'hacker' thread on uk.education.schools.it

[CyberNerd]

http://groups.google.com/group/uk.education.schools-it/browse_thread/thread/088f099d5de1c11f/932ec3d3a6c3243e#932ec3d3a6c3243e

 

OMFG ! This is truely the most batty thing I've heared of.

[bossman]

You can say that again. But can't help feelin sorry for the guy if it is true what he is sayin? Seemas like one big mess. I do know of schools where they have little if no security whatsoever. This is one for the local authority to work out good luck to them.

[indie]

Interesting, I believe the school are also breaking the Data Protection Act by placing those files online for anyone to download.

[Gatt]

Just looked at the website's front page - is it me or does this site seem to function as both its INTRAnet and its INTERnet site?

 

Having a menu labelled "Student Data" where u can choose to look at info such as their behaviour availble on the Internet is shocking - that should not be there - for any reasons!

[indie]

Exactly, I'm on the verge or ringing the school to tell them they're breaking the DP act, I've already spoken to someone at the information Commissioners office about it.

[indie]

Heh, looks like the site is now offline

[petectid]

The server is a Frogteacher box this supplies web services with access to the school network mapping the users home folder in Active directory so that it can be accessed from any Internet connected PC via Internet Explorer (Home School links). One issue that I am aware of is that Google indexes pages that you may not wish the public to view. This post on Google outlines a "Google hack” the search string used is in the first post. If one of the pages indexed has search facilities for the MySQL database the users can be listed, as with any other data stored there. I suspect this is where the person has fallen foul; they have found one of these links in google and exploited it.

[woody]

Wow this is the school I went to when I was a lad! I can't beleive they've been so stupid? Does anyone know who their Network manager/It technician is? It would be interesting to hear their take on this.

[Gatt]

@woody: Normally i'd say "Check their website".. but in this instance that may not be the best thing to do - lol!

[Ric_]

@woody: Normally i'd say "Check their website".. but in this instance that may not be the best thing to do - lol!

 

Job Centre might be a better bet

[GrumbleDook]

The problem seems to be that the authentication for the session is based in the id string for the page ... if the account that that session had been used had had it's account locked then you would not be able to access it.

 

It is a common problem with systems that keep authentication shells of any sort for more that a few hours without being cookie based, or similar (integrated windows authentication as an example of not needing to authenticate repeatedly).

 

The actions of the school were over the top ... the attitude of the student was over the top ... a friendly word from the student to the NM would have sorted this out long since.

[e_g_r]

Why blame the NM? I'm sure at Hathershaw they have some bigwig in charge of this thing, not your put upon NM.

[Geoff]

I have already made my views known in the newsgroup thread in question.

[Ric_]

Why blame the NM? I'm sure at Hathershaw they have some bigwig in charge of this thing, not your put upon NM.

 

To be fair... these systems tend to be thrust upon the NM (if they are kept in the loop at all). It will make other users of the froggy system (or whatever it's called) sit up and take a good look at their setups. The producers of the system wil also be a little embarrassed I imagine.

[GrumbleDook]

I have to admit to having lost any sympathy with the student now ... he has registered a similar domain (top search in google) and posted a site outlining it all ... does he not know how stupid and damaging to his case this might be?

 

He hasn't responded on the thread at all on the newsgroup but I have tried contacting the school (the site is now down so they may be aware) but without success.

[kingswood]

I know of Google hacks that will let you do this regularly. But I think there are issues on both sides of the fence with this one. Blaming some *one* isn't going to fix the problem. How long do we think it would take someone with more savvy than this accidental cracker to actually damage school web pages that contain this kind of information now? Not long at all. It will be seen as a cracker's challenge now.

 

These people have no real ethics or morals and take pride in themselves when they write little scripts that deface web pages, get passwords or whatever. It's like a game of Project Gotham- they get lots of "Kudos" points among their peers.

 

Watch your web sites now people....

[woody]

I really can't see why schools need to put very sensitive data on their websites such as medical history and the likes. Who needs to access that from home? Even names and addresses are risky. Shure, there is lots of sensitive info going around on the web. I use internet banking with the HSBC although I'm considering giving up the conveniences of THAT: http://www.theregister.co.uk/2006/08/10/flaw_hsbc/

 

But when dealing with sensitive information about children, you have to ask whether you really need to publish that on a website, no matter how tight security is. Just keep it on the MIS in school. Maybe allow access through VPN where you can keep tight controll of who has access and when.

[limbo]

There is more and more pressure from the government to put information about students online for parents to view - hence the instruction we have to have VLE's MLE's and online portfolio's over the next couple of years.

 

This is only the start of this kind of story, and it can never be stopped completely because even the most secure system has one weekness - the users and their ability to either maintain a secure password or keep their password confidential.

 

There is a school in Birmingham that has opened up Facilities e-portal system to parents allowing them to view their child's attendance, results etc. They are being hailed as a great success by the LEA but whn I asked them at a conference how they managed to organise getting the usernames and passwords to parents securely (every method we had thought of had a possible flaw) they said that parents just had to go to the website, put in their name, their childs name and form and an e-mail address and they would then be e-mailed the username and password.

 

As I expressed to them, my concern with this is that it is not that difficult for someone to gather this information - especailly for a child in the same class but they, nor the LEA, seem to share this concern and they continue to be put forward as a leading light.

[woody]

But you can limit the type of information you do put on there. For instance, attaching attendance data and maybe assessment data to a name is not as bad as attaching personal data like addresses, telephone numbers, DOB, medical history, family history, family links etc.

 

As far as sending usernames and passwords out is concerned, what about the good old fashioned way of posting them in sealed envelopes once an account has been requested? You do have the issue however, of how protective the parent is with those account details. You would think if they cared for there child's welfare they would keep them secret.

[limbo]

I believe in this case the school is not restricting the information, but I think even attendance and particularly assessment data should be just as confidential.

 

We did think about sending information out by post - but we have settled upon giving them out to parents at parents evenings face to face - that way we know the parents are getting their hands on them, after that it is their responsibility.

[GrumbleDook]

Just spoken on the phone to one of the techies.

 

The issue is with Frogteacher and how it holds authenticated sessions open. That section of their site is being locked down again as we speak and Frogteacher are working with them on this. Sensitive information is removed for the time being. The school is also in regular contact with the police about the ongoing investigation (including the new website the OP has setup).

 

The school could only give limited information about the issue for legal reasons but I can honestly say that it appears that the school has put sensitive information on a secure area of their website in good faith that it is secure and that the issue is with how Frogteacher holds sessions open. That is being worked on. They are aware of issues with DPA (hence why sesnitive information is removed until it is secure again).

 

The *former* student continues to post information about this security breach (in a bragging manner) in spite of being asked not to ... and the ongoing police investigation means that no more can be done other than that.

 

If you do use Frogteacher at your school please contact them about this flaw and check whether your site is vunerable. If you do hold sensitive information on there, they may advise you to remove it until you can be sure your information is secure. The basis of this flaw is authentication based and appears to require access to a staff password or be on a machine recently used by a staff account that still holds information in its history.

 

HTH

 

HAND

[petectid]

Just spoken on the phone to one of the techies.

 

The issue is with Frogteacher and how it holds authenticated sessions open. That section of their site is being locked down again as we speak and Frogteacher are working with them on this. Sensitive information is removed for the time being. The school is also in regular contact with the police about the ongoing investigation (including the new website the OP has setup).

 

The school could only give limited information about the issue for legal reasons but I can honestly say that it appears that the school has put sensitive information on a secure area of their website in good faith that it is secure and that the issue is with how Frogteacher holds sessions open. That is being worked on. They are aware of issues with DPA (hence why sesnitive information is removed until it is secure again).

 

The *former* student continues to post information about this security breach (in a bragging manner) in spite of being asked not to ... and the ongoing police investigation means that no more can be done other than that.

 

If you do use Frogteacher at your school please contact them about this flaw and check whether your site is vunerable. If you do hold sensitive information on there, they may advise you to remove it until you can be sure your information is secure. The basis of this flaw is authentication based and appears to require access to a staff password or be on a machine recently used by a staff account that still holds information in its history.

 

HTH

 

HAND

 

I believe the issue is with poor configuration of file and directory permissions this enables the google bots to index those pages. I will speak with frog about the open session issues but you will find pages on google that were indexed months ago. Would any developer code their software so that sessions were open indefinitely? And in many cases you do not need passwords to access information that would be deemed as sensitive. I brought this issue to the attention of Frog six months ago. As for the bases of the flaw mentioned in your last para, you will find that these sites are accessable from any internet connected PC.

[bossman]

Well all i can say is that the OP needs a good lesson in manners. So he thinks he is clever bragging about it. Hope he gets some form of juvenile punishment like a swift kick in the b*lls. The LEA should also shoulder some of the blame as they must have approved of this software. My apologies if they didn't. I know up here in Durham that the LEA has washed it's hands of DP within secondary schools and made it the schools responsibility which ultimately comes down to me. So i have drawn up a legal document which the school governors are looking at and then hopefully they will endorse it. This means if any member of staff leaves a workstation and remains logged on with no locks set then they will be held totally responsible and it could be used against them in a court of law and it will go down the disciplinary route as well. So keeping my fingers crossed that this will indeed be endorsed.

[woody]

I think that schools have been lax when it comes to security because they have got away with it for so long internally. Now they have started to put things online, you can't get away with it anymore. Granted in this case it looks like a lot of the blame goes to writers of Frogteacher.

 

But for instance, for how long has SIMS used the word 'password' as a system password. I'll tell you how long. Right up to NOW!

 

I had a problem re-installing FMS the other day and I don't normally get involved in Finance. Usually the local SIMS team come in and do the updates. But I had to ring the help desk (which is now a central one) and because I didn't know an administrator password for FMS, they asked me to log in as the default. What was it? Well, I won't say what here as it's publically assessible, but if you know much about SIMS, you probably won't have a hard time guessing.

 

Logging on in this way, I had access to ALL of FMS and now I wonder how many other schools have this log on account on their system. Probably most if like me the Network Manager hasn't been involved in FMS. Safe to say I have changed it now. But you might want to check yours if you're not shure!

 

My point is though, schools have always been lax with system security and it is only with the advent of system administrators and IT technicians that this has begun to change.

[AMcG]

My school has just bought FROG and I expect I will become responsible for security. What I have read above worries me more than a little. I am a UNIX and Internet security novice so I have no clear idea what the various comments about shells, sessions, google hacks and authentication mean. So I have just purchaseed 'Practical UNIX and Internet Security.'' Can anyone point me towards a fuller explanantion of what is going on here? If I talk to FROG about this what questions should I be asking? Is tbere any way I can test myself whether our system is vulnerable in the same ay as Hathershaw? I would be very grateful for any relevent comments or advice.