Connect with us

Tech News

How safe are school records? Not very, says student security researcher – TechCrunch

Published

on

If you can’t trust your bank, government or your medical provider to protect your data, what makes you think students are any safer?

Turns out, according to one student security researcher, they’re not.

Eighteen-year-old Bill Demirkapi, a recent high school graduate in Boston, Massachusetts, spent much of his latter school years with an eye on his own student data. Through self-taught pen testing and bug hunting, Demirkapi found several vulnerabilities in a his school’s learning management system, Blackboard, and his school district’s student information system, known as Aspen and built by Follett, which centralizes student data, including performance, grades, and health records.

The former student reported the flaws and revealed his findings at the Def Con security conference on Friday.

“I’ve always been fascinated with the idea of hacking,” Demirkapi told TechCrunch prior to his talk. “I started researching but I learned by doing,” he said.

Among one of the more damaging issues Demirkapi found in Follett’s student information system was an improper access control vulnerability, which if exploited could have allowed an attacker to read and write to the central Aspen database and obtain any student’s data.

Blackboard’s Community Engagement platform had several vulnerabilities, including an information disclosure bug. A debugging misconfiguration allowed him to discover two subdomains, which spat back the credentials for Apple app provisioning accounts for dozens of school districts, as well as the database credentials for most if not every Blackboard’s Community Engagement platform, said Demirkapi.

“School data or student data should be taken as seriously as health data. The next generation should be one of our number one priorities, who looks out for those who can’t defend themselves.”
Bill Demirkapi, security researcher

Another set of vulnerabilities could have allowed an authorized user — like a student — to carry out SQL injection attacks. Demirkapi said six databases could be tricked into disclosing data by injecting SQL commands, including grades, school attendance data, punishment history, library balances, and other sensitive and private data.

Some of the SQL injection flaws were blind attacks, meaning dumping the entire database would have been more difficult but not impossible.

In all, over 5,000 schools and over five million students and teachers were impacted by the SQL injection vulnerabilities alone, he said.

Demirkapi said he was mindful to not access any student records other than his own. But he warned that any low-skilled attacker could have done considerable damage by accessing and obtaining student records, not least thanks to the simplicity of the database’s password. He wouldn’t say what it was, only that it was “worse than ‘1234’.”

But finding the vulnerabilities was only one part of the challenge. Disclosing them to the companies turned out to be just as tricky.

Demirkapi admitted that his disclosure with Follett could have been better. He found that one of the bugs gave him improper access to create his own “group resource,” such as a snippet of text, which was viewable to every user on the system.

“What does an immature 11th grader do when you hand him a very, very, loud megaphone?” he said. “Yell into it.”

And that’s exactly what he did. He sent out a message to every user, displaying each user’s login cookies on their screen. “No worries, I didn’t steal them,” the alert read.

“The school wasn’t thrilled with it,” he said. “Fortunately, I got off with a two-day suspension.”

He conceded it wasn’t one of his smartest ideas. He wanted to show his proof-of-concept but was unable to contact Follett with details of the vulnerability. He later went through his school, which set up a meeting, and disclosed the bugs to the company.

Blackboard, however, ignored Demirkapi’s responses for several months, he said. He knows because after the first month of being ignored, he included an email tracker, allowing him to see how often the email was opened — which turned out to be several times in the first few hours after sending. And yet the company still did not respond to the researcher’s bug report.

Blackboard eventually fixed the vulnerabilities, but Demirkapi said he found that the companies “weren’t really prepared to handle vulnerability reports,” despite Blackboard ostensibly having a published vulnerability disclosure process.

“It surprised me how insecure student data is,” he said. “School data or student data should be taken as seriously as health data,” he said. “The next generation should be one of our number one priorities, who looks out for those who can’t defend themselves.”

He said if a teenager had discovered serious security flaws, it was likely that more advanced attackers could do far more damage.

Heather Phillips, a spokesperson for Blackboard, said the company appreciated Demirkapi’s disclosure.

“We have addressed several issues that were brought to our attention by Mr. Demirkapi and have no indication that these vulnerabilities were exploited or that any clients’ personal information was accessed by Mr. Demirkapi or any other unauthorized party,” the statement said. “One of the lessons learned from this particular exchange is that we could improve how we communicate with security researchers who bring these issues to our attention.”

Follet spokesperson Tom Kline said the company “developed and deployed a patch to address the web vulnerability” in July 2018.

The student researcher said he was not deterred by the issues he faced with disclosure.

“I’m 100% set already on doing computer security as a career,” he said. “Just because some vendors aren’t the best examples of good responsible disclosure or have a good security program doesn’t mean they’re representative of the entire security field.”



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published.

Tech News

Kia EV6 GT Packs 576 Electric Horses And A Drift Mode

Published

on

You might not associate Kia with performance vehicles, but with 576 horsepower on tap, the new EV6 GT unveiled during Monterey Car Week aims to change that.

Continue Reading

Tech News

This Electronic ‘Skin’ Lacking A Chip Could Be The Future Of Wearables

Published

on

But here’s the exciting part: The electronic skin can also be easily customized with a different kind of ion-sensing membrane that is sensitive to other chemicals like glucose and cortisol in the sweat. “We showed sodium sensing, but if you change the sensing membrane, you could detect any target biomarker,” adds co-author of the paper, Jun Min Suh. 

In 2018, a team from Stanford University also came up with a wearable device that can measure cortisol levels in sweat and analyze stress levels. Additionally, 2021 wearable-centric research from the Ecole Polytechnique Fédérale de Lausanne in France revealed that cortisol can be used as a biomarker for treating conditions like burnout and obesity.

Another critical benefit is that the electronic skin is flexible, which means the comfort aspect has already been taken care of. That’s a huge relief, as sleeping while wearing a smartwatch so that it collects detailed information about heart rate patterns is not the most comfortable experience. Plus, sleep tracking coupled with continuous heart rate monitoring is also quite taxing on the battery life of a smartwatch. 

An electronic skin that can transmit data related to heart rate and changes in the chemistry of sweat without a chip or transmission gear is a truly remarkable step. Work in the domain has been making tremendous process. From the potential for tattoos that monitor health to artificial skin that can heal its own bruises, the possibilities are almost endless. 

Continue Reading

Tech News

TikTok Is Furious About This Dodge Charger EV Feature

Published

on

While the TikTokers present at the event seemed blown away by the new Daytona SRT, their comments sections were not as kind. The vehicle’s exhaust feature was panned by a number of users in the replies, with one of the commenters on Fitrich76’s video simply replying: “We reving [sic] speakers now.” Another TikToker, Justin Hillard, is amongst the crowd predicting the move to electric will backfire on Dodge. He said: “Funny part is they will see the sales go down very quickly. Because no one wants electric. Especially because if everyone has to go electric then.” Caleb Schueng added, “You [sic] can I download the challengers exhaust sound? I wanna put it in my civic.”

Comments on ModdedDetroit’s TikTok followed a similar theme, with one user stating: “Such a sad era we’re going into.” Another user simply said, “we truly are going into dark times,” and one user criticized the vehicle’s figurative lack of soul. A notable portion of the comments section claimed Dodge was going to go out of business, though one user did say the car was better than Ford’s Mach-E.

These are just examples from a couple of accounts, but they do seem to reflect the broader reaction across social media. Influencers attending the events seemed quite complimentary about the new EV, while the majority of their followers tore the concept apart. In several cases, the electric engine sound was likened to the noise Simba from “The Lion King” made when he was trying to roar. You could easily argue that comment sections are the last places you want to look while gauging public opinion, but there’s also a case for saying these are the exact people Dodge was hoping to win over with the Daytona SRT.

Continue Reading

Trending