15 ms·
Berkeley HS student tried to rig his own election, exposing cybersecurity flaws
- bowmessage 8y agoMy HS used birthdate as account password, for both students and teachers, with no option to change! I hope they've updated since.
- mfoy_ 8y agoMy bank only allows for up to 6 alphanumeric (no special!) characters. https://www.bmo.com/olbb/help-centre/en/my-profile/change-password.html https://www.bmo.com/olbb/help-centre/en/my-profile/change-pa...
- b_tterc_p 8y agoI believe this is because you may be required to enter it on a phone using the dial pad. This also means it’s secretly just 6 single digit numbers.
- walrus01 8y ago5 bucks says that's because it's stored in plaintext, no crypto, no hash, no salt, in some gargantuan ancient mainframe system database. https://www.theglobeandmail.com/technology/digital-culture/why-canadas-banks-have-weaker-passwords-than-twitter-or-google/article18325257/ https://www.theglobeandmail.com/technology/digital-culture/w...
- cperciva 8y agoYou'd lose your $5. BMO's online banking system is an outgrowth of their telephone banking system, which used 4-6 digit PINs. (Thankfully not the same PINs as used with their bank cards though! Or rather, each card had two PINs, one for use as a card and one for use with telephone/internet banking.) I'm sure they're all stored in plaintext in an ancient mainframe system, but that's not the reason for the odd requirement.
- Scooty 8y agoWhy is this such a common thing? Just about every bank I've used has had one of these issues on their website: - Password can't be long - Password can't be pasted - Password must contain symbols - Password can't contain symbols I even locked myself out of my credit card (AMEX) account 3 times in less than 2 days because they have multiple different password reset forms, but one of them doesn't enforce their password length limit, so I successfully set my password to a password that was too long for the web/mobile login forms.
- ska 8y agoWhy is this such a common thing? Short answer I suspect is old systems with complicated dependencies.
- lwansbrough 8y agoEven so, you could hash the password somehow in order to produce the number, which then goes into that old system.
- ska 8y agoThere are always engineering solutions to such things, but I don't think most of the decisions are made in terms of "it's possible". There is always a risk/reward conversation, and a lot of conservatism in systems currently processing a large number of transaction and/or $ successfully. Perceived risk may or may not be analyzed correctly, mind.
- mavhc 8y agoYou'd think when they have all the money the risk would be really high
- tuzakey 8y agoIn my experience with banks that did this it was to allow a mapping to 10digit keypads for bank by phone access. I haven't tried it recently, and they allow complex passwords now. When I noticed this several years ago I was able to log into my bank account via the website with the 10digit equivalent password. At least your bank balance is insured...
- cabaalis 8y agoMicrosoft will not let me go past 16 on my O365 email. Msft employees: change this!
- aczerepinski 8y agoaol.com also requires super short passwords
- Humdeee 8y agoThis was changed actually. You can change your password to something more secure now. The help files appear to not have been updated.
- Scoundreller 8y agoCorrect. It should be pointed out that the old passwords were all 6 numbers. Any alpha characters would be converted to a number through a simple map.
- cperciva 8y agoBMO changed that a few weeks ago! I guess their website hasn't been fully updated yet.
- Someone1234 8y ago> “It just shows that people don’t make healthy cybersecurity decisions,” said Stern. You mean like the administrators of the school? You can set a temp password to immediately expire. What's notable is that even after this incident they still didn't do so, just encouraged students to change the default password during orientation.
- OliverJones 8y agoIndeed. An immediately expiring temp password is the usual workflow for new private-labeled Google accounts. I suppose, though, that somebody thinks middle schoolers can't handle it.
- thaumasiotes 8y ago> Students were casting ranked-choice ballots via a Google Form accessed through district-provided Gmail accounts > The investigators were also able to determine that the false votes were cast from a computer I bet the real votes were cast from a computer too.
- RandomBacon 8y agoAh, computerized highschool class elections. I could have rigged the vote to win at my school too, except that I wasn't in the right cliques. It would have been very suspicious if I won, and everyone knew I was "good with computers". Our program actually saved who voted for who in plaintext. At least I got to see who voted for me.
- veryworried 8y agoIn a situation like this the best action is to install a puppet who you can blackmail. Then use them to push policies you find favorable to you.
- AnimalMuppet 8y agoI don't think student governments get to push policies that can actually help students very much. I don't think school administrations let the student government have any real control whatsoever.
- InitialLastName 8y agoIt's a puppet puppet. IIRC, my high school government was very effective at choosing the prom theme and lobbying for a specific brand of crackers in one of the vending machines.
- nathancahill 8y agoThe illusion of government power starts young.
- erobbins 8y agoGovernment seems pretty powerful. I mean, there's one guy elected by 213k people blocking the entire congress from passing any bills.
- 8y ago
- nkrisc 8y agoThe perpetrators should be punished by being made to give a presentation on how they automated the process, what poor security practices allowed them to pull it off, and recommendations for preventing a similar incident in the future.
- tickthokk 8y agoI was suspended in high school for "hacking"; this was in 2000. I added two (crudely named) folders to an old DOS style typing teaching software. My presentation would have just been "I pressed F10, and typed in bad words", but it would have been preferable to a three day suspension, haha. I hope this is the outcome!
- Waterluvian 8y agoAhh those were the days. I once sent a WinPopup message to every computer in the school board. So thousands probably. As an idiot I used my account and immediately got suspended.
- deleted 8y ago[deleted]
- MikeCoats 8y agoYup, I did the same. A contractor replaced all our Classic Macs with Windows 9x boxes and never taught any of the staff how to secure them. We were using winpopup to send messages to each other, when I worked out how to send them to the entire subnet (or domain - I forget). Three months later I was hauled in front of the Deputy Rector to explain how I managed to 'write my name' on the admin office server. It turned out that they never turned on the monitor connected to the print server until the printer stopped working and they jumped to blaming me. It took some really fast thinking to wriggle out of that one - I was warned 'he'd be watching me' from then on though.
- dmix 8y agoSo you wrote your name on a Winpopup that you sent out to the entire subnet? That's just asking to be punished lol
- dontbenebby 8y agoSo default password was student ID? Who wants to bet there was a list of names and student IDs available somewhere that made this trivial to automate? (Or they were sequential with blocks for each class)
- hbosch 8y agoOr more simply, what pattern do student IDs conform to? I’d be absolutely shocked if they were randomized.
- dontbenebby 8y agoI wish there was a name for this kind of thing, because I see it a lot. Something is used a username in one context, then a password/authentication token in another. (Ex: many libraries use your barcode number as your username) I suspect the mistake stems from not understanding how passwords are stored. (Eg: while yes, well set up systems hash passwords, usernames or any other identifier paired w the password are in cleartext, and in many cases huge swathes of the userbase can access them)
- ryanmjacobs 8y agoA bit late, but in my high school, we realized that our student IDs were chunked by which feeder middle school we came from. This was after we scraped the entire ID->Name mapping database. For example, 7500-7600 was Middle School "A"; 7600-7700 was Middle School "B" and so forth. Within those chunks, we couldn't really discern an order, alphabetical or otherwise.
- mountainofdeath 8y agoI did something very similar to this for my high school's prom queen vote who I wanted to win for teenager reasons. The voting system was just a bunch of laptops in front of the lunch room running a web app and all that was needed to vote was to know a student id. A few hours and some javascript later, I voted more than the entire senior class. It was only discovered after the event.
- dustindiamond 8y agoAmanda?
- OliverJones 8y agoInternet voting. What could go wrong? In my opinion these two have done us all a service by showing what could go wrong.
- anbop 8y agoLOL. Reminds me of LBJ’s Senate election in 1948.
- stcredzero 8y ago“When we spotted it, it was incredibly obvious,” said Stern, 17. “There were just massive alphabetical votes at random hours.” Reminds me of an interview question: How would you do a reasonably good job of randomizing an incoming stream of items, while minimizing auxiliary storage?
- greiskul 8y agoNever heard of this question, how do you do that? Do you mean getting a random sample from an incoming stream, using only O(1) space?
- stcredzero 8y agoI'm thinking of randomizing the entire stream, and getting something that looks "reasonably random" to casual inspection by human beings, using only O(1) space.
- DuskStar 8y agoIt's easy if you don't need exact results! For instance if you want 1/2 votes for A, 1/3 for B and 1/6 for C, well you roll a die and vote A for 1-3, B for 4-5 and C for 6 - do this enough times and it'll approximate that distribution! Things only get difficult if you need exact results OR start doing things to make it "look" random - breaking up long runs of one vote, that sort of thing. (which of course makes it look distinctly nonrandom to someone with a stats background)
- stcredzero 8y agoIt's easy if you don't need exact results!\ I didn't mean randomizing the votes. Perhaps I should have written "shuffling." I meant randomizing the order of the stream.
- willbw 8y agohmm you can randomise the time at which you next put something into the stream right? I am thinking you can sleep() until the next time, just by doing rand() * someMultiplier * aSecond
- MagicPropmaker 8y agoHe didn't expose flaws. They caught him.
- will_pseudonym 8y agoThe flaws exposed were of general cybersecurity--they had default passwords comprised of a static string for every student + their student ID, and did not require students to change that default password immediately upon first login. "If a student does not change the default password, “anyone with access to your student ID number will be able to access and delete your emails, schoolwork, personal documents and anything stored on your Google Drive,” Stern wrote in his message to the student body."
- jlrubin 8y agoI'm glad to see that it seems the student in question was afforded a measure of process and admitted guilt -- I could easily see the story ending where the weaker opponent casts fake votes for their competition to get them eliminated!
- zaroth 8y agoBesides the fact that this "online voting" was immediately hacked, I wasn't fond of the notion that the votes had everyone's name attached.
- aiddun 8y agoI'm pretty sure Google Forms allows for you to require a Google or even a specific Google enterprise/education account and then limit that account to a one time use of the form. Don't know why they couldn't just do that.
- ryanmjacobs 8y agoGosh, I did this back in my high school as a Senior, two years ago. Got myself suspended for two days and ruined my perfect attendance, oh well. It scared the shit out of me when two police officers barged into my U.S. History class and pulled me out. The usernames of our voting system were our 5 digit student IDs. And the passwords... same as the usernames. I wrote a puppeteer script that looped through 2000 IDs and voted for everyone. They tracked me down through my home IP address -- if there is a next time, I'll definitely use Tor haha. EDIT: Yeah, the school's VP picked up on it because normally about 40% of the student body actually votes -- but this time it was 100%; plus when student's started signing into their voting accounts, it claimed they already voted. Not my brightest moment.
- ggm 8y agoThe number of responses which go to "...I did this too" are fascinating. I also did stupid things in my past which nowadays would incur severe penalty, as hacking. They felt mild right up to the point I was caught (this is 35 years ago) and then they stopped feeling mild very quickly. I feel very sorry for people in todays world who don't get the "everybody gets one free pass" on these things we did back in the day. I think we need a clear statute of limitations on some stuff done by minors and near-minors, regarding their future lives. Nobody is going to be eligible for election to senate or the law courts, or to work in federal or state bodies if we don't work out how to deal with this kind of thing. That said, I am pretty sure rigging an election is a good indication you have need of some ethics. Amusing, but also not a good idea. This ranks (in my books) with the recurring "we thought we'd make a film about a bank robbery without informing the bank or the shopping mall about it" type cock-up: Actions have (unforseen) consequences.
- dangrover 8y ago> Schweng said the culture around this election, from the outset, was different than what she’d seen in the past. There were more reports of students taking down candidates’ posters, and more activity on social media. Some students suggested to the principal that the stakes felt higher because colleges are becoming increasingly more selective, and extracurriculars like student government are consequently more important. This part was the most interesting revelation in the article to me! It never would have occurred to me as a HS student to "cheat on extracurriculars"! I just did the stuff that was interesting.
- bhsalumni123 8y agoNowhere in the article is it mentioned where the student gained access to a mapping of student IDs to student first and last names. As a recent BHS alumni, these ID numbers are not obviously derivable from a student's name (but I do think they are allocated sequentially). Getting access to this list implies some sort of social engineering or threat vector elsewhere.
- QuamStiver 8y agoThis kid is going to be fighting off job offers.