Oxford May Suspend Students Who Pointed Out Network Flaws
from the shoot-the-messenger dept
Stories like these are way too common these days. Two Oxford University students, working for the school newspaper, figured out how easy it was to break into the school's network and access private student data. They wrote up a front page article on the vulnerabilities in the system, and were promptly handed over to the police. The police told the university to handle it internally, but Oxford is now looking at suspending the students and potentially fining them as well. Of course, there's no word whatsoever on whether the university actually patched the holes in their system. Why is it that so many people who point out security vulnerabilities are immediately accused of criminal acts? This only gives good people the incentive not to find and point out these vulnerabilities -- but you can be quite sure that those up to no good are already exploiting them.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Reader Comments
Subscribe: RSS
View by: Time | Thread
...
The point of full disclosure is to get the word out to others whose systems may be vulnerable. Telling the world about local problems before anyone can fix them is downright destructive.
[ link to this | view in chronology ]
Is it really not clear to you?
Pointing out network or software vulnerabilities to internal administrators who can fix them is GOOD. Shouting them from the rooftops or putting them in print is BAD...it's the equivalent of a bank employee handing out keys to the vault to anyone who passes by on the street. And if you don't want to get handed over to the police, simply avoid breaking into your school's private files and accessing confidential information.
As a network admin with some experience in this area, I'll share a little secret: Well-meaning people don't spend their spare time trying to find vulnerabilities in someone's network. If they do, they're getting paid for it by the network's owner. And for that rare Internet Robin Hood who is the exception, they still wouldn't publicize their findings without notifying the powers-that-be beforehand.
Your moral compass is due for some recalibration, man...
[ link to this | view in chronology ]
Re: Is it really not clear to you?
An insecure system is insecure period. Obscurity is not a valid security policy. In addition the students were working on the school paper. The lesson they are liable to learn from this incident is that investigative reporting does not pay. Not a lesson any school should be teaching.
[ link to this | view in chronology ]
It happened to a local school system here
The school shutdown the network, set the access to closed, and now all the parent volunteers can't access it, including the network admins.
No police were called. It must be the type of culture in England to treat whistleblowers differently (they even made a movie about it where the whistleblowers are blown up in the end)
[ link to this | view in chronology ]
To the first two reponders:
[ link to this | view in chronology ]
The "Oxford Student" article
University IT network wide open to hackers
[ link to this | view in chronology ]
Morally wrong
Publishing their way of getting into the network is wrong. Had they gone to the administration & reported it, I highly doubt they would be in the trouble that they are in.
[ link to this | view in chronology ]
Re: Morally wrong
1. They did tell the administration before publishing the story.
2. They didn't publish *how* they did it, just that they had done it.
[ link to this | view in chronology ]
No Subject Given
[ link to this | view in chronology ]
because....
[ link to this | view in chronology ]
Re: because....
[ link to this | view in chronology ]
Big Brother loves you ...
Report to the ministry of information for reprogramming.
Big brother loves you ...
[ link to this | view in chronology ]