{"id":9,"date":"2005-03-31T10:01:31","date_gmt":"2005-03-31T14:01:31","guid":{"rendered":"http:\/\/blogs.law.harvard.edu\/zeroday\/2005\/03\/31\/hacking-clearly-not-what-it-used-to-b"},"modified":"2005-03-31T10:01:31","modified_gmt":"2005-03-31T14:01:31","slug":"hacking-clearly-not-what-it-used-to-be","status":"publish","type":"post","link":"https:\/\/archive.blogs.harvard.edu\/zeroday\/2005\/03\/31\/hacking-clearly-not-what-it-used-to-be\/","title":{"rendered":"Hacking clearly not what it used to be"},"content":{"rendered":"

<\/a><\/p>\n

A student from UCSB is charged with 4
\nfelony counts in a “Ferris Buller’s Day Off” enactment. 
\nRamirez used some crude tactics to change the password of some
\nprofessors and then change her grades and the grades of several
\nothers.<\/p>\n

A few things here that bother me about using the word
\nhacking.  She didn’t use any sophisticated means to penetrate
\nthe eGrades system.  She didn’t have the foresight to actually
\nmask her IP by using a proxy or anonymous WiFi.  Ramirez worked
\nfor AllState insurance and the professors were listed in her
\ndatabase.  With access to AllState information she was able to
\nflesh out the DOB and SSN.  This would have been the case if she
\nhad worked at the professors cell phone provider too. <\/p>\n

“Knowing what information you need in order to do the
\npassword reset and gathering that information and then going and
\nsubmitting the grade changes — you don’t just trip and
\naccidentally fall into that,” Schmidt said. “That requires some
\nspecific planning and effort to do that.”<\/p>\n

<\/i>This clearly
\nshows malicious intent.  The act was planned out and she (and
\nany accomplices) knew what they were doing.  I imagine that she
\nwas sitting at work and looking up random people that she knew. 
\nI imagine this is something that is common among ALL workers who have
\nthis type of access.  One has to wonder when companies will be
\nheld responsible for the sloppy dissemination of personal
\ninformation.  When she got a hit on her professors information
\nthe idea probably clicked in her mind.  This seems like the most
\nlogical scenario since she actually logged into the eGrades system
\nfrom work.  Although there is a feedback system that is supposed
\nto catch these types of acts I wonder just how well it would have
\nworked if the two had not gone so far.  <\/p>\n

“Ramirez,
\nwho could not be reached for comment after repeated phone calls
\nTuesday evening, changed her grade in one class from a B to an A,
\nSigna said. She also altered the grades of her roommate from an F to
\na B+ in one class and from a B to an A+ in another class, Signa said.
\nFurther details about other changes Ramirez made were not available
\nat press time.”<\/p>\n

<\/i>Had Ramirez left the other grades
\nalone and changed the F to a D- (which is still passing) it might
\nhave gone unnoticed.  In this type of flagging system I would
\nimagine that the system notices grade changes that are greater then 1
\nor 2 points.  So an F to a B+, which is a 3.5 jump, should and
\ndid trigger an alarm.  I am totally speculating at this point so
\nplease let me know if I am way off base here.  <\/p>\n

More
\nimportantly, and something I alluded to earlier, is that information
\nworkers have much more access then I think is warranted.  As an
\nexercise go to your cell phone providers local presence and talk to
\nthe folks at the counter about your account.  The terminals at
\ntheir locations are capable of looking up any account, pulling up the
\nfull details of your call history, not to mention all of your
\npersonal details.  With the companies all merging having an
\nentry level job at one of these stores means you have a one in three
\nshot at any single persons personal information.  I have a
\nfeeling AllState had no clue that an employee was abusing her system
\naccess until the police came in with a warrant.  This problem is
\nlikely far more pervasive then they would like to admit.  <\/p>\n","protected":false},"excerpt":{"rendered":"

A student from UCSB is charged with 4 felony counts in a “Ferris Buller’s Day Off” enactment.  Ramirez used some crude tactics to change the password of some professors and then change her grades and the grades of several others. A few things here that bother me about using the word hacking.  She didn’t use […]<\/p>\n","protected":false},"author":214,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-9","post","type-post","status-publish","format-standard","hentry"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/users\/214"}],"replies":[{"embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":0,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"wp:attachment":[{"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/archive.blogs.harvard.edu\/zeroday\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}