I should immediately make myself clear that I'm not a sysadmin or anything, I'm just a 15 year-old student, wanting to get some insight into the usage of SIMS nowadays, and I'm seriously questioning the security of SIMS. I should also make clear that I don't have any malicious intent, this post is more for a small independent research project that I'm doing. Maybe this isn't the right place to post this, but I'm hoping I can still get some insight.
In regards to SIMS' security, this is about how SIMS handles user authentication.
SIMS handles credentials through SQL Server users with usernames prefixed with 'sims_', and the password of the user is run through an encryption algorithm that's specific to SIMS. The SIMS .net client also has an implementation of this encryption too as the password is encrypted before it is sent over the network. So, this sounds all good, right?
The standard practice for storing user passwords in a database is typically to run it through a hashing algorithm, but SIMS uses encryption. That by itself would not be an issue if it wasn't for the fact that the encryption is reversible. With SIMS' encryption, the security aspect comes purely from the fact that the encryption algorithm is proprietary and completely unknown. However, keep in mind that the database client has the code for the encryption function too. SIMS .net's code is not obfuscated in any way, and so the reversible encryption algorithm can be very easily obtained.
This is a problem for a few reasons. For one, teacher passwords can be obtained by traffic interception, as SIMS communicates with the database server over a plain connection. The encrypted password is sent, but with the encryption algorithm, you can decrypt the password, and obtain a teacher's password. Even worse, the chances of them reusing that password for other accounts (such as their AD login) would be pretty high.
Another problem is that if someone has a copy of a SIMS database backup (sysadmins, encrypt your database backups!!!), you can gain access to other teacher's accounts, and obtain access to a school's live database. In a database table, every user account created is listed with a column that stores the encrypted password generated when the account is first created. The good thing is that it only stores the generated password, so for the most part the password would be completely void as SIMS prompts a password change on first login. The bad thing is that there could be many accounts which have never been logged into, and thus the generated passwords are still valid for those accounts. Ideally, SIMS should really not be storing generated passwords in the first place. It should just show you the password one time after account creation, and that's it.
Also, did you know SIMS passwords are not case sensitive, despite the login prompt warning you about case sensitivity? I'm definitely not the only one here to notice!
I understand that this is probably more out of necessity as SIMS .net has to retain compatibility with older software like Nova-T, but by retaining legacy compatibility, some security ends up having to be sacrificed. Also, should software as old as Nova-T that dates back to the 1990s still be in use?
The point I've been building up to with all of this is that SIMS doesn't really seem to be a great choice for modern use. It may have worked well back in the 90s and 2000s, but it really has not aged all that well. It's old, bloated, insecure, and slow. And I hope everything I've been talking about here helps to demonstrate its age and concerns over security. I see many alternative MIS systems being advertised here, yet many schools stick to SIMS. Many of the posts here are about SIMS. I'm also asking about the security aspect as I'm wondering if this is that big of an issue, having seen nobody talk about it before. The age of the software and the security concerns is a bit of an eye-opener for me personally given how SIMS is considered to be professional software, especially given its widespread use in schools. You could say that I'm worrying too much about the security and that I'm making a big deal over nothing, but it concerns me given how much sensitive information a system like SIMS holds.
So, what's with so many schools still using SIMS? And do any of the concerns I've expressed present a security issue?
