5 ms·
When I was a junior, I mentioned to my housemate that I had forgot my Blackboard password. "It's just your birthday" he said, and I looked at him shocked. 30 M
by tomatohs 7y ago
When I was a junior, I mentioned to my housemate that I had forgot my Blackboard password. "It's just your birthday" he said, and I looked at him shocked.
30 Minutes later I was in my professor's account. Their birthday month and day were public on Facebook, so it was only a matter of guessing their age.
I reported this to our IT department and they were not pleased. They let me know they had the power to expel me but wouldn't.
A week later, I found another exploit. I think blackboard group chat allowed JS execution outright. I redirected the class to "disney.com" but never disclosed it to IT because of the earlier threats.
- XIVMagnus 7y agoI have and forever will find it extremely stupid to threaten someone with expelling them for trying to HELP you do your job.
- coolsunglasses 7y agoI got in-school suspension for the last 1/3 of senior year in HS because I took screenshots of a shared network directory permissions problem.
- TeMPOraL 7y agoMe too, but unfortunately it's standard idiocy both in schools and in large companies. Whether you're a curious student or a white-hat pentester, it's still the case that if you find something and say something, you're treated as if you were the danger.
- danesparza 7y agoSchool (the institution) is not about learning. School (the institution) is about conformity. And finding exploits is anything BUT conformity.
- packet_nerd 7y agoIt should be about learning. I think finding exploits should be encouraged and rewarded.
- danesparza 7y agoAgreed.
- emilfihlman 7y agoPerhaps in some places, but not everywhere.
- AnIdiotOnTheNet 7y agoHaving worked for a public school district, it is my experience that things almost never go down as parent said. What actually happens is that they get caught and make an excuse (I was about to report it!) or their "report" of the problem is in the form of some leet-speak shit-talk on a public message board. A common theme you'll notice when people describe these events, even from their own perspective, is how they absolutely did change something, deface the page, etc.
- deleted 7y ago[deleted]
- maaaats 7y agoWe used It's Learning in "high school". It had login without https at the time, and on the school wifi it was then easy to listen and get other's credentials. Some people got hold of some teachers' credentials, and tried to remove or alter some minuscule data. One guy however, decided to sell grade-editing as a service to others. Of course it was noticed by the school, and it became a big deal with police involved and everything. Happy ending, though, the two people I know that was involved got master's in compsci a few years later.
- perryprog 7y agoMust've been fixed. My school used It's Learning for a while until this year, and it was fairly secure. HSTS of course.
- maaaats 7y agoYes, this was 10 years ago. I may even misremember, maybe it was a unsecured single sign on in front or something where the fault actually was.
- food_eater 7y agoDid this happen to go down in Florida?
- keanebean86 7y agoYou're way cooler than me. I just injected rainbow css banners into my BB posts. I was too scared to try anything else.
- jschwartzi 7y agoI like this so much better because it beautifully demonstrates the problem without cluing anyone else in that there is an exploit unless they care to look at how you're injecting the rainbow CSS banner. And if anyone tells you to stop doing it you can just explain that you thought it was an intentional feature that just wasn't very well documented.
- Ididntdothis 7y ago“I reported this to our IT department and they were not pleased. They let me know they had the power to expel me but wouldn't.” This response is grounds for immediate dismissal of the IT person in my view.
- AnIdiotOnTheNet 7y agoBy parent's own admission they actually did break into their professor's account. The fact that they reported it did not exonerate them from that act, but did at least get them off with a warning.
- Ididntdothis 7y agoThe first response should be to be horrified about their own system and fix it quickly. Such a simple hack shouldn’t be possible.
- AnIdiotOnTheNet 7y agoFor the most part people in IT departments aren't stupid, they know precisely how crap the software they're stuck using is, they just don't have any real input on the decision process. Blackboard, for instance, is notoriously awful but is everywhere in schools. This often applies to policies as well, unfortunately.
- Ididntdothis 7y agoI agree but they still. shouldn’t threaten people who show these hacks with expulsion. The real bad guys will do their thing without telling anybody and you can assume that this is going on
- protomyth 7y agoTrue, but it is nice to have some customer (student) verification of how crappy it is. It helps with future negotiations. Plus, wanting students to trust the IT department is not their enemy is the basis of a good security experience when we notice something about a student's laptop or other device.