Is SIMS really secure? And why do so many schools stick with it?

[visage443]

I should immediately make myself clear that I'm not a sysadmin or anything, I'm just a 15 year-old student, wanting to get some insight into the usage of SIMS nowadays, and I'm seriously questioning the security of SIMS. I should also make clear that I don't have any malicious intent, this post is more for a small independent research project that I'm doing. Maybe this isn't the right place to post this, but I'm hoping I can still get some insight.

 

In regards to SIMS' security, this is about how SIMS handles user authentication.

 

SIMS handles credentials through SQL Server users with usernames prefixed with 'sims_', and the password of the user is run through an encryption algorithm that's specific to SIMS. The SIMS .net client also has an implementation of this encryption too as the password is encrypted before it is sent over the network. So, this sounds all good, right?

 

The standard practice for storing user passwords in a database is typically to run it through a hashing algorithm, but SIMS uses encryption. That by itself would not be an issue if it wasn't for the fact that the encryption is reversible. With SIMS' encryption, the security aspect comes purely from the fact that the encryption algorithm is proprietary and completely unknown. However, keep in mind that the database client has the code for the encryption function too. SIMS .net's code is not obfuscated in any way, and so the reversible encryption algorithm can be very easily obtained.

 

This is a problem for a few reasons. For one, teacher passwords can be obtained by traffic interception, as SIMS communicates with the database server over a plain connection. The encrypted password is sent, but with the encryption algorithm, you can decrypt the password, and obtain a teacher's password. Even worse, the chances of them reusing that password for other accounts (such as their AD login) would be pretty high.

 

Another problem is that if someone has a copy of a SIMS database backup (sysadmins, encrypt your database backups!!!), you can gain access to other teacher's accounts, and obtain access to a school's live database. In a database table, every user account created is listed with a column that stores the encrypted password generated when the account is first created. The good thing is that it only stores the generated password, so for the most part the password would be completely void as SIMS prompts a password change on first login. The bad thing is that there could be many accounts which have never been logged into, and thus the generated passwords are still valid for those accounts. Ideally, SIMS should really not be storing generated passwords in the first place. It should just show you the password one time after account creation, and that's it.

 

Also, did you know SIMS passwords are not case sensitive, despite the login prompt warning you about case sensitivity? I'm definitely not the only one here to notice!

 

I understand that this is probably more out of necessity as SIMS .net has to retain compatibility with older software like Nova-T, but by retaining legacy compatibility, some security ends up having to be sacrificed. Also, should software as old as Nova-T that dates back to the 1990s still be in use?

 

The point I've been building up to with all of this is that SIMS doesn't really seem to be a great choice for modern use. It may have worked well back in the 90s and 2000s, but it really has not aged all that well. It's old, bloated, insecure, and slow. And I hope everything I've been talking about here helps to demonstrate its age and concerns over security. I see many alternative MIS systems being advertised here, yet many schools stick to SIMS. Many of the posts here are about SIMS. I'm also asking about the security aspect as I'm wondering if this is that big of an issue, having seen nobody talk about it before. The age of the software and the security concerns is a bit of an eye-opener for me personally given how SIMS is considered to be professional software, especially given its widespread use in schools. You could say that I'm worrying too much about the security and that I'm making a big deal over nothing, but it concerns me given how much sensitive information a system like SIMS holds.

 

So, what's with so many schools still using SIMS? And do any of the concerns I've expressed present a security issue?

[elsiegee40]

This is a forum that discusses many security issues in schools and you allege you are a student.

 

We only have your word for this and you seem very well informed and written for a 15 year old.

 

Please forgive our school network managers for not necessarily seeing it as appropriate to discuss such matters with anyone not directly employed by a school whether a student or not.

Edited July 6, 2022 by elsiegee40

[supportman]

Great post, thanks for the write up!

 

You are correct in many things.

 

We have personally moved away to a modern cloud solution in our school for our MIS.

 

Sims carries with it lots of technical debt, I think its excellent that you pointed out some of its short comings. Looking into these things can only make the system more secure which is a good thing.

[TechMonkey]

Without going into the security issues the biggest reasons for SIMS still being used is inertia and out side influence.

 

In regards to inertia, any organization using a system will take a good lot of effort to move to a different system. Think of not only the migration effort, transferring all records, data, documents, etc, but also the training of nearly every member of staff, the updating of helpsheets and documentation and the loss of time while people move their mental models. There are also the number of systems that have hung off SIMS to do all the bits SIMS doesn't. It can appear to be an impossible task sometimes. Add to that the amount of institutional knowledge and experience that will have been built-up, it is understandable why there is hesitence.

 

In regards to outside influence, schools used to be serviced by the LEA (local education authority) who would offer cheaper services and licenses. They would decide on the system they wanted the whole area to use and they would go along with it. This did give an economy of scale and meant there was ease of transferring data.

 

Now neither of these should be the end of discussion to not migrate now, but they do explain why this position has come about. If you think education and SIMS is bad, look into banks! They have not only aged systems, in some cases even older than SIMS, but also multiple systems from bank mergers and take overs. These often then have another system to interface into the main systems. This is often the underlying cause to big outages we have seen in the past.

[psydii]

I think I saw someone just posted here about how they thought sims auth can have a better option, and then realised that the "better" option was actually way way worse

 

To answer your second to last question first: Inertia. Though momentum for change has been building across the industry.

 

To answer your questions about the lack of modern security practices: SIMS development has been relatively stagnant as market dominant cash-cows often become. The previous owner (Capita ESS) tried and failed to create a new web/cloud MIS over the last 10 years. Capita found itself in financial difficulty and has sold off the SIMS business unit, and the new owners are promising significant developments.

 

While not meeting modern security best practices (or even best practice from a decade ago), last time I had a noodle around with wireshark on a SIMS Client->Server connection they were all protected by TLS. I have never heard of SIMS being breached through a technological hack. I'm sure there will have been kids who just figured out teacher passwords though.

 

On Nova-T. The code for timetabling is as old as microcomputers. Nova-T is at least 25 years old, likely deep down older still. The major alternative (Timetabler) dates its core back to the 1970's!. If you think this is bonkers, go read up on what keeps the money flowing in banks.

 

 

Finally on being able to do bad things if you have an unencrypted copy of the backup. Well, yes. Backups of the database should be well protected by NTFS permissions, and never be stored on removable media with out additional protections.

[jthompson]

I think I saw someone just posted here about how they thought sims auth can have a better option, and then realised that the "better" option was actually way way worse

 

There's certainly a debate to be had there. A debate almost as old as SIMS.

[mavhc]

SIMS's alter password function (In LoginProcesses.dll UpdatePassword function) appears to use Encrypt64, whatever that does.

DatabaseCommandCreator.addCommandParameter(dbCommand, "@new_password_encrypted", (object)Encrypt64.EncryptPassword(newPassword));

 

Are you sure it's stored reversibly?

[psydii]

The lack of reference to keys and the number 64 does not give me any hope that this is anything but reversable encryption.

[Sonic007]

I think the reason people have stuck with Sims for so long is that they've been told to do things in a certain way and it's been passed down from one staff memember to the next.

Once somneone has been trained to do things one way they just keep going.

 

I do think Sims needs a re-think. It seems to constantly just have little bits and updates added here and there. There is always an issue somewhere.

 

It could do with a complete makover, leaving older things behind and bringing newer needed features to the table.

[mavhc]

But then there'd be 0 reasons to use it rather than 1

 

Given that the connection to the SQL server is encrypted, and who's leaving backups lying around, not a terrible issue anyway. If you have access to the sql server you can do way more interesting things.

 

What's more fun is password swapping, copy your encrypted password to another user, log is as them, copy it back later, as there's no salt

[FN-GM]

I am happy to see there there isn’t a prejudice against the OP age.

[paulkerton]

To answer it quickly

1. No, not really.

2. Because there is a level of fear of change when it comes to some (not all) schools.

Things are changing in the age of MATs, but there is a level of comfort in relying on the same local authority support organisations and the same software solutions rather than trying to do anything truly innovative and seeing change as a positive thing.

 

Its the same reason why a lot of people reach for Microsoft Publisher as their software of choice still. This is one reason why schools are stuck with Windows 10 and Office 2017 still - SIMS domination of the market and lack of support for Windows 11 and Office 365. It holds schools back.

Edited July 8, 2022 by paulkerton

[Banjo]

I've read and marked many 15 year old's work. This isn't it !

 

My guess, a disgruntled ex Capita employee...

[paulkerton]

I've read and marked many 15 year old's work. This isn't it !

Definitely not, but I still don't mind answering.