This post’s regarding various security holes I see in the schools’ computer system. Please note that I am not trying to hack the school’s system. ( I promised Mr. Low that I won’t. ) This is posted here in the hope that they will fix it. Also, I did not actively audit the system, these are just some that I come across without auditing.
Wireless system
When I first came into Temasek Junior College, I met the IT assistance/manager ( His name is Yang Le, or however it should be spelt ), and he bet with me that I cannot retrieve the schools wireless password. He also claimed that the password is secure, because it is long…
However, a standard WPE password must be 26 character long, and is made up of hexidecimal. Therefore, his password is as strong as all the other WEP passwords. His claim of his password being more secure is a false claim.
Anyway, the bet is still on, so that day, I spent half an hour coding a simple keylogger on my previous laptop, a Compaq Presario 1500. It took me 5 minute to start up my comp, another 5 minute to start up Visual Studio 2003, and another 7 minute to create a new project. ( That laptop retired just one month ago, since it is too old. )
A keylogger’s done in 10 minutes time, abusing the GetAsyncKeyState() API is quite fun indeed. I am quite amazed that one of my classmate, S??????n recognized that it is C++ language. ( Name censored for privacy. )
I keylogged him ( The IT Assistance ), and obtained the wireless password. Which is just as what my classmates found out from our senior, the factory defualt for 3com wireless accesspoint.
Later, I talked to Mr. Low, the IT manager ( or whatever position he held. ). He told me that it is the factory defualt, not for security, but because it is troublesome to change every of the accesspoint in the school.
The nature of wireless network allowed every single computer on the network, or in some circumstances, any computer within the range of the transmitter, to recieve what everyone’s talking about on the network. Since the signal’s transmitted into the air.
With this nature of wireless network, information is easily accessible. Therefore, the extra security measurements need to be in place.
The e-learning portal – The MaTrix
I am quite pleased that the e-learning portal have a basic form of encryption in place to prevent password from being transmitted as plain text. They also ensured that the password cannot be derived from what is sent across the net.
How they achieved this is described below:
1. When the login page is displayed, the server generate a seed and send you.
2. When you login, the password is encrypted with digestive algorithms like md5. Furthermore, to prevent brute force of md5 with precomputed table, the salt/seed is added to the password.
3. Together with the username and seed, the password in the form of hash is sent to the server.
4. The server md5 the password from the database, with the seed, then compare the result to the one recieved from your browser.
5. It set the cookie if it matches.
The method is quite good, but not without weakness:
1. We now know that the passwords are stored in plain text, which is not a good practice. ( Maybe not, seemed that the password’s passed md5() twice… )
2. We don’t need the password to login, we just take the hash, username, and seed ( that we obtain by some ways ), then we can send it to the server like how legitimate logins are made, the server would acknowledge the login, and we are in.
To fix no. 2, the server should set a timeout for each seed.
The Student Portal
I am quite pleased that the student portal is taking the same strategy as The MaTrix, md5 the password before it is send onto the net.
Yang Le ( Or however his name may be spelled. ) did a good job in writing the Student Portal. It is more advanced in security than the MaTrix, as it made use of the ASP Session ID properly.
I dare not say that the Student Portal is secure, but I would say that it is secure comparatively to the MaTrix.
There is a vulnerablity in the staff/student directory page, that allowed arbitrary remote SQL code execution. By submitting a specially crafted string as the keyword, the attacker can do anything to the database, that includes… sadly… drop database;.
To fix it, the search page should convert special characters, such as “‘”, “:”, “;”, into escaped form, eg: “\’” ( Examples in this sentense is without the double quotation — ” )
Another vulnerablity with the student portal is that the search page doesn’t not limit the interval of your search query. This could be a potential vulnerablity to DDOS, probably given the power of 2 to 3 computer, any attacker can crash the Student Portal SQL server or even the web server, if they are the same box.
To Yang Le, in case he is reading my blog: I am waiting…. For a proper legal statement of the student portal.
After all, I have not even started. This is just some bugs that I spotted while in school. Perhaps I will start the real auditing when Mr. Low give me the permission…
————————————————————
The weird thing about my blog is that it does not have any link to other’s blog, eg: my classmate’s blog.
My blog is going to have a link section!
Those who want to be linked, please leave a comment.
For h4xx0rs, I don’t want to link your “life” blog, sorry. Techical blog only. ( A mixed one’s alright.. perhaps… )
Posted by john0312 
Posted by john0312 
Posted by john0312 