, I'm sure.

Re:RTFA before commenting...

[Score Whore]

There was a much better approach that I'm sure Mr. Maass would have been pleased to be subjected to. In the exact same fashion that he developed this software and kept the whole situation to himself until his "planned" notification to Cisco this summer, the university could have let him finish out his degree then "planned" on releasing the confirmation that he had done so until sometime in 2020. I'm sure that would fit perfectly within Maass' code of ethics.

And, btw, university code of conduct, aups and the like are meant to be vague. Not so they can stick it to anybody they don't like, but because it's impossible to enumerate the entirety of stupid behavior. University students should have the brains to not need an itemized list of good and acceptable behavior.

All in all it sounds like their being pretty nice to the guy. He's just been suspended, he could have been expelled.

Re:RTFA before commenting...

[Anonymous Coward]

No, it sounds like he embarassed the University IT administration, so they closed ranks and used a kangaroo court to express their displeasure. Dean Wormer put him on double secret probation first, I'm sure.

That is the way I read it. In fact, I strongly suspect his reaction to being busted was that if IT administration wants to impose CCA and Symantec AV on everyone (destabalising their systems while doing little to enhance security) then they should expect those with more of a clue to bypass the system. I would be curious as to what security products he was running on his system. Very likely, something a lot better than Symantec.

Re:RTFA before commenting...

[pallmall1]

In the exact same fashion that he developed this software and kept the whole situation to himself...

Read the article. He did tell a Professor. I'll bet they don't "stick it" to him/her.

Put that in your smug pipe and smoke it.

Re:RTFA before commenting...

[freecorbinj]

Yeah, something like this happened at my university a couple of years back. A student found a vulnerability that allowed root access, and sent an email to both the IT department and the CS department. Of course, the CS department fixed it right away, but when the IT department didn't do anything about it, he sent them an email as root reminding them again of the vulnerability. As you might expect, the IT dept flipped out and tried to get him expelled for such and such offence, but fortunately rationality prevailed and he was let off.

CCA and University Technical Support

[dorath]

I work in the IT department at a university that uses CCA. If you live on-campus you're required to use CCA to connect to the University network. IIRC, the setup here doesn't check for much: anti-virus and XP SP2 if you're on Windows, and Linux users are ignored.

Support calls from students have fallen by more than 50% since CCA was put into use. Simply requiring anti-virus and SP2 has tremendously reduced the amount of garbage infecting Windows users machines. CCA has been a real boon, even if there are a plethora of ways around it.

Re:CCA and University Technical Support

[The Cisco Kid]

"Linux users are ignored" in that they can connect without jumping through the hoops, or in that they simply can't connect at all? I'm hoping you meant the former.

Also, if a Linux (or other *nix) box can connect with no hoop-jumping, it would be trivial from there to put two NICs in that *nix box and then setup natd and dhcpd, to provide other boxes (which might include wincrap boxes) with access. A smart IT dept would recognize that anyone who would think to use a *nix box as a firewall for windoze boxes (probably) was smart enough to keep their systems malware-free on their own. An incompetent IT dept would of course think of this as a terrible security hole and wouldnt allow anything but Windoze boxes with the proper firewall 'software' installed to connect.

Honest Your Honor!

[Stormy Dragon]

I wasn't buglarizing this house, I was just checking the home security system for holes!

Re:Honest Your Honor!

[asninn]

A better analogy would be "I wasn't burgling anything, I was just using the unlocked back door to gain entrance into the building where I work because the security guard at the door was taking twenty minutes to check me every time I wanted to enter, and I was also telling a couple of others about the unlocked back door so they could do the same thing".

He shouldn't have exploited this for seven months without telling anyone (and his claim that the intended to tell Cisco about it in the future seems rather weak now), and he shouldn't have told others about it so they could do the same thing, but it's obviously not the same as cracking a random system that you do NOT have any right to access at all with the intent of doing damage or taking information from there (which is what "burgle" (or "burglarize", if you prefer that) would imply to me).

A one-year suspension is ridiculous, too. What this guy needs is a Security Research Ethics 101 course and someone who will help him develop his talents further so he'll become one of the Good Guys(tm).

Re:Honest Your Honor!

[mysidia]

Since he was bypassing a security measure on his own property; it's more like he was burgling his own house.

Or rather more like... the local government entity that maintains the streets decided to require everyone put Brand X locks on their doors, and they put automatic detectors in front of everyone's house to close an electronic gate in front of their driveway, in case Brand Y locks or no locks were detected on their front door.

Even if Brand Y locks happen to be more secure than brand X locks.

Seems to me like the Brand Y lock makers (I.E. The AV companies other than Symantec) should be pursuing legal action against from the university for what would seem to be violations of anti-trust law.

Student computers are not university computers. A university you attend has no right to dictate which software you should use to secure your system, only that you take all reasonable precautions, including full responsibility for any activity of your system (Even if it becomes compromised), and not have your system compromised.

Bait and Switch

[litewoheat]

OK this story is sensationalist BS. Maybe the summary should have stated that he USED IT FOR SEVEN MONTHS and GAVE IT OUT TO FRIENDS!? Come on, only when he gets caught does he say he was going to share his results. Yeah, that's like embezzling and then saying you were going to give all the money back when you get caught.

Re:If he were a law student...

[dknj]

...and that does what?

My experience with CCA

[Christophotron]

My university imposed this crapola on all dorm residents during the summer to test it out. I wasn't there, but my girlfriend's computer suffered the consequences of it. They forced her to uninstall the AVG antivirus and Comodo firewall that I configured, and during the transition her computer was massively hijacked. I'll admit, the dorm networks there are atrocious and this type of software might have been a good idea. Worms/viruses were absolutely rampant; two or three times a day AVG would popup saying it found a threat in some random temporary folder, and the firewall would report numerous "intrusion attempts". However, they didn't even warn people that they would be COMPLETELY unprotected while they are installing the new protection software. If I was there I would have unplugged the network cable during all this. Opening the ports for even five minutes proved disastrous. Needless to say I ended up reformatting.

They never did implement CCA after the trial. Now, the dorm network is simply bandwidth-throttled and packet-shaped to oblivion. Dial-up is faster, I am sure. It's still a security risk, but so slow that no one gives a shit.

"Trying to improve security" my a$$

[ericfitz]

This guy was being clever disabling the security software, nothing more. He got caught and now he's whining.

It may be unpopular, but when you connect your computer to some networks you do so under agreement which may limit what you can do, may require you to consent to monitoring, and may require you to install software to enforce the terms of that agreement. Tampering with the software may be a violation of that agreement, it doesn't matter if it's "your" computer, we're talking contracts here.

There's nothing extraordinary about someone with physical access and superuser/administrative access rights being able to modify the software on their own machine. And if you can debug a client app, then you can write your own app that can pretend to be that client when talking to the corresponding server.

If he was a security professional then he would have done this in a lab, not on his own machine, and would have reported the results in a timely fashion, not "I was going to get around to it", and would not have distributed exploit code to his friends.

This guy's behavior violated pretty much any acceptable use policy I've ever seen or written, and he got a punishment probably on the stiffer end of the scale because his behavior doesn't appear to show any mitigating circumstance.

Re:"Trying to improve security" my a$$

[maop]

He broke an agreement and thus the school will take a "pound of flesh" from the lad. I guess that's the moral of the story.

Cho Vs Maass

[chromozone]

All week I been reading how the kid at Virginia Tech couldn't be dismissed from school even though he stalked, threatened and oozed a violent psyche to the point of having 2 professors ask the university for help with him. Universities should only protect students as vigorously as they seem to protect themselves in this case.

Re:If he were a law student...

[rriven]

...and that does what?

proves you aren't just saying "i was going to tell them it was broken" to get out of trouble and you HAD the intentions to do so. But you would still probably get in trouble

Wasn't it his computer?

[gillbates]

From what I gather, the breach occurred on his own computer!? Since when does keeping your own computer private from the intrusive eyes of others count as a computer crime?

Essentially, what the university is asking for is the root password to your own machine, in exchange for network access. I think I'd rather do without the university network if I had to run snoopware.

And on what ethical principle does the university believe they have a right to own a machine for which they haven't paid? I can understand they are trying to combat network problems caused by viruses, but the correct response is not to install spyware, but rather simply to cut off the network connections of those machines infected. They have no right to install backdoors on machines they don't own.

And even so, he doesn't deserve to be punished for effectively taking control over his own machine. It belongs to him, not the university!

Re:Wasn't it his computer?

[qzulla]

If you want to be on my network here's the rules. I don't care who owns the computer. I own the network.

Let me repeat myself.

If you want to be on my network here's the rules. I don't care who owns the computer. I own the network.

Those are the rules.

If you don't like them don't connect. If you violate the rules go back and read the fine print you signed.

qz

Re:Wasn't it his computer?

[Doctor Faustus]

Do your rules include installing a webcam they're not allowed to turn off? I'm starting to think college network administration could be a pretty nice job...

Re:Wasn't it his computer?

[The Cisco Kid]

That rule applies only in the coed dorms. :P

ob simpson's quote

[TheGratefulNet]

"mess with a teacher's mind: that's a paddlin', too"

Never help a corporate, NEVER

[cheekyboy]

They have enough money and power and shares....

If any thing, give the info to a smaller competitor so they can exploit it in marketing.

Unless you know the IT admin or department head personally, dont go being a hero and make them look bad.

If they arent your friend, they are your enemy

I would hope the sensitive data

[Tran]

is secured beyond the basic yoyo windows software and lives on either a separate network or on secure servers on the network.

If everyone had guns....

[cheekyboy]

They would have gunned down that Korean dude.

Either way, there are ways to attack someone who has a gun without a gun, and actually WIN.

1. Find a fire hose, and spray the whole floor so its slippery when running, you can even spray it directly on him to make him fall.
2. Get a fire extinguisher and spray him/hall way/room like hell so its so foggy you cannot see anything, and breathing those chemicals in is
      not nice either.

Re:If everyone had guns....

[iamacat]

Do you actually own a gun?
Are you carrying it to classes?
Can you shoot well enough to hit a moving target when you are scared shitless?
Is it always secure enough that you are willing to take responsibility if someone, possibly your kid, uses it to commit a crime or dies in an accident?

You can always count on /.

[th3rmite]

When things like this happen, people are always saying how horrible it is that the poor guy got in trouble. After all he wasn't doing anything wrong, just trying to help their security get better. Using the same logic, I guess I shouldn't have a problem with someone picking the lock to my house and walking around, even if they say they were going to write the lock company about how they did it. I know not related to the article's situation, but I'm tired of people jumping immediately to the side of the hacker/cracker. As far as the University "owning" your computer for use of their network, if you AGREED to the contract, I can understand why they'd be mad if you broke your end. AND do you really want students in your institution who don't have the integrity to honor contracts that THEY signed into? It would be one thing to do this in a controlled laboratory type setting, but this man obviously did not. I honestly have no sympathy for him. Oh and for the poster who says we want to raise our children to be corporate drones when it pays for Jobs to be somewhat anti-authority: We only want those who are smart enugh to NOT GET CAUGHT.

Re:Tell us again...

[AmigaBen]

Because he's kewl, you see. IT is "the man", and he stuck it to him! w00t

Re:If he were a law student...

[Score Whore]

Or it says that you were planning on doing something bad and just in case you got caught in the act you were preparing your story ahead of time...

Black hat - bad!

[billcopc]

For those of you who can't read, what the summary neglects to mention is that the guy was running this kind of reverse-rootkit for 6 months. 6 months is a long time to "test" a vulnerability. In all likelihood he just started yapping to cover his own ass, when in truth he probably never intended to go public with the vulnerability and just wanted to go on being "leet" clandestinely. I agree it's a shame that top-dollar commercial products used by the largest organizations have such glaring holes, but this kid was no Jesus Christ of Cisco, he was yet another ePeen going down the wrong path. Had he wanted to help improve network security, he would have worked with Cisco or his IT department since day one, and probably gotten great kudos for it. Instead he got suspended and will have to look for exploits in a burger joint.

Bradford networks BS

[fineghal]

Yeah my Uni has something like this for windows. Bradford Network Agent, which forces TrendMicro AV down your throat. (You must uninstall all other AVs...) Now I'm all for security, but there wasn't any granular control to speak of. "A false positive. Hmmm... Well surely there is an exclusion option..." 20 minutes later, and guess what? Still no exclusion. So I say, screw that. Block the heartbeat ping they have on the network at my firewall, remove network agent. No problems so far. Go to remove their Trend Micro... And guess what? I need a password. I need THEIR permission to remove a program on MY 2000 dollar machine. Needless to say I removed it re-booted to *nix, authenticated and no worries.

Re:and he deserved it

[arminw]

.....installing it without permission on someone's network ......

He didn't install anything anywhere but on his own computer. He didn't cause any harm to anyone either, except to the pride of the University's IT staff. There are some web sites that refuse to recognize any browser except IE. Am I doing something wrong when I tell my Mac to inform their server that this particular request is coming from a Windows machine running IE? Some of these same web sites then work just fine with Safari on the Mac. This student did in effect do the same thing. He instructed his computer to lie to the server and tell that stupid server what it wanted to hear, so the young man could get on with his work.

How Clean Access Works

[iMouse]

What a crock-o-blank,

Typical University IT people not knowing what the hell they are dealing with. Think this "breach" was a big deal? Think again.

Know how to use the Windows Registry? You'll love how simple this is...

Cisco Clean Access looks for several registry keys that determine which Windows patches are installed and which are not. It also looks for registry info to give the system a look at what anti-virus package they are running and which DAT file they have. Basically, all his program would need to do is create entries in the registry in the locations where Clean Access would look. It would defeat the security check and the remediation process very easily.

This is not a vulnerability, it is the means in which the system works.

1. User connects to the network. When a browser is launched, the user is redirected and prompted to install the Clean Access Agent from the Clean Access Server.
2. The user is presented with a login box where he/she would log into the system.
3. The Clean Access Agent checks for several registry flags to determine which Windows Updates are installed and what anti-virus/anti-spyware is installed. It will also check the registry for anti-virus/anti-spyware DAT/REG file date and versions.
4. If the system is not up to date, they are passed to a temporary role (remediation stage) where they are only permitted to selected sites to download the updates they need.
5. Users are left in the temporary role until they fulfill the logon requirements. Once the requirements have been completed, they are passed to the main role allowing full access to the network.

Now...for the easy part...

Wanna get around the CCA check without installing patch KB918439? Create the following registry keys ending with Filelist.
[\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Wi ndows XP\SP3\KB918439\Filelist\]

How about getting around AV installation (McAfee VirusScan Enterprise as an example)? Create the following registry keys ending with VirusScan Enterprise.
[\HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\VirusScan Enterprise\]

How about getting around a forced DAT update? Create the following registry keys ending with CurrentVersion. Also create a string value called szVirDefVer with the value greater than 5018.
[\HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\VirusScan Enterprise\CurrentVersion\]

Heh...that wasn't so bad...was it? ;-)

Well, it depends, what did he write?

[SmallFurryCreature]

I read the article and still am not clear on what the program was supposed to do. Apparently there was a piece of software in place that monitored the computers for security reasons. Lets for simplicity sakes call it a virus scanner.

Now did he write a program that DISABLED the virus scanner in some ways?

Did his own program then REPLACE this virus scanner with his own?

If so, then he is indeed in the wrong.

He should instead have written a virus scanner sitting behind or in front of the existing one to augment its capabilities. Then nothing would be wrong, the required software is still in place and working BUT his own software would be making it more secure, always presuming offcourse that his own software IS in fact more secure.

This is the crux of the matter, who says his software was better and that by him replacing the default software he made the system more secure? We got only his word for that.

See it like this, say that the dorms are required to have a fire extinguisher in every room. Now a person comes along and says that the devices ain't good enough, too small and don't work in certain conditions. What should he then do? Replace them with a model he claims to be better OR put that model NEXT to them.

I can argue till I am blue in the face with the local firechief but replacing mandated equipment and facilities is NOT going to be accepted. ADDING to them is. Just because only a handheld bottle of eye-washer is needed doesn't mean I can't install the full shower version. Just as long the bottle is still there. Just because the helmet is required at the building site doesn't mean I can't wear ear/eye protection as well, just as long as I still wear the helmet.

Granted there are problems with this, it could be that policy requires you to use the small fire extinguisher first, that you know won't work, to fight a fire and that you cannot touch your own that does work because by then you will have burnt to death.

if the existing virus scanner has an exploit weakness having your own program behind it don't work. If the policy requires the exiting security software to be the first in line, and if it itself can be exploited so that a second program behind it never gets a chance to stop the intrusion you are screwed.

Setting your own software in FRONT is probably against policy, after all if your own software is flawed then it can be exploited before the required software has a change.

It is difficult but frankly that is what you get when departments get too large. You need rules but will inevitably find that the rules restrict legitimate use. The answer? Don't use them.

What I think is however far more likely in this case is that we are talking the ancient and dreaded evil of the crushed ego. Who wants to take a bet that someone at the IT department didn't just feel peeved to have the software he/she choose as being secure exposed as being insecure? Yeah, sure, YOU would use such a comment to learn and implement a better solution. You are a saint to be sure but most people would just come down like a ton of bricks on the messenger, less their supervisor starts asking just what you are getting payed for.

It's a load of crap

[argStyopa]

Please.
Firstly, the title of the article shows which way /. is going to swing on this: " Student Attempting To Improve School Security Suspended"

Attempting to improve security? Really? How precisely was he 'attempting' to improve anything. It reads to me that he found an exploit AND EXPLOITED IT. He didn't immediately approach CISCO, or an academic advisor, or anyone.

Other posters in this thread talk about oppression and crap - what a laugh. It's the Townsend defense: Yes, officer, I was looking through pedophilic pron because I wanted to catch these darn bad guys, I was JUST about to come tell you about it.

It's very simple to do white hat research.
1) tell someone what you're doing. If you feel you might want to 'sell' the idea or there's some reason you don't want to be too specific, don't be. But TELL someone - even a discussion with your lawyer can later be used as strong evidence about your ORIGINAL INTENT

2) document what you're doing

3) if someone interrupts you and says "aha, we caught a criminal" you have a paper trail AND at least one witness that you laid the groundwork for something non-criminal beforehand.

The problem is that actions like this look JUST LIKE the crimes they purport to prevent. So much so, it's very, very easy to claim that's what you were doing after the fact. So the burden is upon YOU to prove that your explanation is not just after-the-fact rationalization.

Man I wish I had students this smart...

[sarkeizen]

I manage a part of a university IT department. I am dumbfounded about exactly how dense students are about computers - these are non-cs/engineering students btw - students were shocked that I could tell (even when the clicked the little 'encryption' checkbox) that they were using BitTorrent. That I had their username and if I cared - which I don't - I could have a whole lot of information about what they were doing.

Our problem is the opposite - students are too stupid (or simply embrace a kind of self-interest that is rather short sighted) to update their virus protection software, or patch their OS or set their passwords to something that isn't easy to guess. So we do need something to enforce these kinds of policies - We have looked at Cisco's product (for the first two) and aside from being ridiculously expensive it's a pain. The fact that there is no standardized way of querying antivirus software over a network is also annoying. In the end we may end up writing some client software of our own and combining it with packet fence.

In short I'm familiar with the problem that this Uni is trying to solve but I don't really view students like this as the problem.

CCA

[CaptainJeff]

CCA, and other NAC solutions, are designed to be used in a business environment (i.e. the same AV, the same anti-spyware, the same firewall, the same patch levels, etc are all in use by all the workstations). It works well in this case (a homogeneous environment). It is impractical for a situation when you don't control the software load on all of the workstations you are subjecting to it. However, if a school decides that to connect to their network, you need to be protected with a minimal set of "security" software, this is the only way to enforce that right now. So what is the school to do? Require everyone to run an up-to-date version of specific software or let students connect machines with god-knows-what, increasing the risk to everyone on the network? Not a clear-cut answer.

No, it's not okay to break security...

[Xugumad]

...without permission.

This is akin to finding someone sitting in your house, the entire place apparently untouched, and they explain "Oh, I was just checking the security on your locks; turns out it's fairly bad. I was going to tell you later...", and it's not okay.

If you think you've seen a security hole, stop, tell the person responsible _immediately_. With luck, they can give you a dummy system to test it on without risking getting yourself into trouble.

If the people responsible for security ignore you, get someone else to back you up. In this case, talk to one of the staff who is knowledgeable about computers, or the student newspaper.

Didja hear the one about...

[flyneye]

How many Portlocks does it take to administer university policy?
None,they still haven't figured out how how to interpret common sense.

the moral teaching

[Walter Carver]

Stop helping the retarded fools, fuck them, be one of the bad guys.

WOW

[Grindalf]

LEET LEET LEET LEET LEET K-Rad! I'll bet those lecturers were really cross...

Your network.

[gillbates]

If any virus-infested machine can take down your network by merely connecting to it, you obviously don't own your network. You just think you do.

Ok, it's trollish, I'll admit, but I'm disgusted with network admins that push the responsibility for their network back onto the users. I'm a professional engineer, and people expect my stuff to work, even under adverse circumstances. Is it too much to ask the same of a network admin?

Re:Persay?

[StikyPad]

Apparently it's a line of biometric speaker verification products.

I guess Clean Access doesn't put any constraints on it, so that's good to know.

Re:IT staff

[bussdriver]

I said "almost all"

I've rarely met IT staff (and SysAdmins) that were human. I understand Woz's old comment about killing his kid if they grew up to be a SysAdmin. The education system and small business seems to pull in the really bad ones.

The educated and competent ones seem to be rare and they are usually good. A CS degree isn't a clear enough filter, there are too many with CS degrees.