{"id":7,"date":"2005-03-09T07:16:24","date_gmt":"2005-03-09T11:16:24","guid":{"rendered":"http:\/\/blogs.law.harvard.edu\/zeroday\/2005\/03\/09\/rejected-harvard-applicants-say-schoo"},"modified":"2005-03-09T07:16:24","modified_gmt":"2005-03-09T11:16:24","slug":"rejected-harvard-applicants-say-schools-reaction-to-web-page-hack-e","status":"publish","type":"post","link":"https:\/\/archive.blogs.harvard.edu\/zeroday\/2005\/03\/09\/rejected-harvard-applicants-say-schools-reaction-to-web-page-hack-e\/","title":{"rendered":"Rejected Harvard applicants say school’s reaction to Web page “hack” excessive"},"content":{"rendered":"

<\/a><\/p>\n

What happened here is something referred to in my industry as script kiddies.  <\/SPAN>One “hacker” finds a loop hole and creates instructions or a program which can replicate this vulnerability.  <\/SPAN>He feeds it to othersthat are not as skilled and they can “hack” in at the push of a button.  <\/SPAN>119 script kiddies attacked the ApplyYourself web site trying to find out if they were admitted early.  A rabid user of the Business Week forum<\/A> posed what seemed to be a repeating, and totally untrue, meme.<\/SPAN><\/P>
\n

 <\/P>
\n


\n

“Its easy to speculate on the motives and thoughts of those who did from a safe position, but “not having a link” doesn’t make something confidential”<\/P><\/BLOCKQUOTE>
\n

 <\/P>
\n

This is not correct.  <\/SPAN>Yes, the page was available via the public facing internet.  <\/SPAN>So are the credit card numbers you enter into Amazon and other e-commerce web sites.  <\/SPAN>One merely needs to know how to manipulate the database from within the web application.  <\/SPAN>If you heard that you could access a list of credit card numbers by inputting a “special url” wouldn’t that be unethical?  <\/SPAN>Actually, that would also qualify as illegal in most countries.<\/P>
\n

Another simple example would be a web servers password file.  <\/SPAN>A long time ago directory traversal was a common problem with web servers.  <\/SPAN>This vulnerability would allow one to “traverse” backwards through directories by inputting “..\/” into the URL.  <\/SPAN>On most UNIX based servers the passwords to every users accounts were located in a file in the \/etc directory.  <\/SPAN>So if the server was affected by this bug then<\/P>
\n

http:\/\/www.vulnerablesite.com\/..\/..\/..\/..\/..\/etc\/passwd<\/STRONG> would display everyone’s username and encrypted password. Tools like John the Ripper would allow the newly purloined passwords to be cracked.  <\/SPAN>So here is a case where one simply entered a URL to a file that “didn’t have a link” yet I think it’s pretty widely held that this activity would be considered illegal and unethical.<\/P>
\n

 <\/P>
\n

I work as a consultant who is paid to find security holes in web applications (obviously I was never hired by AY) and most of the issues I find could be construed as public files.  <\/SPAN>Not to belabor the point but when Adrian Lamo<\/A>, the “homeless hacker”,<\/A> was arrested for breaking into the NY Times<\/A> and using their Lexis Nexis account he was accessing via special URL’s too.  <\/SPAN><\/P>
\n

 <\/P>
\n

There was a lot of chatter in the Business Week forum about a lawsuit against HBS.  <\/SPAN>I find it unlikely that an attorney would bother taking up this cause.  <\/SPAN>One poster asked, <\/P>
\n


\n

“Does HBS have it anywhere in writing that figuring out to how access the site through changing links is grounds for immediate rejection and did any applicant sign that statement?  <\/SPAN>Probably not.  <\/SPAN>Thus, no contract was established that applicants agreed not to use obvious loopholes to access their own files earlier than the set date.”<\/P><\/BLOCKQUOTE>
\n

An interesting argument.  <\/SPAN>I would imagine that HBS has the authority to deny applicants on whatever grounds it sees fit so long as they don’t violate civil rights<\/A>.  <\/SPAN>This issue has nothing to do with race, color, sex, sexual orientation, religion, age, national or ethnic origin, political beliefs, veteran status, or handicap.  <\/SPAN>It is based on what HBS believes to be an impaired judgment.  <\/SPAN><\/P>
\n

<\/SPAN>Let’s assume for a moment that one of these future leaders saw a post somewhere that claimed to allow “special access” to a potential clients contract database.  <\/SPAN>The database was housed in a law firms not so secure website but is not supposed to be viewed by anyone except the law firm and it’s clients.  <\/SPAN>This future leader enters into the web application to see whether or not he had won the bid and upon seeing that he didn’t calls in a lower price.  <\/SPAN>Is this illegal?  <\/SPAN>It’s questionable but I would lean towards yes.  <\/SPAN>Is this unethical?  <\/SPAN>Absolutely.<\/P>
\n


\n

“For all that to be trumped by a poor decision made in the middle of the night is incredibly unfair,”   <\/SPAN><\/P><\/BLOCKQUOTE>
\n

This is a very fair statement for all concerned.  <\/SPAN>It is unfair and unfortunate.  <\/SPAN>From HBS’s perspective though this incident served as a quick litmus test for one of the biggest traits that I like to see in business leaders.  Ethics.  <\/SPAN>From what I’ve read about 900 students are admitted to each class.  <\/SPAN>For those 900 slots THOUSANDS apply each year.  <\/SPAN>I would imagine that more then 900 are qualified to attend and this puts HBS in the unfortunate position of rejecting perfectly qualified candidates.  These 119 students simply made the task easier.<\/SPAN><\/P>
\n

<\/SPAN>I’ll leave with this thought.  Of all the analogies I read the best one supposes that “200 students are waiting around in the admissions office when the person behind the desk runs out on an emergency. The filing cabinet behind the desk has a clear label stating ‘Admissions: Acceptance List’.  <\/SPAN>A few students walk behind the desk and open the cabinet and peek inside.  <\/SPAN>Little do they know the entire thing is captured on a video camera overhead.  <\/SPAN>Upon seeing this the review board rejects all the students involved.”<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"

What happened here is something referred to in my industry as script kiddies.  One “hacker” finds a loop hole and creates instructions or a program which can replicate this vulnerability.  He feeds it to othersthat are not as skilled and they can “hack” in at the push of a button.  119 script kiddies attacked the […]<\/p>\n","protected":false},"author":214,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-7","post","type-post","status-publish","format-standard","hentry"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts\/7","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/users\/214"}],"replies":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/comments?post=7"}],"version-history":[{"count":0,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts\/7\/revisions"}],"wp:attachment":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/media?parent=7"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/categories?post=7"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/tags?post=7"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}