Full Disclosure mailing list archives
[Fwd: Re: Web security breach changes the lives of 119 people]
From: Jason Coombs <jasonc () science org>
Date: Sat, 12 Mar 2005 08:57:29 +1300
Once again, securityfocus.com refuses to post the truth.Anyone who has been following the story of the Harvard Business School applicants and others who allegedly hacked a Web site operated by ApplyYourself Inc. will find the following information valuable.
And you can't get it on securityfocus.com. Why is that, exactly? Regards, Jason Coombs jasonc () science org -------- Original Message -------- Subject: Re: Web security breach changes the lives of 119 people Date: Thu, 10 Mar 2005 21:21:13 +1300 From: Jason Coombs <jasonc () science org> Reply-To: jasonc () science org To: Richard M. Smith <rms () computerbytesman com> CC: webappsec () securityfocus comReferences: <E1D8hZR-000510-00 () smtp01 mrf mail rcn net> <422F963A.2030908 () science org>
Here's a description of the hack: http://tinyurl.com/63znp ... the gist of which is ... ApplicantDecision.asp?AYID=GUID&mode=decision&id=1234567 My point is that once your browser has been assigned the GUID of a valid/active session, an application status is obtained simply by entering a seven-digit number and tweaking the URL name/value pairs. Chances are, the "applicants" who looked at their own application status were predominantly script kiddies who were having fun poking around by exploiting the hole. In case Harvard isn't aware of this, a seven digit number is not difficult to guess, and if you know your own (or somebody else's) valid seven digit number, and if the numbers are assigned sequentially, then, well, there's nothing even to guess... As Richard M. Smith points out, this could very well be a simple Web security breach -- but where's the proof that the 119 people actually did this thing? There is none, and chances are very good that the security flaw in the Web site allowed anyone to poke around and look at anyone else's application status just by inserting a seven digit number. Let's throw out all of the applicants for this year and leave the Harvard Business School empty to memorialize the dramatic decline in business intelligence that is caused by computers and the Internet. Regards, Jason Coombs jasonc () science org -------- Original Message -------- Subject: Re: Web security breach changes the lives of 119 people Date: Thu, 10 Mar 2005 13:35:06 +1300 From: Jason Coombs <jasonc () science org> Reply-To: jasonc () science org To: Richard M. Smith <rms () computerbytesman com> CC: webappsec () securityfocus com References: <E1D8hZR-000510-00 () smtp01 mrf mail rcn net> Chances are that nobody at Harvard Business School or ApplyYourself Inc. bothered to contemplate the most obvious scenario: that somebody other than the 119 accused, or their friends and family, was responsible for the majority of (or all of) the attempts to access application records. What information of a personal nature would have been required in order to access the pending application? Social Security Number? Perhaps it was possible to browse any one of the pending applications once one had penetrated the ApplyYourself Inc. security perimeter. Are 118 applicants being accused of hacking because of the actions of a single applicant? This is more likely than is the scenario as it has been depicted. Unfortunately, even Harvard Business School now believes, in the current climate of mistrust and fraud in the U.S. Government and U.S. marketplace, that it is more likely that the 119 applicants just couldn't wait for their admission answers through proper channels. Common sense is dead. Long live the Internet. Regards, Jason Coombs jasonc () science org Richard M. Smith wrote:
http://www.boston.com/business/articles/2005/03/08/harvard_rejects_119_accus ed_of_hacking_1110274403?mode=PF Harvard rejects 119 accused of hacking Applicants' behavior 'unethical at best' By Robert Weisman, Globe Staff | March 8, 2005 Harvard Business School will reject the 119 applicants who hacked into the school's admissions site last week, the school's dean, Kim B. Clark, said yesterday. ''This behavior is unethical at best -- a serious breach of trust that can not be countered by rationalization," Clark said in a statement. ''Any applicant found to have done so will not be admitted to this school." A half dozen business schools were swamped by a wave of electronic intrusions Wednesday morning, after a computer hacker posted instructions on a BusinessWeek Online message board. Harvard is the second school to say definitively that it will deny the applications of proven hackers. The first was Carnegie Mellon's Tepper School of Business, where only one admission file was targeted. ... In most cases, applicants from around the world saw only blank screens when they hacked into their files, but some Harvard applicants glimpsed preliminary decisions about whether they would be admitted. Other business schools said they had yet to post any information in their applicants' files. Some business school administrators have said they were being cautious in their reaction because their software vendor, ApplyYourself Inc., can identify which admissions files were targeted but not who tried to access them. Theoretically, at least, a hacker might have been a spouse or parent who had access to the password and personal identification numbers given to a business school applicant. Clark, who said Harvard was working with ApplyYourself to determine the hackers' identifies, rejected that distinction. ''We expect our applicants to be personally responsible for the access to the website, and for the identification and passwords they received," he said..
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://www.secunia.com/
Current thread:
- [Fwd: Re: Web security breach changes the lives of 119 people] Jason Coombs (Mar 11)