To Report or Not To Report

I consider myself to be an ethical person. On my school's local network, I discovered a series of _HUGE_ security holes, and reported them. I was thanked for this by being suspended and having my network priveliges removed, I can no longer even log on and access the internet. I would like to point out that other than look around, nothing was confidential, I did not do anything. I did not damage any files, or anything at all malacious. They knew this.

Now, while doing a virus scan for a teacher, I noticed that the machine scanned *.PWL files. The network is run mainly on Win98 machines running NT scripts, with a Win2000 ISA Server. (....) Whenever someone logs on, windows machines makes a copy of their password on the C Drive, and its fairly easy to decrypt.

My question is, should I report this flaw or not? I can always do it from an anonymous source, but after what they did to me last time...Opinions? (Either way, I intend on keeping some Passwords so I can get on if I really need to, in case of an emergency)

That really sucks...sorry to hear that. Can't you appeal their decision? I would not tell them how bad their security is if that is the way they treat people who try to help. They would probably expell you for another occurance. :(

Remember the old saying," Let no good deed go unpunished!" I think if you had to ask the question you already know what you have to do to be right with yourself

Exactly how I feel! As it is, I have to use my laptop to do all of my work, including for several programming classes, and such. I need to get someone else to login for me to print something out! (I dare not use one of the many User/Pass combos I found.)

I also used to be the Webmaster, but they decided that my niceness made me a security threat, and needed to be removed from my position helping them. (I did, of course, never do anything but design and fix the website for the school AND the Regional Planning Commission!)

As for appealing it...I saw a quote in a 2600 that fits this situation perfectly. "We don't know what you did...nor how you did it...but we're going to punish you...and don't do it again." Or something like that.

Despite all this...I still want to help them! Do I dare though? Even through anonymous channels...

I quoted that for a full week. Silence...or Righteousnes?

Even though it would be a good deed I don't know that I would mention the password thing to them. I would just chill and continue as you are until they have a problem and can't fix it. Offer up a solution and hopefully they will see your really not a bad kid after all. Just my opinion though.

It's a really hard decision.. I think that if you try it again, even through annonymous channels, they might think it's you again and try another punishment. What they did is really disgusting.. :fpissed: I wonder if suing them would be an option. Damn, you are innocent. Well, I don't know if you found the vulnerabilities by chance, or if you were searching for them. Perhaps you should just forget about it. I wouldn't help them anymore after such a punishment, but wouldn't exploit the vulnerabilty either. "Someone the does something nasty to the network? Wasn't my fault, I told them before and was punished." And them sleep the sleep of the just.. well, almost. :/

I am tempted to let it go, tempted to take advantage of them, though that isn't an option. Shall I stay silent? Or shall I take a risk again? I discovered all faults while looking around, or in this case, doing a virii scan. Gah! <Curse> *Bleep* them! *Censored* </Curse> Oh well. I can always tell them about it later, right?

if you see a door opened that should be locked its one thing to report the open door its another to go in and snoop around then report it. the fact is you obtained illegal entrance. your lucky you didn't get arrested. breaking the law and then reporting yourself IS one of the dumber things ive heard so far this year.

it would be right to explain the possible dangers in .pwl files. just don't illustrate your point by cracking them first before you tell them

=+=+=+=+=+=+=+=+=+
I am tempted to let it go, tempted to take advantage of them
=+=+=+=+=+=+=+=+=+

i think your just looking for validation to do what you want to do anyway. so go ahead show them all how 1337 you are, get your education the hard way.

Tedob, I never went in or got illegal access to anywhere. I found ways in, and looked around on the network, to places that I was allowed into (although they shouldn't have let me in.)

Here's an idea of how stupd they were, just because I want to rant a bit. Everyone has they're own network drive, and that network drive is named after their username, such as this \\(severname)\users\ teachers\studentyears\office\admin (depending on group)\username

Thus making enumeration all to easy. These people are vindictive, and stupid.

I don't think I'll help them, but I have no intention to damage anything on the network.

Quote:

---

"Perhaps I could work for the school to look for more security holes.."
"We arlready have people who do that, and they're experts! They know what they're doing!"
*Under breath* "..Obviously they did a bad job"

---

I realized that I might get a better answer if I divide the problem into parts.

A) Do I WANT to help them at all? Yes
B) Should I help them? Yes
C) Does what happened before absolve me of this? Perhaps
D) Will I be punished if they know I report this? Yes
E) Is it worth the risk? Perhaps.

So it really comes down to two questions, C and E.

The other question that occurs to me is:
F) Will they even plug up this security hole? ...Perhaps.

So...does it seem that I am obligated to help them here, or not?

Tedob..I never said that I wanted validation. I have absolutely no intention of taking advantage of these files. To do so would be...stupid...arrogant...actually hundreds of words come to mind here, but none of them are good. Remember, temptation is not the same as doing something. :-)

I can always speak up later...but I can only be silent once. I think, for now, I won't tell them what I discovered unless I see the need to. I know its there, and no one else does, so I doubt anyone else will take advantage of it. If they do...oh well.

BTW, I modified my last post with some other thoughts that better refined the question, so make sure you see that.

(I also editted the post that Tedob1 refered to, because it apparently was unclear. He thought I was a script kiddie. LoL. To take advantage of this would go against everything I believe in, and make me a hypocrite, something I hate with a passion.)

Does anyone feel strongly that I SHOULD speak up about this?

(I'd like to apologize for problems with this being posted a few times in the same thread, in the same post and such...my browser went weird on me, and didn't tell me it had been posted. So I tried again. It should be fixed now. Hope it didn't bother anyone!)

The same thing happened to me in high school. I pointed out some problems with sam files, easily guessable passwords and some network folders that should have been read only. I was suspended the next day. The worst part was even after agreeing not to touch any of the computers in the school again the principle still called me to the office every once and a while blaming me for every single problem with the network. At lest I demonstrated the incompetence of the two admins that the school contracted. In the end they were fired and replaced with an admin that didn’t need to blame students to cover up his incompetence.

Here are a few tips about disclosing security holes in schools

1. Go to the right person
Whose ever in charge of you network might feel threaded and may decide to burn you instead of facing the facts. Good admins shouldn’t do this but most public schools don’t pay admins that much so they sometimes get stuck with one from the bottom of the barrel.

2. Don’t be a know it all.

3. Never use the word hacking, even “security hole” might be the wrong word.

4. Read that piece of paper that your school made you sign so you could use the computers. Some of those things are so restrictive you might as well just keep you mouth shut. When ever there’s a question of proper use it always comes back to that little piece of paper. Most of the ones I’ve seen are so vague that it’s almost entirely up to the staff to decide what’s allowable and what’s not.

5. Keep in mind that computer problems are the last thing that your principle wants to deal with.

6. Offer a fix if you can

7. If they get confused and end up accusing you of things that you had nothing to do with don’t think you have nothing to worry about. They might not have the knowledge to check log files and instead base there decisions on theory’s and there personal perception of how computers work.

Of course there’s the anonymous e-mail. Sounds like a great idea but keep in mind that they might just decide that you sent it because they’ve had problems with you in the past.

Disclosing security holes is a touchy subject. The right way isn’t always obvious and every situation is different. I recently discovered a hole in a testing program at the collage I attend. There is an exam file in a read only folder. You use an exam player to take the test; it asks you for a password and after the results are then sent to the instructor. The problem is that when you open the file in notepad the password is stored in clear text. Even though the file isn’t up until about 10-30 minutes before the exam it’s still enough time to copy the file and write the test a few times before class. I’ve decided that e-mailing the company that makes the product might be a better option then informing my instructor and bringing every test I’ve written on that system into question.

I am assuming you are in high school and got into this trouble? not a university of some sort. I dont know who was in charge of suspending you but if it wasnt the principal you should go to him and ask him if he will let you do security scans free of charge under his supervision. then you can give him a detailed report of everything that is wrong. Then he will be able to go to the sys admin with the information and fix whatever is wrong. If he was the one who suspended you and you really do want to help take it a step higher and talk to the superintendent of the school, give him the same speal, let him know you were suspended for reasons that dont seem logical to you. See if you can get your parents to back you up. Now if you are in college go to the dean and do the same. These are just some thoughts. let me know if it works for you

Cheers Spy

=+=+=+=+=+=+=+=+=+
Tedob, I never went in or got illegal access to anywhere. I found ways in, and looked around on the network
=+=+=+=+=+=+=+=+=+

just because you CAN get somewhere dosn't give you authorization.

http://www.swiss.ai.mit.edu/6.805/ar...-comp-law.html

Unauthorized use.

Unauthorized use is a misdemeanor and the least serious of the New York computer crime offenses. It is designed to thwart the curious hacker who gains entry into another's computer system to look around rather than to do damage.

Computer trespass. To be deemed guilty of computer trespass, a user must gain unauthorized access to a computer system and then either commit a felony or obtain "computer material," which is narrowly defined under the New York law as protected commercial information available only to specified members of the company. Examples of computer material include trade secrets databases, and member lists. Information available to the public by computer or other means cannot be considered computer material.


http://vx.netlux.org/texts/laws/new_hamp.html

I. A person is guilty of the computer crime of unauthorized
access to a computer system when, knowing that he is not
authorized to do so, he knowingly accesses or causes to be
accessed any computer system without authorization

+=+=+=+=+=+=+=+=+=+=+=+

this are amoung the first few items that i came accross but they're all basically the same.

this is what you did! If you happened to open any of the documents that where there then are guilty of computer trespass.

whatever made-up ethical standard your think your abiding by the fact remains that you broke the law.

If your not AUTHORIZED to view certain files at certain network locations and you thwarted network security procedures no matter how flimsy....you broke the law.

If you accessed an area not provided to you by straightfoward means... you broke the law

BUT...breaking the law isn't the issue here. You reported yourself.

If you must waste your time reading rable rousing documents like "the Hacker Manifesto" and consider yourself part of a non-existant organized hacker underground, at least have the smarts to read the documents that usually accompany this paper...what constitutes computer crime.

for god sakes man im not comming down on you for exploring a network thats what brought most of us here to begin with. im comming down on you for being dumb.

LoL. Tedob, I thought I had stated clearly before, though I'm sure I didn't or you would have understood, I didn't access anything I wasn't allowed to. I did find out HOW to do so, but didn't, and never broke the law. THAT is why I was surprised and upset about being punished. But that isn't the issue.

Also, "The Hacker Manifesto," which I just read for the first time, BTW, seems nice enough, but its a sentiment that many people will try and twist around. The good points that it makes don't have to be pointed out to us, and will be lost on those that do need to hear it because of how its written. But, we're not talking about that either.

And I don't consider myself dumb. In fact, I resent that statement! I prefer "Intellectually-challenged."

Quote:

---

LoL. Tedob, I thought I had stated clearly before, though I'm sure I didn't or you would have understood, I didn't access anything I wasn't allowed to.

---

Quote:

---

Whenever someone logs on, windows machines makes a copy of their password on the C Drive, and its fairly easy to decrypt.

---

Quote:

---

(I dare not use one of the many User/Pass combos I found.)

---

So... you know there are PWL files on the clients of your school network, and you decrypted the PWL files and you have a list of user/pass combinations. Easier solution - upon discovering PWL files on the clients, inform the school that a simple registry edit on the client boxes will ensure that PWL files will not be created on login (link). I honestly don't see how this could get you suspended, if you didn't do anything stupid like decrypting them and keeping a list of combinations. You could have said something about it straight after the virus scan.

Quote:

---

To take advantage of this would go against everything I believe in

---

You went and decrypted PWL files... why? You know they're a security risk. You don't need to decrypt them. All you needed to do was inform your admin.

And seriously... if you are going to get into trouble for doing this, then don't report it. Easy. If, when you reported the old bugs, you really didn't do anything wrong, and you still got suspended, well that should be enough of a hint. And yeah, this thread does basically seem like validation of your 'efforts'.

quote:
Whenever someone logs on, windows machines makes a copy of their password on the C Drive, and its fairly easy to decrypt.

That was saying that it would be fairly easy to decrypt. I have not, nor do I have any intention, decrypt any such thing.

quote:
(I dare not use one of the many User/Pass combos I found.)

Again, this is the PWL files that I could have decrypted, but I did not.

As for things before...I found holes that were obvious. You don't have to go through an open doorway to see that its there, and there's gold beyond. If you see it...its obvious.

Yes, the problem is there. Yes, I could decrypt the files and get admin status immediately. Will I? Heck no!

I really hope this clears up the remaining confusion. This post has nothing to do with "Should I 'hax0r' them or not?" But "Dare I report the problem?"

Powertoad, did I say anything else to make you think I had decrypted the files?

BTW, I haven't seen any posts from you in awhile, where have you been?

If you didn't decrypt them, fair enough, but you have to admit it did sound like you had. And I understand what your question is. It just seems that the answer is incredibly obvious. If you feel that strongly about it, send a fake email to your admin and make sure it doesn't sound like it's coming from you i.e. simply give some links to resources which will enable them to fix the holes - do not include anything in the email except these links.

Quote:

---

BTW, I haven't seen any posts from you in awhile, where have you been?

---

My last post was less than a week ago... we can't all post 28 times a day (and counting) ;)

ok maybe im reading this wrong:

"I would like to point out that other than look around, nothing was confidential, I did not do anything. I did not damage any files, or anything at all malacious. They knew this. "

you accessed an area that you were not given explicit or implyed permission to access. that is there wasnt a network drive mapped to it on windows explorer or a short cut on the desktop or a menu entry to access these files. you simply found them by exploring the network and accessed them.

you found this area and expolred it. i don't have a problem with this but believe it or not this is against the law And im sure against the schools network use policy. As illustrated by the schools actions against you.

OK lets forget about the manifesto poor choice maybe ethical hacking. i realized that was a bad choice as i was running off to the gym. But what can possibly be ethical about prying where you dont belong. i mean i do it, but i dont consider it ethical.

i am not saying you are not intelligent or that you have a low IQ i really think the opposite but not having the knowledge you need to keep your ass out of trouble makes you dumb...just like the the "self proclaimed white hats" that get busted for reporting security holes they find in web sites to the admins and give their real identities....dumb

Time seems a bit warped..I just seem to get caught up in threads like this one. ::Grin:: AO is addictive. I'll probably burn out in a week though! ::Tries to ignore the cheering in the background:: Hush you.

Glad we were able to clear it up...as for the answer being obvious...practicality says one thing, while morals says another. For me, a very difficult dilemna.

I understand what you mean, Tedob, and I do appreciate your input. I consider it worth reading and taking into consideration.

As for "I would like to point out that other than look around, nothing was confidential, I did not do anything. I did not damage any files, or anything at all malacious. They knew this. " I believe, though I don' specifically remember, that my intent was that I looked around the network. I may have been looking at files, and if I did they were ones I already had access to. Going beyond that, in a SCHOOL where there is a LOT of confidential information, means a violation of, not only the law, but people's privacy. I think we both agree on that.

Thank you for also revising your statement to make it more clear. I didn't take any insult, because I was pretty sure one of us mis-understood, and that seems correct. (Because I did.)

Thanks again!

To speak from experience here.

My HS was a Novell network until started gr 11, then we switched over to an NT Network. We had one Administrator for a school board that geographically covered around 1000sq km. So he did a lot of travelling. I ended up setting up my schools network, securing everything and such. From that point on I helped out with the computers. When i pointed out bugs, or found holes, regardless of what I'd done I was commended for it. I remember before I helped with the security I was a thorn in the schools side, i was constantly asked about problems with the computer network, and when I had internet access, the librarian stood over my shoulder the entire time. Helping the school out changed their opinion of me. I even ended up working with the Police Dept. in my town, beause they didn't have a security expert, and a student at the school I attended had received an E-mail threat. Anyways.. In a case like that I'd say point out the holes. Showing them that I could be a help greatly improved the way they looked at me.

You are to be commended for wanting to be a "good samaritan",
but they have made it quite clear that they do not want your
help.

The security weaknesses in their network are not your problem.
CYA
:cool:

Mobius, i think you are just a really gay boy that has no life and thinks he is a computer hacker or "White Hat". get a life cuz u r a loser. i know u, and i know your real name is dan. get a life.

Tedob: I gotta disagree with you......... Sorry, It's in my nature......

Permissions and rights granted by sysadmin to users are the _final_ rights and permissions. It means that the sysadmin has given permission for someone to visit a given location and what they can do within that location. The fact that a drive is not mapped to the exact location is irrelevant. The permission has been granted. It is the sysadmin's responsibility - even if he has made a mistake - not Mobius'. If the sysadmin is dumb enough to leave the default "Everyone" group permissions on the drive for example then it is sysadmin who is at fault _not_ mobius for discovering that fact.

The reason that Mobius was suspended is because the sysadmin is a spineless incompetent that would rather hide his own inadequacies behind Mobius then stand up and tell his boss that he F****d up........

If we took your approach all would be well as long as _everyone_ in the world stuck by the principles and rules you are putting forth.... but what happens when a single person breaks from your "tradition"...... It kinda all goes to rat$hit doesn' it? It's for that very reason that all countries maintain an army - 'cos you can't trust the guy next door.

Mobius: Forget them. You learned your lesson once.... the lesson being that there are lots of people you will meet that are more powerful than you by 10 times and more incompetent than you by 100 times and that those are always the one who have no backbone or integrity and will do anything to conserve their little job that they are clearly not qualified to do including stab you in the back if you uncover their incompetence.

Let them sit there in utter ignorance until someone with less integrity than yourself hacks their system up a treat then sit back and giggle knowing that they had the answers right there in front of them if they had had the good sense and grace to ask for them.

Do as you have been told and do not touch a school computer ever again......

Hi all.

Quote:

---

You are to be commended for wanting to be a "good samaritan",but they have made it quite clear that they do not want your
help.

The security weaknesses in their network are not your problem.
CYA

---

Thats straight forward, and to the point. I agree with this 100%.



^Mobius^:
Why whine about how others react to your actions. Let them take care of their own problems. Now you said that your responsible for all glitches that arise. Heh. Why want to help them. Or did you do something that indeed causes problems?

Cheers.

Some ISP's are real STUPID!!!
Some are real good and will thank you......
:3pow: Some Admins should also be HUNG for their security habbits.

You just lucked out and got a STUPID ISP/Admin and and got SCREWED!!!

:ubergun: Luck has it you did not end up in Jail for being a nice guy.

I know the feeling.... Click on the link below

http://www10.brinkster.com/cecomet

I can realate to where your comin from ^Mobius^ the same kinda thing happened to me. some stupid kode kiddie phuked with the system file so that the comp always booted in safe mode. the admin fixed this prob but didn't disable boot keys i showed the librian that one in safe mode someone could access the registry and disable everything. i was allmost explelled.
long story short i now keep my mouth shut about every and all security problems.
if i were you i wouldn't bother with them.
dont cause trouble just don't provide help.

Quote:

---

Originally posted here by Highlander
Some ISP's are real STUPID!!!
Some are real good and will thank you......
:3pow: Some Admins should also be HUNG for their security habbits.

You just lucked out and got a STUPID ISP/Admin and and got SCREWED!!!

:ubergun: Luck has it you did not end up in Jail for being a nice guy.

I know the feeling.... Click on the link below

http://www10.brinkster.com/cecomet

---

I visited the site in this link and clicked on a couple of the links on it, I eventually ended up trying to visit a site I cannot pronounce ch(something something)lake.com or something. I was useing Mozilla browser and was greeted with a popup warning me of an invalid certificate or something and if I would allow the connection, I told it to allow it just this time, and I got another one saying that the reason I am getting the popups is because some site code is trying to gather information from my computer I don't want anyone to have. Now when I try to access AntiOnline with Mozilla browser I get a message that connection to AO is being refused. WTF?????????

Blackdeath00, I've said my name is Dan many times on this site, and others I've linked to here. My full name, for anyone who cares, is Daniel MacCurdy Burnet. I live at 186 Kunkle Road in Fawn Grove, PA 17321. My phone number is (717) 382-9971. Give me a call if you want. :-)

Also, I'm not a hacker, or a White Hat, since that would say I gain illegal access to a system, even with the best of intentions. I don't.

Now, as for this topic, the only reason it popped up was because BlackDeath00 there decided to call me gay "annonymously" through these boards. The topic is pretty much...closed. The issue was long ago resolved. Thanks for everyone's help and input. :-)

These things happen.

You tried to do someone what you saw as a good turn, and they didn't want it. You knew the risks when you decided to play, and if you didn't, you should have.

By accessing without / in excess of authorization, you implicitly accept the possibility of consequences.

By placing a network in a context where users can access it, one implicitly accepts the possibility of access.

The final authority on what form that access will take rests with the individual doing the accessing. In practical, realistic terms. Because that's what security is. Reality and realism. Sanctimony is fun, but it doesn't stop intrusion.

If they/you/whoever don't want to have unauthorized access, do not have a network.

There. Is. No. Other. Way. To. Prevent. It.

Whether they slap you down when you think you're trying to help them, or shake your hand and call you a hero, don't believe it's wasted. It's never wasted. Every action we take in this place contributes to its evolution. "Complex system" means more than unauthorized access. It means possibilities no one ever intended. Unauthorized access is just one of them. Some better, some worse.

We have seen others, and we will live to see more.

Don't stop exploring.

Cheers,
-- Adrian