Feedly Archives - Page 7 of 9 - Caudill Miller

A Teen Hacker Found Bugs in School Software That Affects Millions originally published on Wired

A few short decades ago, the archetypal hacker was a bored teenager breaking into his school’s network to change grades, à la Ferris Bueller. So today, when cybersecurity has become the domain of state-sponsored spy agencies and multibillion dollar companies, it may be refreshing to know that the high school hacker lives on—as do the glaring vulnerabilities in school software.

At the Defcon hacker conference in Las Vegas today, 18-year-old Bill Demirkapi presented his findings from three years of after-school hacking that began when he was a high school freshman. Demirkapi would poke around the web interfaces of two common pieces of software, sold by tech firms Blackboard and Follett and used by his own school. In both cases, he found serious bugs that would allow a hacker to gain deep access to student data. In Blackboard’s case in particular, Demirkapi found 5 million vulnerable records for students and teachers, including student grades, immunization records, cafeteria balance, schedules, cryptographically hashed passwords, and photos.

Demirkapi points out that if he, then a bored 16-year-old motivated only by his own curiosity, could so easily access these corporate databases, his story doesn’t reflect well on the broader security of the companies holding millions of students’ personal information.”The access I had was pretty much anything the school had,” Demirkapi says. “The state of cybersecurity in education software is really bad, and not enough people are paying attention to it.”

5,000 Schools, 5 Million Records

Demirkapi found a series of common web bugs in Blackboard’s Community Engagement software and Follett’s Student Information System, including so-called SQL-injection and cross-site-scripting vulnerabilities. For Blackboard, those bugs ultimately allowed access to a database that contained 24 categories of data, everything from phone numbers to discipline records, bus routes, and attendance records—though not every school seemed to store data in every field. Only 34,000 of the records included immunization history, for instance. More than 5,000 schools appeared to be included in the data, with roughly 5 million individual records in total, including students, teachers, and other staff.

In Follett’s software, Demirkapi says he found bugs that would have given a hacker access to student data like grade point average, special education status, number of suspensions, and passwords. Unlike in Blackboard’s software, those passwords were stored unencrypted, in fully readable form. By the time Demirkapi had gained that level of access to Follett’s software, however, he was two years into his hacking escapades and slightly better informed about legal dangers like the Computer Fraud and Abuse Act, which forbids gaining unauthorized access to a company’s network. So while he says he checked the data about himself and a friend who gave him permission, to verify that the bugs led to access, he didn’t explore further or enumerate the total number of vulnerable records, as he had with Blackboard. “I was a little stupider in the 10th grade,” he says of his earlier explorations.

When WIRED reached out to Blackboard and Follett, Follett’s senior vice president of technology George Gatsis expressed his thanks to Demirkapi for helping the company identify its bugs, which he says were fixed by July of 2018. “We were happy to work with Bill and grateful he was wiling to work through those things with us,” Gatsis says. But Gatsis also claimed that even with the security flaws he exploited, Demirkapi could never have accessed Follett data other than his own. Demirkapi counters that he “100 percent had access to other people’s data,” and says he even showed Follett’s engineers the password of the friend who had let him access his information.

Blackboard also thanked Demirkapi, but argued that based on its analysis no one else had accessed those records through the vulnerability he exposed. “We commend Bill Demirkapi for bringing these vulnerabilities to our attention and for striving to be part of a solution to improve our products’ security and protect our client’s personal information,” reads a statement from a Blackboard spokesperson. “We have addressed several issues that were brought to our attention by Mr. Demirkapi and have no indication that these vulnerabilities were exploited or that any clients’ personal information was accessed by Mr. Demirkapi or any other unauthorized party.

Advanced Persistent Teen

Demirkapi says he started digging up the two companies’ security flaws out of a combination of teenage boredom and an ambition to learn more about cybersecurity and web-based hacking. “I have a passion to, I guess, break things,” Demirkapi says. “I really wanted to learn about web application testing, so I thought, well, how cool would it be to test on my own school’s grading system?”

Demirkapi notes that, unlike Ferris Bueller, he never actually tried to change students’ grades. which would have required a deeper level of access to Blackboard’s network. He did, in a separate incident, exploit flaws in a college admission software to change his admission status to “accepted” in the database of Worcester Polytechnic Institute, a college he had applied to. A spokesperson for the college said that change alone wouldn’t have been enough to admit him.

“These companies say they’re secure, that they do audits, but don’t take the necessary steps to protect themselves from threats.”

Teen Hacker Bill Demirkapi

After Demirkapi began to find bugs in Blackboard and Follett’s software, he says he struggled to get the companies to take him seriously. In the winter of 2016, he initially tried to contact Follett by asking his school’s director of technology to contact the company on his behalf. But as Demirkapi remembers it, she told him the company had dismissed his concerns. He says he later sent messages himself to Blackboard and Follett via email and Follette’s contact page. Blackboard initially thanked him for his note and said it would investigate, but didn’t follow up. Follett ignored him altogether.

So a few months later, Demirkapi took a more typical approach for a juvenile hacker. Among Follett’s bugs, he found that could add a “group resource” to his school’s account, a file that would be available to all users and, more importantly for Demirkapi, that would trigger a push notification with the resource’s name to everyone in his school district who had Follett’s Aspen app installed. Demirkapi sent a message reading “Hello from Bill Demirkapi :)” out to thousands of parents, teachers, and students.

That stunt got him suspended from school for two days. “It was really immature of me to do that, but I didn’t know any other way to get in touch with a company that wasn’t open to contact,” Demirkapi says.

If It Weren’t for That Meddling Kid

Over the course 2018, after Demirkapi enlisted the help of his school district’s director of technology and Carnegie Mellon’s CERT Coordination Center, he says the companies finally began to listen. With Blackboard, whose sensitive data he had accessed in the process of testing the software’s security, he worked out a contract that stated the company wouldn’t sue him, and in return he’d keep the company’s vulnerabilities secret until they were fixed—after refusing an initial draft in which Blackboard tried to prevent him from telling anyone even after the patches went through.

Even now that both companies have fixed the software flaws Demirkapi found, he says that his work should worry anyone who cares about the security of student data. “It doesn’t seem like there’s any interest in this from the security field, because the incentives just aren’t very high,” he says, pointing out that neither Blackboard nor Follett has a bug bounty program for rewarding security researchers who find and their vulnerabilities. “These companies say they’re secure, that they do audits, but don’t take the necessary steps to protect themselves from threats.”

Some months after his Blackboard vulnerability disclosures, Demirkapi noticed that Blackboard had posted a job opening for a new chief information security officer. Demirkapi jokes that he briefly considered applying. Instead, he’s going to try college.

---

More Great WIRED Stories

Blackmagic announces Pocket Cinema Camera 6K originally published on The Verge

Blackmagic Design has revealed its latest compact camera for cinematography, the Pocket Cinema Camera 6K. It looks pretty similar to the 4K camera introduced last year, which is to say that it looks like a Minolta SLR from 1993, but it has a bigger sensor — it shoots in Super 35 format (similar to APS-C) with a resolution of 6144 x 3456.

Resolution aside, the switch to Super 35 will allow for much better low-light performance and control over depth of field. The 6K camera also uses Canon’s EF lens mount, rather than the 4K’s Micro Four Thirds, and Blackmagic is claiming 13 stops of dynamic range with dual native ISO of 400 and 25,600.

The Pocket Cinema Camera 6K has a lot of connectivity: mini XLR, full-size HDMI, USB-C, DC power, mic input, and headphone output. The camera is largely operated by the same five-inch touchscreen as the 4K model. It can shoot up to 50 fps at 6144 x 3456 16:9, 60 fps at 6144 x 2560 2.4:1, or 120 fps at 2.8K 2868 x 1512 17:9.

The Pocket Cinema Camera 6K is available right now, priced at $2,495 — almost twice as much as Blackmagic’s 4K model.

Who Owns Your Wireless Service? Crooks Do. originally published on Krebs on Security

Incessantly annoying and fraudulent robocalls. Corrupt wireless company employees taking hundreds of thousands of dollars in bribes to unlock and hijack mobile phone service. Wireless providers selling real-time customer location data, despite repeated promises to the contrary. A noticeable uptick in SIM-swapping attacks that lead to multi-million dollar cyberheists.

If you are somehow under the impression that you — the customer — are in control over the security, privacy and integrity of your mobile phone service, think again. And you’d be forgiven if you assumed the major wireless carriers or federal regulators had their hands firmly on the wheel.

No, a series of recent court cases and unfortunate developments highlight the sad reality that the wireless industry today has all but ceded control over this vital national resource to cybercriminals, scammers, corrupt employees and plain old corporate greed.

On Tuesday, Google announced that an unceasing deluge of automated robocalls had doomed a feature of its Google Voice service that sends transcripts of voicemails via text message.

Google said “certain carriers” are blocking the delivery of these messages because all too often the transcripts resulted from unsolicited robocalls, and that as a result the feature would be discontinued by Aug. 9. This is especially rich given that one big reason people use Google Voice in the first place is to screen unwanted communications from robocalls, mainly because the major wireless carriers have shown themselves incapable or else unwilling to do much to stem the tide of robocalls targeting their customers.

AT&T in particular has had a rough month. In July, the Electronic Frontier Foundation (EFF) filed a class action lawsuit on behalf of AT&T customers in California to stop the telecom giant and two data location aggregators from allowing numerous entities — including bounty hunters, car dealerships, landlords and stalkers — to access wireless customers’ real-time locations without authorization.

And on Monday, the U.S. Justice Department revealed that a Pakistani man was arrested and extradited to the United States to face charges of bribing numerous AT&T call-center employees to install malicious software and unauthorized hardware as part of a scheme to fraudulently unlock cell phones.

Ars Technica reports the scam resulted in millions of phones being removed from AT&T service and/or payment plans, and that the accused allegedly paid insiders hundreds of thousands of dollars to assist in the process.

We should all probably be thankful that the defendant in this case wasn’t using his considerable access to aid criminals who specialize in conducting unauthorized SIM swaps, an extraordinarily invasive form of fraud in which scammers bribe or trick employees at mobile phone stores into seizing control of the target’s phone number and diverting all texts and phone calls to the attacker’s mobile device.

Late last month, a federal judge in New York rejected a request by AT&T to dismiss a $224 million lawsuit over a SIM-swapping incident that led to $24 million in stolen cryptocurrency.

The defendant in that case, 21-year-old Manhattan resident Nicholas Truglia, is alleged to have stolen more than $80 million from victims of SIM swapping, but he is only one of many individuals involved in this incredibly easy, increasingly common and lucrative scheme. The plaintiff in that case alleges that he was SIM-swapped on two different occasions, both allegedly involving crooked or else clueless employees at AT&T wireless stores.

And let’s not forget about all the times various hackers figured out ways to remotely use a carrier’s own internal systems for looking up personal and account information on wireless subscribers.

So what the fresh hell is going on here? And is there any hope that lawmakers or regulators will do anything about these persistent problems? Gigi Sohn, a distinguished fellow at the Georgetown Institute for Technology Law and Policy, said the answer — at least in this administration — is probably a big “no.”

“The takeaway here is the complete and total abdication of any oversight of the mobile wireless industry,” Sohn told KrebsOnSecurity. “Our enforcement agencies aren’t doing anything on these topics right now, and we have a complete and total breakdown of oversight of these incredibly powerful and important companies.”

Aaron Mackey, a staff attorney at the EFF, said that on the location data-sharing issue, federal law already bars the wireless carriers from sharing this with third parties without the expressed consent of consumers.

“What we’ve seen is the Federal Communications Commission (FCC) is well aware of this ongoing behavior about location data sales,” Mackey said. “The FCC has said it’s under investigation, but there has been no public action taken yet and this has been going on for more than a year. The major wireless carriers are not only violating federal law, but they’re also putting people in harm’s way. There are countless stories of folks being able to pretend to be law enforcement and gaining access to information they can use to assault and harass people based on the carriers making location data available to a host of third parties.”

On the issue of illegal SIM swaps, Wired recently ran a column pointing to a solution that many carriers in Africa have implemented which makes it much more difficult for SIM swap thieves to ply their craft.

“The carrier would set up a system to let the bank query phone records for any recent SIM swaps associated with a bank account before they carried out a money transfer,” wrote Wired’s Andy Greenberg in April. “If a SIM swap had occurred in, say, the last two or three days, the transfer would be blocked. Because SIM swap victims can typically see within minutes that their phone has been disabled, that window of time let them report the crime before fraudsters could take advantage.”

So far, there is zero indication that the U.S.-based mobile carriers are paying any attention.

In terms of combating the deluge of robocalls, Sohn says we already have a workable approach to arresting these nuisance calls: It’s an authentication procedure known as “SHAKEN/STIR,” and it is premised on the idea that every phone has a certificate of authenticity attached to it that can be used to validate if the call is indeed originating from the number it appears to be calling from.

Under a SHAKEN/STIR regime, anyone who is spoofing their number (and most of these robocalls are spoofed to appear as though they come from a number that is in the same prefix as yours) gets automatically blocked.

Unfortunately, Sohn said, the FCC has allowed the wireless carriers to adopt this approach voluntarily. And — shocker — most of them haven’t, or else they are charging a premium for it.

“The FCC could make the carriers provide robocall apps for free to customers, but they’re not,” Sohn said. “The carriers instead are turning around and charging customers extra for this service. There was a fairly strong anti-robocalls bill that passed the House, but it’s now stuck in the legislative graveyard that is the Senate.”

What about the prospects of any kind of major overhaul to the privacy laws in this country that might give consumers more say over who can access their private data and what recourse they may have when companies entrusted with that information screw up?

Sohn said there are few signs that anyone in Congress is seriously championing consumer privacy as a major legislative issue. Most of the nascent efforts to bring privacy laws in the United States into the 21st Century she said are interminably bogged down on two sticky issues: Federal preemption of stronger state laws, and the ability of consumers to bring a private right of civil action in the courts against companies that violate those provisions.

“It’s way past time we had a federal privacy bill,” Sohn said. “Companies like Facebook and others are practically begging for some type of regulatory framework on consumer privacy, yet this congress can’t manage to put something together. To me it’s incredible we don’t even have a discussion draft yet. There’s not even a bill that’s being discussed and debated. That is really pitiful, and the closer we get to elections, the less likely it becomes because nobody wants to do anything that upsets their corporate contributions. And, frankly, that’s shameful.”

US Soccer must unbundle USWNT from MLS and SUM TV rights deal – World Soccer Talk originally published on ussoccer.com

US Soccer must unbundle USWNT from MLS and SUM TV rights deal  World Soccer Talk

In the wake of the US Women’s National Team (USWNT) FIFA Women’s World Cup triumph, much has been discussed in terms of equal pay for female players.

Atlanta United’s Martinez likely out vs NYCFC originally published on Atlanta United headlines

Atlanta United’s Josef Martinez sustained a Grade 2 adductor strain on Monday, which is why he missed Tuesday’s 2-0 win over Orlando in the semifinals of the U.S. Open Cup.

Atlanta United to play Minnesota United in U.S. Open Cup final originally published on Dirty South Soccer – All Posts

Brett Davis-USA TODAY Sports
The cup final matchup is set

After Atlanta United dispatched Orlando City 2-0 from the U.S. Open Cup in the first semi-final played Tuesday, Minnesota United punched its ticket the next night ewith a 2-1 win over the Portland Timbers.

Last month, Atlanta drew first priority to host the final if they were to get there, and indeed Mercedes-Benz Stadium will host its second cup final in as many years—albeit different cups. The U.S. Open Cup final will take place on August 27 at 8 p.m.

It’s an interesting matchup in that not only is it a rematch from a game earlier this season that Atlanta won 3-0, but it pits the two “Uniteds” that joined the league together against one another. Having experienced two very different paths to get to this point, the two clubs arrive in similarly upward trajectories. While Atlanta United was busy winning MLS Cup and nearly claiming a double with a Supporters Shield title, Minnesota were stuck in first gear—enduring a coaching change and personnel revamp. But the pivot worked, and now Minnesota are on the rise, currently placed second in the conference standings—just like Atlanta—and playing some fun, direct attacking soccer.

The Rundown: Creative agencies face a perfect storm originally published on Digiday

The shutdown of Barton F. Graf is yet another sign of the times for creative agencies. The shop, which was founded just under a decade ago, has been one of the darlings of the creative agency world. It will close its doors later this year. Founder Gerry Graf, speaking to Ad Age, said the closure was due to “a perfect storm.”

But that storm shouldn’t come as a surprise; it’s been brewing for a while. Barton F. Graf, like other agencies, was hit hard by the ongoing movement from clients towards more project-based work. That’s a tough pivot for agencies like this one, which was built on models that prized agency of record work.