Tag Archive for Hack

| October 8, 2013
Comments Off on LA Schools iPads Hacked In A Week

LA Schools iPads Hacked In A Week

– UPDATE 08-28-2014 – Just in time for the start of School reports surface LAUSD is “re-opening” bids for its controversial billion-dollar contract with Apple and Pearson to give all students, teachers, and administrators iPads.

—

LA iPads Hacked In A WeekThe second-largest school district in the US is spending at least $1 Billion to complete a 1:1 tablet initiative. The Las Angles Unified School District (LAUSD) plans to deploy 650,000 Apple (AAPL) iPads, one for each student in LA county. The project slated to be completed by December 2014, has had problems that may prevent if from reaching that goal.

Las Angles Unified School DistrictThe project includes 500 million dollars for iPads and 500 million dollars for Wi-Fi and related infrastructure. The initiative is funded mostly by voter-approved school construction bonds, which taxpayers typically pay off over 25 years which the LA Times says “has sparked some concerns and legal and logistical hurdles.”  (rb- I first noted the project here)

The project has run into a series of issues. The first issue focused on the 25 year payback period on a $500.00 device. A second issue emerged in September 2013 when the district recognized that it may need to buy Bluetooth keyboards for the iPads. The LA Times estimated a bill of $38 million for the oversight. The LA Times reports that the included software keyboard on the iPad might not satisfy the needs of older students writing term papers.

650,000 Apple iPads,Also, LAUSD has planned to use the iPads for testing based on new Common Core English and math learning standards. The article contends that the iPad’s touch screen could frustrate students and even obscure portions of a test item that would be visible in its entirety on a full screen. (rb- I talked to many school districts about the SBAC keyboard testing issue, who is going to configure Bluetooth on and off? What about power? Does Bluetooth decrease the battery time on the iPad? Do you have enough electrical outlets to plug in 30 iPads? How is your Wi-Fi?)

In late September 2013, the LAUSD iPad project ran into a bigger problem as they deployed the iPads to high school students. According to the LA Times, it took exactly one week for nearly 300 students at Theodore Roosevelt High School to defeat the LAUSD installed device security. Following the news that students were using the hacked tablets for personal use, district officials halted home use of the Apple tablets until further notice.

Common Core English and math learning standards.Students told the LA Times once they had the iPad home they could not do anything with the $678 device. Apparently, the students began to tinker with the security lock on the tablets and soon discovered all they had to do was delete their personal profile information. With the profile deleted, a student was free to surf, tweet like, and stream music.

The new found freedom prompted L.A. Unified School District Police Chief Steven Zipperman to suggest that the district might want to delay the distribution of the devices. The chief said in a memo obtained by the LA Times, “I want to prevent a ‘runaway train‘ scenario when we may have the ability to put a hold on the roll-out.”

I want to prevent a 'runaway train' scenarioAccording to a March 2013 blog post from Roosevelt HS, LAUSD chose AirWatch as the provider for the mobile device management system. And that when students first get their iPads they will have AirWatch already installed. The district posted an update on their website that indicated they have turned to AirWatch and Apple for better solutions to their iPad problem.

rb-

This really is a story of mismanagement from the top down. A billion-dollar project for consumer devices financed over 25 years – Really? Are the students of LA’s class of 2038 going to have to use the iPad’s from 2013? Where is the refresh program? How are they getting the money to buy 650,000 iPad 9’s in 5 or 6 years?

If the iPads are to be used at home? how is LAUSD addressing the digital divide in LA?

Did the big-wigs consider the equity of using iPads for high-stakes nationwide common core testing? Not only will LA students be compared against each other and the rest of California but also students in 44 other states.  It is my understanding that the current SBAC test is not optimized to display well on small screens. Will the tablet form factor handicap LA students or others across the US using tablets when competing against others using large screens and real keyboards in ergonomically proper positions? Will LAUSD show the test takers how to see the entire question, or how to easily switch between back and forth between screens to review a passage and then write a response.

Call me cynical after working in K-12 and living in the Detroit area, but a public $1 Billion dollar government project seems like a magnet for mismanagement, fraud, waste, and pay-to-play scams. It already seems to be at least $20 million over budget to buy keyboards even at K-12 discounts. Hopefully, the iOS and AirWatch updates are already included in the existing contracts.

While the headline-grabbing hacking story may be resolved in Apple’s iOS7. AFAIK Apple does not let anybody into its BIOS or whatever chip it is on an iPad. That is why students can easily delete the AirWatch agent. LAUSD still has a task on its hands to get all the deployed devices up to iOS 7.

LAUSD is missing 71 iPadsIn more signs of mismanagement, The LA Times reports that LAUSD is missing 71 iPads. They deployed 69 of the missing iPads last year at the Valley Academy of Arts and Science. PadGadget reports that after the fact, the District ramped up its tracking efforts by adding stronger safeguards. Global positioning can now be activated for every tablet. Plus, an electronic inventory system registers who is now responsible for a particular device, and District officials can remotely shut down iPads reported stolen.  Lt. Jose Santome of the school district’s Police Department stated, “We know what’s going out and deployed on every campus.”

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , ,
| February 16, 2013
Comments Off on UP EAS Warns of Zombie Attack

UP EAS Warns of Zombie Attack

UP EAS Warns of Zombie AttackEmergency Alert Systems at northern Michigan television stations sent out a fake emergency alert warnings. The alters warned the UP of a zombie attack after being hacked. The fake broadcast warned that bodies were rising from the grave and alerted people to avoid contacting the walking dead.

MLive Zombiereports the message went on Monday about 8:30 p.m.. The zombie attack warning interrupted “The Bachelor” on WBUP, ABC 10 and “The Carrie Diaries,” a prequel to “Sex and The City,” on CW. The same person got into Northern Michigan University’s public television station WNMU-TV 13. That message interrupted “Barney and Friends” at about 4 p.m., reports NMUstation manager Eric Smith.

“People panicked and it was crazy and we didn’t know how to stop it,”  Cynthia Thompson, station manager and news director at ABC 10 and CW 5 in Marquette, MI said. The suspected hacker has been caught, according to MLive, Ms. Thompson could not release any further details on the suspect.

Attacks around the nation

Security leakSimilar attacks were reported at Great Falls, MT station KRTV and KNME/KNDM in Albuquerque, NM. The security breach’s occurred at stations that didn’t have their login names or passwords reset from factory default settings, said Ed Czarnecki, senior director for strategy and regulatory affairs for Monroe Electronics Inc., a Lyndonville, NY based manufacturer of EAS equipment. “We are very aggressively working with authorities … to ensure that all broadcasters have updated their passwords on their critical equipment,” he said.

Michigan Association of Broadcasters CEO Karole White said the MAB is taking the issue very seriously and working with the Michigan State Police and Federal Communications Commission on the case. “Though this was kind of a pranksters joke, they could have used a different code that could have caused people to be very concerned and possibly even panic,” CEO White said.

HackerInfoSecurity says the problem goes beyond just passwords. Mike Davis, a security expert with IOActive, submitted a report to US-CERT detailing flaws in the equipment used by the EAS system a month before the incident. “Changing passwords is insufficient to prevent unauthorized remote login. There are still multiple undisclosed authentication bypasses,” he told Reuters via email. “I would recommend disconnecting them from the network until a fix is available.”

Really, really, terrible software

According to Kaspersky’s ThreatPost, the flaws Mr. Davis unearthed allowed him to do exactly what Monday’s hacker did. “There is some really, really, terrible software on the other side of that box,” Davis said. “There are some known issues like authentication bypasses and what I would call back doors, although I don’t know if they were meant that way. While I can’t provide authenticated messages [from the EAS system itself], I can log into all of them and insert authenticated messages.”

“The problems that Davis found,” warns ThreatPost, “represent a serious weakness in the EAS system. Some of the ENDECs (encoder-decoder) are networked together in a way that enables them to relay messages to one another, so an attacker who could compromise one could conceivably cause problems on others, as well.”

 rb-

Umm Networking 101, change your default passwords.

Haven’t the dead been roaming the halls of Congress for years? Brain dead anyway!?

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers and anything else that catches his attention since 2005. You can follow him at LinkedIn, Facebook and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , ,
| February 14, 2013
Comments Off on School Kids’ Data at Risk

School Kids’ Data at Risk

School Kids' Data at RiskGerry Smith writes about the growing amount of school kids’ data being stolen across the country. In the Huffington Post article, “In Push For Data, Schools Expose Students To Identity Theft” the author explains why.  Data thieves want this information to commit identity theft. The author cites several recent cases:

Child identity theftThe article says these incidents highlight the growing risk of school kids’ vulnerability to identity theft. Across the country, schools have become conduits for children’s pristine Social Security numbers. The students’ numbers are increasingly falling into the hands of credit-hungry identity thieves. The frequent data breaches have prompted calls for schools to stop collecting sensitive student data. The breaches have angered parents like Art Staehling, whose 14-year-old daughter was among 18,000 Nashville students who had their Social Security numbers accidentally exposed online for three months in 2009.

They left the gate wide open for data theft

“They left the gate wide open,” Mr. Staehling told The Huffington Post. “It’s clumsiness. There’s no excuse for it. If schools want that information, there should be some sort of penalty paid if they don’t guard it with their lives. I haven’t found a reason why they honestly need it.”

Schools collect students' Social Security numbersSchools collect students’ Social Security numbers as part of a campaign to more precisely track their progress. But privacy experts told Huff Post there are less risky ways to identify students. The privacy experts accuse schools of needlessly exposing children to identity theft by gathering their Social Security numbers. Mn then not securing them.

The push for collecting student data began under the federal No Child Left Behind Act. Financial incentives in the 2009 stimulus package, including Race to the Top‘s $250 million in competitive grants drove schools to collect student social security numbers, according to Reidenberg.

No Child Left Behind Act drove schools to collect student social security numbersThe U.S. Department of Education has warned schools not to use students’ Social Security numbers in their databases. The Huff Post says the Feds urge schools to create other unique identifiers. The National Center for Education Statistics warned schools last fall that. They told educators that Social Security numbers are “the single most misused piece of information by criminals perpetrating identity thefts.”

School abuses student’s Social Security numbers

Despite the warnings, the collection and use of student’s Social Security numbers in K-12 schools remain “widespread.” An audit last year by Patrick O’Carroll, the Social Security Administration‘s inspector general. The IG found students’ Social Security numbers printed on transcripts, tests, and athletic education forms. According to the article, the audit concluded that schools were using the numbers “as a matter of convenience.” Mr. O’Carroll found there have been at least 40 data breaches of confidential student information at K-12 schools since 2005.

In his report, O’Carroll wrote.”We believe the unnecessary collection and use of Social Security numbers is a significant vulnerability for this young population. Each time a student provides his or her Social Security number, the potential for a dishonest individual to unlawfully gain access to, and misuse, the number increases.”

Read Part 2 here.

rb-

Consumers Unions points out that Michigan law restricts how Social Security numbers can be used. In Michigan, SSNs cannot be printed on ID cards, intentionally communicated to the public, and/or publicly displayed or mailed within an envelope.

Related articles
  • Young children can be identity-theft targets (goerie.com)

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , ,
| October 25, 2012
Comments Off on Attacking Electronic Door Access Control Systems

Attacking Electronic Door Access Control Systems

Attacking Electronic Door Access Control SystemsDarkReading pointed out research by independent security researcher, Shawn Merdinger, into vulnerabilities within embedded door access control systems. The researcher investigated the inner workings of electronic door access controls (EDAC). Mr. Merdinger disclosed some of his findings at the 2010 CarolinaCon conference.

S2 Security logoThe DarkReading article Attacking Electronic Door Access Control Systems reports that the researcher found several flaws in the S2 Security NetBox. According to the firm’s website, more than 9,000 customers in 50 countries worldwide use S2 Security Corporation’s integrated security management platforms. Among the flaws in the system, he found an unauthenticated factory reset and unauthorized access to backup data. The author says the first issue is obviously a pretty serious one that could lead to a potential denial of service, but it’s the last one that turns heads.

According to the CarolinaCon presentation, the backup files are stored in a location with predictable file names that do not need authentication to access. Inside a software dump of the electronic door access control system, an attacker can find goodies like the configuration and something that might come in handy like the administrator’s password hash. From there, the attacker can do pretty much anything he or she wants, including unlocking doors at will.

door access control system, administrator’s passwordThe article further states that Mr. Merdinger found that the door access control database also has the user names, passwords, and IP addresses for the network cameras and digital video recorders (DVRs). Now the attacker can watch the facility, learn traffic patterns, and plan for a physical penetration of the facility. The stolen credentials will allow the attacker to turn off cameras and/or recordings during their assault on the facility. To make matters worse, Mr. Merdinger points out that marketing folks for these products will actually state that it’s safe to put these management systems on the Internet. And apparently, people do, because in the presentation he demonstrates production systems that are online with a Shodan search.

DarkReading acknowledges that the presentation doesn’t stop at showing the scary stuff. It takes the next step that most audiences are dying to see, but don’t always get, and that’s how to fix these things as both the vendor and the customer. The blog recommends the video, the detailed paper, and his updated presentation from Hack in the Box 2010 (in Dubai) on attacking electronic door access control systems.

Related articles
  • New Access Control Technology Holds the Key to Safer Schools: Unique RFID-based System Addresses the Shortcomings of Expensive and Inefficient Alternatives (prweb.com)

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , ,
| September 20, 2012
2 comments

Students – Insider Threat At K12 Schools

Students - Insider Threat At K12 SchoolsI have spoken to several tech people outside of K-12 lately. When the topic of information security comes around, they talk about how much they are focusing on the “growing insider threat” their employers face. I always smile because those of us in K12 have always faced a hostile internal threat, students. Here are a couple of examples of how students can be an insider threat at school.

student hackers changed gradesAt Colorado’s Jefferson County K12 Schools KUSA reports that administrators are investigating reports that student hackers got into Golden High School’s computer system and changed grades. Investigators are looking into whether students inside the school hacked the campus portal system. A student said, “People started giving themselves A’s.”

Golden High School students told the media that the hackers changed the grades for themselves and others just before winter break and the end of the first semester.

Administrators do not even know how many grades were changed. It could be low as 15 students or as high as 200. The district will not say if any students were caught or how many are suspected of hacking into the system.

do not even know how many grades were changedJefferson County Schools Superintendent Cindy Stevenson told local TV her staff is working hard to find out how it happened. When they do, she says security will be improved.

Berkeley High School

Prestigious Berkeley High School in Berkeley CA succumbed to the student insider threats. The media reports nearly three dozen students were suspended and face expulsion for hacking into the K12 school’s attendance system, an act that could lead to criminal prosecution according to SFGate. At least four students used an administrator’s stolen password to clear tardies and unexcused absences from the permanent records of 50 students, offering the service or the password for a price, Principal Pasquale Scuderi said.

The hackers erased from the system hundreds of cut classes and tardies from October through December, and charged classmates $2 to $20 for the illicit help, Scuderi told the SFGate.

Orange County K12 schools

student insider threatThe student insider threat struck K12 schools in Orange County, California. Omar Khan a former student of Tesoro High School, pled guilty to charges of having installed spyware on his high school’s computers and having used the collected passwords to get access to the grading system and change his grades according to CSO Online.

Khan and another student, Tanvir Singh were arrested for breaking into the school’s assistant principal’s office at night. Khan’s goal was to destroy the evidence that he cheated on a statistics test by stealing it.

Khan had faced a maximum of 38 years in prison on the felony burglary and public-record tampering charges is expected to be sentenced to 30 days in jail, 500 hours of community service, and ordered to pay about $15,000 in restitution.

years in prison on the felony public-record tampering chargesThe article says Khan admitted he was guilty of breaking into school offices and installing spyware on computers and then using the passwords to change some of his grades and that of 12 other students.

He also acknowledged that he changed his transcript grades to appeal rejection letters from the University of Southern California, the University of California, Berkeley, and the University of California, Los Angeles.

Nevada salutation

PC World reports that in Pahrump, Nevada, K12 schools Tyler Coyner, Pahrump Valley High School’s 2010 salutation with a 4.54-grade point average, was arrested as the ringleader in a group of 13 students who have been charged with conspiracy, theft, and computer intrusion. The article states that Coyner somehow obtained a password to the school’s grade system and, over the course of two semesters, offered to change grades in return for cash payments.

salutation arrested as the ringleader in a group of students charged with conspiracy and computer intrusion.According to PC World, ten juveniles have also been arrested for having profited from Coyner’s offer to bump up their grades. It turns out that Coyner, somewhat foolishly – chose to make himself the one that profited most from his scheme. In fact, the 4.54-grade point average that made him the school’s salutation is the result of his own grade manipulation.

rb-

Looks like Coyner is gotten a head start on his dream of becoming a Wall Street hedge fund trader by facing criminal charges as a student insider threat at school.

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , ,
« Older Entries   Recent Entries »