Arbor Data Breach

[IrritableTech]

Yesterday Arbor acknowledged an issue we put forward to them where incorrect school login boxes were showing up. https://status.arbor-education.com/incidents/193419

 

However not only did we see evidence of this issue after they had announced it was resolved. We had reports that a member of our staff had been able to access another schools Arbor site. Today Arbor have confirmed (through our support partner) that this was a caching error which did allow users to see limited data from other schools...

 

There was a brief period yesterday, where the school URL was redirecting to the login page showing another school logo and sometimes, users were being prompted for 2FA when logging in when this is not normally used. This was happening for some users of the Arbor MIS, Student and Parent Portal.

 

Following the incident yesterday caused by a caching error, I want to confirm some next steps Arbor will be taking.

 

To confirm, there was no access to any other data that was not on the homepage of the school's Arbor site. This issue was caused by an internal release which incorrectly stored caching data and has now been resolved.

 

We are investigating the root cause, however, we believe that in some instances users were able to see some personally identifiable information and as a result, we have informed the ICO of the incident.

[supportman]

Sounds very minor...

[mbedford]

Sounds very minor...

 

They have said that in some cases users were able to see PII, but the line above seems to contradict that. With little additional context, I think that's pretty serious, it sounds like they are struggling to explain something a little more serious than what this message suggests.

Edited March 28, 2024 by mbedford

[dafad_dew]

Looks to me like a very very carefully worded statement...! Look away, there's nothing much to see!

 

"no access to any other data that was not on the homepage of the school's Arbor site."

so the seriousness depends on what gets displayed on a school's homepage. Hmmmm.....

 

The most worrying bit is that it was "caused by an internal release which incorrectly stored caching data".

An "internal release" should be totally isolated from live, customer sites, so the main explanations I can see are either:

- Their internal and live/production releases share components and/or data stores (Ouch!) and/or

- Their release process isn't robust (another Ouch!) and/or

- Their QA processes aren't robust (ditto)

or... it wasn't really an "internal release" and this is just a play on words

 

Wouldn't be surprised if this was down to a missing WHERE clause along the lines of WHERE School_ID = when getting data from the cache. Without it, it would show data previously cached for any school. And that's not a minor issue at all.

Edited March 28, 2024 by dafad_dew

[dmj]

Hmm, Caching issues, vague statements. Did they get bought by classcharts?

[mavhc]

Got to be careful with caching https://www.theverge.com/2024/2/19/24077233/wyze-security-camera-breach-13000-customers-events

[dafad_dew]

There are countless examples identifying "caching" as the problem, but caching is no more risky than any other data storage/retrieval. It's usually a step added on at the end to improve responsiveness or performance, and doesn't always go through the same rigorous tests.

 

One of the benefits of a cloud based system is (hopefully!) reduced infrastructure costs. But you only get that benefit with multiple schools sharing infrastructure - which may well include databases and web front-ends/servers. Almost every step has to to verify that data belongs to the same organisation as the person logged in. And if there's one tiny piece of code where that check is missing, you can get data for another school back.

Or data for every school!

 

This makes these systems much harder to test properly, and it's extremely easy to slip up, particularly when adding new features. Expect to see more of this kind of stuff.

This clamour for "cloud" MISs isn't always a good thing!

[sefton]

I had this issue on our MAT and school sites but when you actually logged in you were directed to the correct site, so all that was actually displayed was the name of the school and badge.

[Damon]

So what happened for parents and students when they logged in? Did they see any other data?

[PotNoodleTech]

Sounds like the classcharts data breech all over again. Edited April 10, 2024 by PotNoodleTech

[JamesWeatherill]

Hi everyone, I just thought I'd jump in and give a quick update before people draw the wrong conclusions.

 

We completed our investigation into the incident on the 27th March and confirmed that the only information incorrectly shared between schools was the school name and school logo, which is not personally identifiable information so no further action needs to be taken. I apologise for any undue alarm this has caused.

 

A separate issue for a small handful of schools meant there was the potential for information to be shared between authorised users within the school. These schools have been contacted directly just in case, and as data processors we reported it to the ICO for prudence.

[PotNoodleTech]

Hi everyone, I just thought I'd jump in and give a quick update before people draw the wrong conclusions.

 

We completed our investigation into the incident on the 27th March and confirmed that the only information incorrectly shared between schools was the school name and school logo, which is not personally identifiable information so no further action needs to be taken. I apologise for any undue alarm this has caused.

 

A separate issue for a small handful of schools meant there was the potential for information to be shared between authorised users within the school. These schools have been contacted directly just in case, and as data processors we reported it to the ICO for prudence.

 

It seems I drew the wrong conclusion.

 

Well done.