What to do when a hole is found?

Just the other day, i need my old high school GPA and class that i have taken. The school had an on-line system so students could check there grades. Thinking that i could still login to get the information, i gave it several trys, to realize that they no longer kept old student data.

What sparked my interest, is that on failure to login i got a 404 (page not found). I took a deeper look into the source code for the web page and found that there was no real secure authentication. The java script made a simple hash of the student ID, Turning a 5 digit integer to hex. It then tacks on the users 3 digit pin/password to the end of the hex string. It turns out this hex-string is the name of the HTML file on the server that has the students grades.

The flaws in the system are obvious. The only thing they did right was to add the directory with the student data to the robots.txt file so Google would not cache the information.

Should i let this go? Should i bring this up to the school? Would they even listen to me? Should i spend the day to write a program to anonymously brute-force every student's ID and pin, as proof how flawed the system is. I know there is no real personal info available, but why did they add the insecure authentication system.

It get worse since hundreds of schools nation wide use this exact same method, because it is part of a licenced package of software that many schools use, to keep track of students grade.

I also suspect that the pins are not random, but may derive from the student Id of students name. Since they were given, and no person has the power to change it. Hans the software that powers the grading system, generated the pin.

Wireless keyboard encryption easily broken

This was kind of an interesting story for tonight. From my readings and understanding, the encryption on Microsoft Wireless keyboard has been broken. This is nothing to be alarmed about in my opinion.

First if you ever had a RF wireless keyboard you know the range. There great in the same room but, one room away it works ok, little iffy at times; some keys may not register all the time. Therefore the hacker has to be in within 50 or so feet. So if there some one in your living room, you don't know, you have more things to worry about. Just to cover all areas in this matter, in an office build it would be very useful. If you worked at an insurance company, with hundreds of computers on the same level you’re bound to find someone typing personal information. Only problem it is an office building, wireless keyboards are not standard issued.

Besides the range, the equipment need to scan the 20 MHz frequency is not on every ones Christmas list. It may be possible to hack up an old wireless keyboard receiver, but those who have them know how limited they are. This is not like a wi-fi wep crack, since every laptop now comes with a wireless card, which has mix mode to scan the air space.


"
The encryption on Microsoft's wireless keyboards is so simple it only has 256 possible keys. You can guess the key using only 20-50 keystrokes. Someone could potentially create a wireless key logger that captures characters from every keyboard in the office.

read more digg story
"