Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Education Security IT

Student Attempting To Improve School Security Suspended 282

Posted by Zonk from the no-good-deed-goes-unpunished dept.
TA_TA_BOX writes "The University of Portland has handed a one-year suspension to an engineering major after he designed a program to bypass the Cisco Clean Access (CCA). According to the University of Portland's Vice President of Information Systems, the purpose of the CCA is to evaluate whether the computers are compliant with current security policies (i.e., anti-virus software, Windows Updates and Patches, etc.). Essentially the student wrote a program that could fool the CCA to think that the computers operating system and anti-virus were fully patched and up to date. 'In the design of his computer program, Maass looked at the functions CCA provides and identified vulnerabilities where it could be bypassed. He wrote a program that emulated the same functions as CCA and eliminated some security issues. He says that the method he chose is "one of six that I came up with." Maass says his intent was not malicious. Rather, the sophomore says he was examining vulnerabilities so that they could be fixed. "I was planning on going to Cisco with the vulnerability this summer," Maass says. '"
This discussion has been archived. No new comments can be posted.

Student Attempting To Improve School Security Suspended More

Student Attempting To Improve School Security Suspended

Comments Filter:

  • University doing a favor (Score:5, Insightful)

    by Anonymous Coward on Friday April 27, 2007 @04:41PM (#18906387)
    It seems obvious that the suspension is a favor done by the university. A person of this caliber could do better in the workforce or a better university instead of TEACHING the university...

    • Re:University doing a favor (Score:5, Insightful)

      by bfizzle ( 836992 ) on Friday April 27, 2007 @04:54PM (#18906505)
      I wouldn't want to hire someone who wrote a piece of software that clearly violates University Policy and used it for 6 months. Its one thing to write the software, distribute it as a proof of concept and let Cisco or the University fix it. Its a whole other to write the said software and use it to exploit the hole for an extended period of time then claim you were going to tell Cisco months later. His actions sing a whole different song than his words.

      • Re:University doing a favor (Score:4, Insightful)

        by rblancarte ( 213492 ) on Friday April 27, 2007 @05:15PM (#18906709) Homepage
        I don't know if I would fully agree with not wanting to hire this guy. He is clearly smart and knows what he is doing. As a programmer, he could be a valuable employee.

        NOW, that being said, I am the first that will say - if you do something like this, know that you are breaking the rules and be prepared to pay the consequences (the guy is ROTC, and probably is going to own the Air Force some money). If you stumble upon something, that is one thing. But to blatantly break the rules for SEVEN months - bad idea.

        And the guy can say "I was planning on going to Cisco with the vulnerability this summer," But that is just talk. Yes, it could be true, but it also could be something he is saying to try to cover his butt since he was found out. Sorry, paint me skeptical.

        RonB

        • Re: (Score:3, Insightful)

          by Romancer ( 19668 )
          Totally agree. Regardless of what his intentions were, he did make the entire network less safe against the specific will of the administrators. By bypassing the security check he opened up a door that they were trying to keep closed. He states no gain from bypassing these checks that would offset the risk created by using his code. So there was no benifit other than making the network less secure.

          Now imagine that a virus got in through this hole and deleted all their e-mails on campus. What would the opini

          • Re: (Score:2, Insightful)

            by Anonymous Coward
            If you implement/code security software with holes in it, you deserve to have them exploited. If this university was truly devoted to research they would take this as an opportunity and challenge other students to exploit the system. This isn't a national defence system or even a corporate accounting computer. This is a university, their primary concern should be research, their secondary concern should be education, and security shouldn't even enter into the picture.

            • Re: (Score:2, Insightful)

              by lpw ( 1089731 )
              security shouldn't even enter into the picture

              Have you any idea how much confidential information lives on university networks? Many university researchers sit on loads of proprietary and/or highly sensitive data with confidentiality and nondisclosure agreements up the yingyang. Public health, national security, and defense research come to mind. Security MUST be part of the picture, lest the university loose the trust and the funding from external sources that value the privacy of their data.

              You mus

              • Re: (Score:3, Interesting)

                by hazem ( 472289 )
                Many university researchers sit on loads of proprietary and/or highly sensitive data with confidentiality and nondisclosure agreements up the yingyang.

                Believe me, UP is a nice school, but it's not one of those.

                Having worked with some of these particular IT people, they're mostly ignorant and get very nasty about any who tries to point it out. They are only coming down on him so hard because he made them look bad. It's being done to make him an example to anyone else who might make them look bad.

                They reall

                • Re: (Score:3, Insightful)

                  by rblancarte ( 213492 )
                  Three words - Social Security Numbers

                  As someone who has fallen victim of University ID theft (SSN taken from a University computer), this guy could have been putting information at risk. Sorry, do not pass go, do not collect $200.

                  RonB

                  • Re:University doing a favor (Score:4, Insightful)

                    by hazem ( 472289 ) on Friday April 27, 2007 @08:10PM (#18907961) Journal
                    Actually, it's the University that's putting the information at risk by choosing to use an insecure program and calling is security.

                    There should be no connection between computers in dorms, labs, and classrooms, and any computer that has secure/financial information. They shouldn't have to rely on a crappy program from Cisco to give them the illusion of security.

                    Sorry about your ID theft. I'm a veteran who uses the VA, and I'm sure my SSN was one of those 26 million that were recently compromised. Got a nice letter saying they were sorry but I shouldn't worry. Of course, no credit monitoring, no ability to "freeze" my credit reports... just sit back and wait and hope nothing happens. Kind of like the University in this case... but not by choice.

              • Re: (Score:2)

                by Tassach ( 137772 )

                Have you any idea how much confidential information lives on university networks? Many university researchers sit on loads of proprietary and/or highly sensitive data with confidentiality and nondisclosure agreements up the yingyang

                Confidential information should not be on a computer connected to an untrusted network, nor stored in an unencrypted format. If your data is that confidential, if you have any network at all it needs to be completely isolated from the outside world (no internet connection AT A

            • So what you're saying is: never use any software, ever, or you deserve to have the holes that are present in ANY pice of software exploited. That's brilliant!

              Now, was it pretty cool that he did this? Definitely. But he was an idiot for not coming forward with it sooner. It completely strips his "I was going to tell Cisco later!" argument of any credibility. If you want students to study vulnerabilities in software, you do it on a closed network; not one that is used by other students and faculty.

              This is a s

              • But he was an idiot for not coming forward with it sooner. It completely strips his "I was going to tell Cisco later!" argument of any credibility.

                If you were a student, you'd have waited until you were ready to apply for a summer internship, that is, if you had any brains or business sense.

                BTW - there were students who wre not required to run CCA - they were using macs or linux. There's a lesson there - Windows is not suited for use in schools.

                • But, he should have come forward to a professor or administrator first; or just not used the bypass. THe way he did it wasn't exactly his best idea.

                  And, is windows really suited for use anywhere else?

                  • "But, he should have come forward to a professor or administrator first"

                    Well, he did give it to one of his professors. Looks like the professor also found it useful to get around the hassles of CCA ...

                    "And, is windows really suited for use anywhere else?"

                    I highly recommend all sorts of windows - casement, sliding, patio, even X Windows (or just "X") ... just not Microsoft Windows.

            • If you implement/code security software with holes in it, you deserve to have them exploited.
              It was all that thar University's fault, yer honor. Iffen it didn't want its data exploited, it shouldna been showing off them purty security holes!

            • Re: (Score:2)

              by alienw ( 585907 )
              If you implement/code security software with holes in it, you deserve to have them exploited.

              So, if you don't have bars on your windows, you deserve to get robbed? If you park your car on the street, you deserve to have it broken into? If a girl dresses slutty, she deserves to be raped? Yeah, great argument you got there.

              This is a university, their primary concern should be research, their secondary concern should be education

              Exactly. Securing their network against attacks by their own students is neith
          • "He is trying to cover his ass."

            Shame he wasn't a CS major and when he brought it to a professor he should have brought it to the head of the Arts & Sciences department. They usually have a little pull and instead of getting suspended they would have probably contacted Cisco and said "WTF?! Fix this!"

      • Re: (Score:3, Interesting)

        by cheater512 ( 783349 )
        I'm not sure exactly what the Cisco software does so I could be on the wrong track.

        At my uni we are given a pathetic 150mb/month internet quota and we are charged $7/gig extra.
        I naturally found a way to get free net and I really dont have any problem using it for personal use.
        I dont abuse it or anything either.

        If the Cisco software put constrains on how the guy could use the computer then I would hire him in a instant.
        The more you try to lock something down, the more people try to fight back.

        You'd be stupid

      • Catch me if you can (Score:4, Insightful)

        by electrosoccertux ( 874415 ) on Friday April 27, 2007 @06:30PM (#18906975)
        Clearly you haven't learned from the movie "Catch Me If You Can".

        These people can outsmart you every minute of the day if you give them reason to. Why not just employ them and get on their side?

        Oh right, this isn't about security, this is another stupid power struggle.

      • RTFA before commenting... (Score:5, Insightful)

        by msauve ( 701917 ) on Friday April 27, 2007 @06:42PM (#18907101)

        "There was nothing in [the policies] that stood out to me that I would be in violation of," Maass said of his thinking at the time he authored the program.

        Maass was charged with "violations of the Acceptable Use Policy, the Network Security Policy, disrespect for authority, disrespect for property, disorderly conduct and fraud," according to a letter he received from the University Judicial Board...

        "A lot of these policies are written to be very vague and flexible so that they can be [used] in whatever situation they (the University) need to use them in," he [Maass] says...

        Goldrick [ vice president of student services] declined to comment on issues concerning policies.

        Would you care to quote the policy you claim he broke?

        No, it sounds like he embarassed the University IT administration, so they closed ranks and used a kangaroo court to express their displeasure. Dean Wormer put him on double secret probation first, I'm sure.

        • Re: (Score:3, Interesting)

          by Score Whore ( 32328 )
          There was a much better approach that I'm sure Mr. Maass would have been pleased to be subjected to. In the exact same fashion that he developed this software and kept the whole situation to himself until his "planned" notification to Cisco this summer, the university could have let him finish out his degree then "planned" on releasing the confirmation that he had done so until sometime in 2020. I'm sure that would fit perfectly within Maass' code of ethics.

          And, btw, university code of conduct, aups and the

          • Re: (Score:3, Informative)

            by pallmall1 ( 882819 )

            In the exact same fashion that he developed this software and kept the whole situation to himself...
            Read the article. He did tell a Professor. I'll bet they don't "stick it" to him/her.

            Put that in your smug pipe and smoke it.

      • I wouldn't want to hire someone who wrote a piece of software that clearly violates University Policy and used it for 6 months.


        Keep in mind that some universities require that you run only WINDOWS on machines attached to their network, including computers connected from your dormitories. Sometimes policy is stupid and ought to be ignored, just as unjust laws ought to be broken.

      • Re: (Score:2)

        by hxnwix ( 652290 )
        Somehow, I doubt that he'd want to work for you anyway.

      • Re:University doing a favor (Score:4, Insightful)

        by tomhudson ( 43916 ) <barbara DOT huds ... a-hudson DOT com> on Friday April 27, 2007 @08:39PM (#18908209) Journal

        You obviously didn't read the articles. He did nothing that people with Macs or Linux or BSD on their computer are allowed to do. Its only Windows computers that they force users to run Cisco Clean Access ... and they also force them to us Symantec Antivirus instead of letting them choose ther own AV product.

        Considering that Symantec AV is not the only antivirus out there, if you were running a different antivirus, you would have to bypass CCA as well.

        Check out the article - CCA was taking up to 20 minutes to load - who wouldn't bypass that?

        Also, it is not clear that it "violates university policy" to write such a program, if you're a computer major, and your class work involves looking at vulnerabilities in software - which is what he learned in class. Then again, those who can, do - those who can't - teach.

        FTFA:

        Maass was charged with "violations of the Acceptable Use Policy, the Network Security Policy, disrespect for authority, disrespect for property, disorderly conduct and fraud," according to a letter he received from the University Judicial Board

        "Disrespect for authority?" "Disorderly conduct?" Aren't they part of what yo go to university for - to question the "accepted wisdom"? Or are universities becoming enclaves where they'll start teaching that women have fewer teeth then men, because Aristotle taught that, and it must be true... (in this case Aristotle was clearly an idiot - he was married - twice - and never bothered to check!!! Sort of like the university's VP of IT, because they don't understand the difference between a program a student runs on his own computer, and "hacking their system.")

        So, are they going to suspend every student who goes on a kegger? Flips the bird at a politician? Refuses to let their computer be hijacked by a buggy program? Sounds like a great place not to get an education.

        BTW - his actions exactly suit his words - of course he'd withhold giving it to Cisco until he was ready to ask for a summer job / internship. Your uninformed criticism of him, on the other hand, shows you're real university administration material.

      • Re: (Score:3, Interesting)

        by arminw ( 717974 )
        ......a piece of software that clearly violates University Policy.......

        Does that mean that a student who owns a Mac won't be allowed on the University Network since Macs don't need, or at least very few of them have any anti-malware crap? Does that mean Mac users, or even Windows users are forced to run all sorts of garbage software, just so they may use the University's precious network? I'd find myself a more enlightened place to spend precious education dollars. What business is is of anybody to sear

  • Don't do security research in the US (Score:5, Insightful)

    by Anonymous Coward on Friday April 27, 2007 @04:44PM (#18906393)
    Anyone in the software biz should know: don't do security research (look for vulnerabilities) in commercial software or commercial websites if you want to be in the US. If you find a vulnerability, like a website that lets you launch missiles by putting &loggedIn=true in the URL, the best thing to do is to laugh to yourself about it, and forget it. Failing that, use some secure anonymous service and post the vulnerability somewhere. Doing the responsible thing, like informing the vendor, is absolutely thankless and likely to result in nothing but problems. Be smart, don't be a hero. Don't try to improve the security of others.

    • Re: (Score:2)

      by iamacat ( 583406 )
      commercial != educational. I am sure we agree that we don't want security research to be done on city's traffic light system or nuclear missile control.
      • So you instead just pretend or blindly hope that they're secure and simply wait for the first person to come along who actually *wants* to cause traffic chaos or launch nuclear missiles?

        Using the Ravenous Bugblatter Beast of Traal method. All we need to do is arrest anyone who points out your obvious idiocy then the obvious idiocy will obviously disappear.

        PS IAASR, though a relative beginner at the job.

        • Re: (Score:2)

          by iamacat ( 583406 )
          Nice sentiment, but in practice it's hard to tell if the intruder is going to cause harm or just point out the flaws until it's too late. I think in the case of university computer (especially your own one in the dorm) and in case of nuke control, preemptive responses should be quite different.
          • So then they should do an amazing thing and actually *pay* a security researcher to test the security under controlled conditions in a non-production system! Did you really think I was suggesting that they should do nothing when someone's trying to break into a nuclear power reactor? That is black hat attacking, not security research. It's illegal and unethical. I was simply suggesting that it's naive and idiotic to think that doing security research on systems where security is so vital is stupid.

            Th

    • Re: (Score:2, Funny)

      by Anonymous Coward
      I did the responsible thing. I was walking down the street checking the front doors of my neighbors. Of course I wasn't in my neighborhood being as how that area was boring to me. I found an open door and felt it was necessary to check the house to see if they had left anything else unlocked or exposed where someone who was malicious could find it. Unfortunately the police showed up and as I tried to explain that I was just helping by relocating the valuables to a safe location until I could inform the

  • Ookaaay then (Score:5, Funny)

    by FlyByPC ( 841016 ) on Friday April 27, 2007 @04:45PM (#18906403) Homepage
    Guess I *won't* be doing that automated WiFi stumbler as a senior project...

  • Getting past two imflammatory headlines (Score:4, Insightful)

    by Lockejaw ( 955650 ) on Friday April 27, 2007 @04:45PM (#18906405)
    TFA isn't really clear on what sort of "break-in" this was. It looks like it was, at most, a proof of concept break-in, and may have been as little as figuring out how to break the system without actually doing it.
    In any case, he didn't go around giving out exploit code, and he even worked on the problem of patching the hole (as well as solving other problems with the CCA software), with the intent of full diclosure of the patch and upgrades. This isn't really a punishment for breaking things, it's a DMCA-style punishment for figuring out how someone might break things.

    • Re:Getting past two imflammatory headlines (Score:5, Insightful)

      by yali ( 209015 ) on Friday April 27, 2007 @04:55PM (#18906511)

      In any case, he didn't go around giving out exploit code...

      From TFA:

      "I was planning on going to Cisco with the vulnerability this summer," Maass says. Maass' program was in use for approximately seven months before the University froze his UP account. Additionally, he gave the program to several friends and one professor.

      Also from TFA:

      Moreover, [fellow student] Vandermeulen said, many people are frustrated with CCA. CCA has sometimes taken up to 20 minutes to load on Vandermeulen's computer, he said. "I hear so many complaints (that) I'm not surprised that someone would go ahead and try to write something that would completely bypass it," he added.

      I don't think this guy deserved the punishment he got. But the whole, "I was just trying to help them" argument sounds fishy. Seems more likely that the uni put cumbersome security requirements on students, this guy tried to circumvent them, and the IT folks caught him and overreacted.

  • Not impressed (Score:5, Interesting)

    by Adam Zweimiller ( 710977 ) on Friday April 27, 2007 @04:46PM (#18906417) Homepage
    When I started at as a freshman at the University of South Carolina 2 years ago, they were already using CCA. It's main intrusion was the fact that the University demanded that we use McAffee regardless of any other (superior) software we may have already purchased. Personally, I used Symantec Antivirus (Corporate) that I got through my internship. Regardless, it forced McAffee down my throat. I couldn't use the two side by side, as XP would freeze on startup with both installed. I noticed that the policy for CCA usage only applied to Windows computers, and that Linux and Mac users were exempt. So I booted my SuSe installation and launched Firefox to discover a web-gate type login, a form that I had to put my CCA user and pass into. Once entered, it said I was logged in for 7 days. I thought, well there's really only one way they're seperating out Windows, Mac's and Linux boxes: the user-agent. All it took to bypass was a custom Firefox deployment package pre-configured with User Agent Switcher. You didn't even need CCA installed. Every 7 days you got the web-gate login. All you had to do was switch to the pre-configured Linux user-agent and login, upon which you could change back to the default and continue on your merry way for 7 days. In about a week everyone in my dorm was using it, and it still works today. They just ban the user-agent when they catch on, and we come up with new ones. I'm not sure this guy's University may differ, but it really shouldn't take any kind of sexy software hackery to bypass it. PS. wtf is up with slashdot's server? It took me like 15 minutes to get this posted

    • Re:Not impressed (Score:4, Interesting)

      by bahwi ( 43111 ) on Friday April 27, 2007 @05:01PM (#18906611)
      Well, there's not really just one way to split up the OS'es, see nmap TCP/IP OS fingerprinting, but it's kind of disheartening that Cisco is using the UA for that, as it's the least secure thing you could possibly do. Kind of a name badge, "Hi My name is: CEO of Your Company" and security letting him pass without a card swipe or ID check because he says it so it must be true. Nmap OS Fingerprinting [insecure.org] is really very cool if you haven't checked it out before. OpenBSD hides itself pretty well and FreeBSD does ok with certain switches turned on. But of course the detection just gets better each time too.

    • Re:Not impressed (Score:5, Interesting)

      by logan@bitsmart.com ( 21914 ) on Friday April 27, 2007 @06:31PM (#18906983)
      Heh... I reported this via Bugtraq on August 19, 2005, and CISCO responded to it 3 days later...

      http://www.securityfocus.com/archive/1/408603/30/0 /threaded [securityfocus.com]

      As in, they've known about this for at least 20 months...
      • Cisco "security" software is complete and total crap. There are hacks on the internet for just about all of it. They secure a computer about as well as Norton Internet Security. Its only purpose is to make people feel safe and to satisfy auditors, most of which are MBAs who don't even know what a packet is.
    • My university imposed this crapola on all dorm residents during the summer to test it out. I wasn't there, but my girlfriend's computer suffered the consequences of it. They forced her to uninstall the AVG antivirus and Comodo firewall that I configured, and during the transition her computer was massively hijacked. I'll admit, the dorm networks there are atrocious and this type of software might have been a good idea. Worms/viruses were absolutely rampant; two or three times a day AVG would popup saying
    • There was something vaguely similar that happened when I was in University.

      I found that, rather than booting into SuSe, I was better off just grabbing firefox and telling the User Agent Switcher to represent me as a Mac or Linux, or anything else, really. I never had a problem after, never needed to download the software, and I passed on this tip to dozens of individuals. Six weeks after the beginning of the semester, Network Operations came to me (I had intervewed for a part-time position there) and asked

    • Re: (Score:2)

      by hxnwix ( 652290 )
      Adam Zweimiller, violator of policy, you are a bad man!

      University policy exists for a reason and must be followed!

      Think about how many viruses would be caught if everyone were like you! None! What would we do then?! Why, we would be unable to justify our salaries!

      Adam Zweimiller, we are obligated to bring the hammer down upon you!

  • Heh (Score:3, Insightful)

    by Ant P. ( 974313 ) on Friday April 27, 2007 @04:46PM (#18906421)
    I bet he's reconsidering helping them now.

  • Cisco Clean Access Agent... (Score:5, Interesting)

    by TheGreatHegemon ( 956058 ) on Friday April 27, 2007 @04:46PM (#18906427)
    The article goes over it pretty well, but Cisco Clean Access Agent, in my experience at my college is more of a headache than it's worth. If someone has the slightest problem with Anti-virus updates, they get locked out every week, (I actually have to download the smart installer for them, and then patch it manually). Plus, a lot of good antiviruses aren't recognized by CCA agent as being acceptable. I currently run Windows 2003 server as a desktop, and CCA agent doesn't play nice with me either - I have to trick CCA agent by using a virtual machine for logins. Frankly, if there was a link to this program, I'd be using it right now...

    • Re: (Score:2, Informative)

      by pathological liar ( 659969 )
      That's not a problem with Cisco Clean Access, it's a problem with whoever setup the policies it's using, and their decision that if you don't have antivirus X, you get locked out. Complain to your admin staff, but don't hold your breath.

      At this university the rules only enforce that you've got McAfee and the EPO agent installed, that your patterns are up-to-date, and that you're at a reasonably recent patch level for Windows. They're only set to restrict systems we can reasonably expect to enforce policies

    • Re: (Score:2, Informative)

      by NNland ( 110498 )
      http://kevin.sourceforge.net/ [sourceforge.net]
  • Though, its starting to sound like anyone who tries to use their hacking powers to show vulnerability's, they are suddenly the bad guy.

  • Am I Nitpicking (Score:3, Interesting)

    by Soporific ( 595477 ) on Friday April 27, 2007 @04:47PM (#18906437)
    Maybe it's just me but isn't the statement that he was going to inform Cisco sometime this summer pretty vague? What was holding him back?

    ~S
  • The first article didn't really clarify and actually confused the issue(s). They did indeed do more than just set him back a year. If he's on a full ROTC scholarship, they likely just yanked his funding by suspending him.

    If you look at it out of context, their decision makes some sense, however, as soon as you apply ANY logic to it, their reaction is way too far. What is the result? I would never do research there or even TOUCH anything security related. Imagine if you got suspended because you left

  • Stop instituationalizing young people (Score:5, Insightful)

    by iamacat ( 583406 ) on Friday April 27, 2007 @04:50PM (#18906463)
    It's unavoidable that a bright C.Sci student will bypass some university security measures, for some of the following reasons

    • Bypass cloying "for your own protection" software that he and his computer-literate friends do not need anyway. Besides, what security updates if you have Mac/Linux?
    • Impress a girl by resetting her lost password or re-enabling account in her undergrad school
    • Explore a realistic network structure and challenges of its administration
    • Repair the system when it's down, admin can not be bothered and final project is due tomorrow at 8:30


    Steve Jobs openly admits to phone phreaking and calling the Pope. Both he and Bill Gates eventually dropped out of school. It's clear that, to become a person of substance, you have to be willing to challenge authority once in a while. Are we trying to raise a generation of corporate drones who are so obedient they can never pose a competitive threat to existing oligarchy. Are we so insane we let disturbed students stay in school and own guns, but suspend ones who are merely using university's property, paid for by their tuition, more efficiently than average?

    • wow, excellent points (Score:5, Interesting)

      by JohnnyComeLately ( 725958 ) on Friday April 27, 2007 @05:01PM (#18906613) Homepage Journal
      Your reply hits many points, dead on (pardon the pun when combined with the guns reference). Technically, I "broke" Sprint PCS security policy by showing them a hole in 3G data services (around 98/99). The security guys were certain they were applying the layers of security but forgot about a fundamental shift in types of traffic (tunneling within a tunnel) used in 3G. I said, "OK, if it's secure, how is it I can ping the billing server from my "public" computer".....I could technically have been in the same boat as some others (not this kid...he was clever).

      Which brings up your main, and correct, point. It's sad when we penalize so harshly for students just being clever. Would they have suspended him for a year for putting a penny in the dorm elevator (in effect locking it on a single floor during early morning rush time)??? I often joke, and I'm sadly accurate: If I did half of what I did 20 years ago in highschool and later college....today...I'd be a multiple strike felon...and yet no one or any property was really ever hurt

      • Re:wow, excellent points (Score:5, Interesting)

        by ScrewMaster ( 602015 ) on Friday April 27, 2007 @07:22PM (#18907519)
        When I was in college thirty-odd years ago, my University only allocated 2,000 minutes per quarter per student of mainframe time. Not enough (obviously) and they refused to give me any more. So I wrote a simple fake-login program that would log the user's name and password, and cough up a realistic "system is down" message. Matter of fact, I exactly duplicated the normal logon procedure, including any nominal pauses and delays that occurred. Even fooled the system operators a couple of times. I ran the thing on forty or fifty terminals simultaneously, and I would watch in case someone called one of the admins over to ask why the system wasn't working. Whenever that happened, I'd hit a key on my terminal that would immediately log all the other systems off, so it would work normally at the next login attempt. It wasn't often: most people just shrugged, got up and left to go about their business. Occasionally some busybody would call an administrator over, so I had to keep an eye on things.

        In under a week I had captured the accounts of every active student user on the system, plus all the supervisory accounts. It was pretty unbelievable (as in, "holy SHIT Jesus Mary mother of God" unbelievable) and I couldn't understand why there were no precautions taken against that sort of thing. Needless to say I had no problems with account time after that. That was on the one mainframe: there was another guy, pretty sharp coder, that figured out what I was doing. At first I thought I was screwed, but he was delighted by the idea and duplicated it on the bigger system (this was years before the word "pwned" came in to the popular lexicon but it's no less applicable.) No surprise, a few days later and he had the run of that machine. So far as I'm aware, nobody ever figured out what we'd done. The big system was the one that had everything administrative on it from student grades to paper clips and we could have wreaked havoc if we'd wanted to. As it was, though, we just wanted more computer time to do our homework.

        A couple of years later my father testified in front of my State's legislature regarding a new "computer crime" bill they were shopping around. It was one of those ridiculous "zero tolerance" laws that make the lawmakers look "tough on crime" but end up shafting a lot of people that don't deserve it. Dad pointed out to these idiots that, if passed, their brain-child would immediately criminalize 90% of the best and brightest students in our engineering and computer science curricula. They backed off in a hurry and came back with a more reasonable bill, which never got passed anyway.

        That was then. Nowadays, I don't think our lawmakers would bat an eye if they put half our smartest engineering students in jail. They're just engineers, after all, and ... who the fuck needs those.
    • well said

    • Re: (Score:2)

      by Ant P. ( 974313 )
      In my high school I had to break the brain-damaged "security" just to get my work handed in on time; the only way I could get files onto the system was via http and anything not txt/pdf/doc/etc. was blocked - the system deliberately killed the browser process to prevent me downloading a zip file. With my work in it.
      I ended up opening it as a text file in dreamweaver and fishing the file out of the cache folder.

      I'll spare the complaints about the rest of that whole experience as they're offtopic, but I will
    • They would have gunned down that Korean dude.

      Either way, there are ways to attack someone who has a gun without a gun, and actually WIN.

      1. Find a fire hose, and spray the whole floor so its slippery when running, you can even spray it directly on him to make him fall.
      2. Get a fire extinguisher and spray him/hall way/room like hell so its so foggy you cannot see anything, and breathing those chemicals in is
            not nice either.

    • Re: (Score:2)

      by Myopic ( 18616 )
      Are we trying to raise a generation of corporate drones who are so obedient they can never pose a competitive threat to existing oligarchy.

      Depends on what you mean by "we". If you mean the powers that be, the average person, the democratic mean, then... yes, "we" are. If you mean you, or me, specifically, then no "we" aren't.

      PS I wonder: you ended your sentence with a period instead of a question mark; was it a rhetorical question.
  • He should have talked to the campus IT guys about this "research" before conducting it on live campus systems. I worked in campus IT at Stanford and my experience is that they might be open to seeing what you're working on and allowing it.

    The article summary posted here on /. conveniently left off the next paragraph:
    Maass' program was in use for approximately seven months before the University froze his UP account.

    So he ran this thing for most of the school year and gave it away to his friends and put up a facebook page about it without telling Cisco? At some point it starts to look like the, "I was about to tell Cisco!" claim is just an excuse to get out of trouble. Once he had a working demonstration he should have approached Cisco, not distributed it while he put off talking to the vendor for half a year.

    Still, it seems like the uni is going overboard on the punishment.

    • Re: (Score:2)

      by pembo13 ( 770295 )
      like campus IT guys know anything

    • Re: (Score:2)

      by dgatwood ( 11270 )

      Normally, what one do on his/her own personal machine is that person's business and nobody else's, including the network administrators, unless and until he/she causes harm to the normal operation of the network or other systems on the network.

      Okay, maybe putting it on a facebook page was stupid....

  • Nobody wants things to work right or work well, if it means upsetting the status quo.

    They'd rather things disappear and get bitten in the ass for it in the future, than deal with it now, if it means someone's going to get embarrassed. There's no intellectual honesty anymore..
  • And I thought school was where you went when you wanted to learn about things, test things, build new things, and in general broaden your horizons and expand what you are capable of doing.

    Wait, that is the lie people have been telling us forever.

    School (high school and univ) in my opinion is a very poor excuse for "preparation" for the real world. In all of the jobs that I've had, identifying, working through, and solving problems is what its all about. Of course in school, the students are rarely if ever

    • Re: (Score:3, Insightful)

      by BalanceOfJudgement ( 962905 )
      If you stop thinking of school (all school, from kindergarten through college) as "where you went when you wanted to learn about things, test things, build new things, and in general broaden your horizons and expand what you are capable of doing" and instead start thinking about it as a way to keep people busy and out of the work force for awhile, then the whole thing starts to make alot more sense.

      Imagine what the job market and the economy would look like if everyone in our overpopulated civilization who

    • Re: (Score:2)

      by Rakishi ( 759894 )
      As I have said often in the past: Just because you went to shitty college, took shitty classes and didn't take advantage of the available opportunities doesn't mean everyone is a dumbass like you.

      College (and life) is what you make of it, don't complain about being spoon fed everything when you never showed any ability to eat on your own.

      • Re: (Score:2)

        by pavera ( 320634 )
        Look, I dropped out of college and have never looked back, I am very good at math, CS, physics, chemistry, basically all math/science/engineering fields I was good at in school. My favorite was CS, and I dropped out when the opportunity cost of staying in college was too much (offered a job making 65k at 19, benefits, high paced environment, or stay in school and keep paying 20k/yr to learn slowly and be bored). I don't regret it now, I have 8 years of experience, and I can very easily move between jobs.

  • lets just suspend ALL students and save time (Score:5, Interesting)

    by TheGratefulNet ( 143330 ) on Friday April 27, 2007 @04:51PM (#18906475)
    story after story, its "this student scared us - lets git 'em!".

    why is this country SO AFRAID of students and so into controlling them? I'm not sure I could survive in a modern high school or even college environment now. I'd be too angry all the time at how badly they are mismanaging our youth.

    I am quickly losing all my faith and trust in the so-called 'education system' we have in the US. its becoming not much more than babysitting and nannying.

    and I fear for the kind of young adults we are going to produce from this brainwashing factory we call 'school'.

    anyway, what good is there in suspending this kid? what does that accomplish? the fact that he found YOUR security flaw embarassed you? is that a reason to punish him?

    perhaps the school does not DESERVER your funding. yes, YOU fund the school - they work FOR YOU. its not the other way around. YOU are the consumer. if school-A is giving you crap, why not take your business elsewhere? yes, school IS a business - very much so.

  • TFA says he was running this program for seven months, and was planning on alerting cisco "this summer", and he also spread the program to his friends. Doesn't really sound like security research to me, more like bypassing the security for your own convenience. You really don't "research" a security flaw for seven months, and even spread it to other people.

  • We avoided situations like this... (Score:3, Funny)

    by Cylix ( 55374 ) on Friday April 27, 2007 @04:56PM (#18906529) Homepage Journal
    Early only we ran into some policy issues at the university.

    The solution...

    Take the engineering department off of the campus network and maintain it ourselves.

    It worked out fairly well when I was there, but resulted in some equipment deficiencies. We ended up getting the backend of the upgrade cycle, but that was fine as we were allowed to "blow them up."

    This would not have worked without volunteer work and when I had returned I was already a competent admin. It probably wouldn't scale too well, but it's a good learning experience for some.

    It does lead to issues though...

    At one point, a professor proclaims the network seems to be having issues and at that point I poked my head up.

    "Um, no it's not... I'm putting in dDNS... because it looked like fun."

    Things were back up momentarily. (Hey I was young!)

    The best was probably the day I rooted the servers and updated the motd.

    "Under new management -- cylix"

    This was of course the policy for gaining administration for maintaining systems. The final system I had to social engineer my way into... sorta... I basically made it into the server room with the prof maintaining things and he left to go get some papers. He knew I was after the final system and just wouldn't let me take it over without a fight. He had to know what I was going to do and probably just wanted to see how fast I could get my hands into the system. The moment he stepped out I tackled the keyboard like it was a drunken cheerleader.

    The only catch was no denial of service. So, if you were going to bring something down... no one could notice.

    Fun times!
  • Let's see, if you're writing a program that will circumvent security measures, if he had gone to IT and said "I'm writing a program to test CCA..." he wouldn't have been in deep water as opposed to trying to explain why he did it "No, I wasn't trying to hack the network, I was writing a *test application* and then go to cisco"..

    If he had nothing to hide in the first place, then he shouldn't have hid it in the first place.

  • University of Portland (Score:4, Informative)

    by pclminion ( 145572 ) on Friday April 27, 2007 @05:00PM (#18906569)
    U of P is a Catholic school with no particular engineering focus. I think he would have stood a better chance of a reasonable response had he been attending a "real" engineering school. There's nothing wrong with Catholic school, or in studying engineering at such a school, but I think this poor guy should have seen it coming... If you're going to do research like this, do it at home. If he wanted to inform Cisco of the problems, he should have just done so directly. I feel bad for the guy but it's not surprising.

  • To be honest... (Score:3, Insightful)

    by HuguesT ( 84078 ) on Friday April 27, 2007 @05:01PM (#18906609)
    If I did something like that and got caught I would say I was planning to come clean as well.

  • Let's see.... (Score:3, Funny)

    by MBCook ( 132727 ) <foobarsoft@foobarsoft.com> on Friday April 27, 2007 @05:03PM (#18906633) Homepage
    And now... the university's decision process:
    • Finding security holes in our expensive software: -1 point
    • Fixing security holes in our expensive software: -1 point
    • Giving the program and information to a professor: +1 point
    • Giving the program and information to other students: -3 points
    • Mentioning this online: -2 points
    • Planning to tell Cisco: +1 point
    • Not telling Cisco immediately: -2 points
    • Using the software for months: -2 points

    Total? -9 points. Not good. The university had no choice. For reference, here is the scale:

    • +10 or better: Scholarship
    • +5 or better: Award
    • +1 or better: Acknowledgment
    • 0: "We'll ignore this"
    • -1 to -3: Chiding
    • -4 to -6: Write in your file
    • -7 and -8: "You're in serious trouble"
    • -9 or worse: Suspension

    Too bad the guy may lose his scholarship. He presented it wrong, especially giving it out and not telling Cisco immediately, along with running it himself. But it doens't deserve a full suspension for a semester.

  • CCA (Score:3, Informative)

    by michrech ( 468134 ) on Friday April 27, 2007 @05:03PM (#18906635)
    To those who are saying "CCA doesn't recognize perfectly good antivirus packages" (and other sorts of comments). Most, if not all, of that is configurable on the backend. If your school forces McAfee, they likely removed (or never added) other products to the CCA server. The college for which I work supports Symantec, McAfee (which we give away to students), AVG, and at least a few others.

    If your CCA isn't acceping an antivirus scanner you like, why not go through the proper channels to find out *why* it's not supported and see about getting that fixed?

  • the article doesnt mention.... (Score:2, Informative)

    by Anonymous Coward
    I just finished working with the CCIE who implemented the CCA at U of P today and he said the student wasn't suspended for circumventing the CCA but rather distributing it to other students, which in my book is malicious. And for the record I work for a University around 30 miles away from U of P.

  • From the misleading headline department (Score:4, Informative)

    by peacefinder ( 469349 ) <alan.dewitt@ g m ail.com> on Friday April 27, 2007 @05:21PM (#18906727) Journal
    Many of the arguments we use to - justly - defend security researchers seem like they may not apply in this case.

    * He used the software to bypass the security check for seven months
    * He distributed the software to several other students and a professor
    * He did not disclose the vulnerability to the vendor before releasing his exploit
    * He did not ask permission

    Now, this is not to say that the University's use of CCA is wise or it's reaction was reasonably proportionate to the damage done. (If the damage and the policy violation is as minimal as the article claims, a 1-year suspension is insane.) But Mr. Maass did not do a good job of covering his ass, either.

    Let this be a lesson to the next guy.
  • My University uses CCA, and to bypass it... you can either not use Windows, or use Firefox and install a plug-in that allows you to modify the User-Agent to identify itself as if it were running Linux/OSX. This might not work in all cases, though.

    • Re: (Score:2, Informative)

      by Christophotron ( 812632 )
      Who says you even need a plugin? Just go to about:config, right-click and enter a new string that is named "general.useragent.override" and for the value enter anything you like. Examples of user agent strings can be found here. [user-agents.org]
  • This whole fiasco reminds me of an old BBSpot article:

    Gates Announces Security Death Squads [bbspot.com]

  • This illustrates "transitive trust" fallacies (Score:5, Insightful)

    by malcomvetter ( 851474 ) on Friday April 27, 2007 @06:30PM (#18906979)
    Regardless of the student's ethics (or lack thereof), this illustrates a fallacy of trust in computing that often goes overlooked, especially in software security products: transitive (implicit) trust.

    Think about it logically for a second ... If the administrator (of the University, some enterprise, or even a home network) cannot state anything about the trustworthiness of an unfamiliar computer, how can that same administrator trust the output of some software program designed to assert the trustworthiness of an otherwise untrusted computer?

    Trusted input (e.g. Cisco Clean Access)
    + Untrusted computation (unknown host)
    != Trusted output (i.e. an assertion from the CCA that the computer is trustworthy)

    The nature of this equation is that the untrusted computer is implicitly trusted to compute its own trustworthiness. What ramifications does that have on the real world analogies?

    Banker: Can I trust that you'll repay this loan for $1 Billion?
    Some joe off the street: [Hides "will work for food" cardboard sign behind his back.] Uh, sure.

    And yet, how many NAC/NAP vendors actually try to challenge the unknown host (java applet, activeX control, native code, etc.)? Answer is: nearly all of them, unfortunately. Even if Cisco fixes this hole, what will happen next? This is not unlike Cisco trying to sell a perpetual motion machine-- this simply defies the "natural laws" of security.

    --
    NAC is not the answer. How about those good ol' 3270 connections?
  • If this "kid" REALLY intended to bring his findings to Cisco, then he should have been documenting not only his intent but also his findings and techniques used and this should be enough to prevent a suspension. Unless he came up with this idea of 'going to Cisco' after he got busted.

    I have a hard time believing his story without some proof he'd been discussing visiting Cisco or interning there well in advance of getting busted for spoofing their APIs.

    LoB

  • Honest Your Honor! (Score:3, Funny)

    by Stormy Dragon ( 800799 ) on Friday April 27, 2007 @06:51PM (#18907207)
    I wasn't buglarizing this house, I was just checking the home security system for holes!

  • Bait and Switch (Score:5, Insightful)

    by litewoheat ( 179018 ) * on Friday April 27, 2007 @06:53PM (#18907225)
    OK this story is sensationalist BS. Maybe the summary should have stated that he USED IT FOR SEVEN MONTHS and GAVE IT OUT TO FRIENDS!? Come on, only when he gets caught does he say he was going to share his results. Yeah, that's like embezzling and then saying you were going to give all the money back when you get caught.
  • This guy was being clever disabling the security software, nothing more. He got caught and now he's whining.

    It may be unpopular, but when you connect your computer to some networks you do so under agreement which may limit what you can do, may require you to consent to monitoring, and may require you to install software to enforce the terms of that agreement. Tampering with the software may be a violation of that agreement, it doesn't matter if it's "your" computer, we're talking contracts here.

    There's no
  • All week I been reading how the kid at Virginia Tech couldn't be dismissed from school even though he stalked, threatened and oozed a violent psyche to the point of having 2 professors ask the university for help with him. Universities should only protect students as vigorously as they seem to protect themselves in this case.

  • From what I gather, the breach occurred on his own computer!? Since when does keeping your own computer private from the intrusive eyes of others count as a computer crime?

    Essentially, what the university is asking for is the root password to your own machine, in exchange for network access. I think I'd rather do without the university network if I had to run snoopware.

    And on what ethical principle does the university believe they have a right to own a machine for which they haven't paid? I can un

Slashdot Top Deals

CChheecckk yyoouurr dduupplleexx sswwiittcchh..

Close