Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Over the Summer I found a cookie put on my computer by the school's network that seemed like it could be a problem. It stored authentication information and (long story short) I found if you put in other people's easily attainable information, you become signed in as them. Slow but sure, I discovered 3 security exploits that, when working together, compromised ALL security on the website. In theory I could sign in as teachers, access any student's email (with capabilities to send), adjust all grades, anything I wanted to do, I could do. They have since fixed this error, not only is the cookie gone, but the site is replaced with a Microsoft Sharepoint foundation instead of their "roll your own" system.

I didn't research this to take advantage of the exploit. I did it because these exploits would allow MY information to be viewed by ANYBODY, a student of the school or not. So I went to my School's IT so that they would fix it. They did, and almost a month after they fixed, I decided to write a 2 page-ish article on my blog. I'd link to that page now except that the head of IT has asked that I take the page down. He claims we agreed that I'd never talk about the exploit to anybody outside of IT. I know I never agreed to that because since square one I wanted to take credit for my 3 or 4 weeks of hard investigation and work, I fully intended on telling people about the problem.

I wrote my article with discretion. I never mentioned the school's name and it had very little subjective content, it was primarily how I found the exploits, what they were, and how they could be used. The idea was that if I talked about it from the point of view of the discoverer, it'd show insight into how to develop against it. The school was very appreciative that I did not use these exploits and that I came straight to them with the intention of fixing it.

I only blog about Software Development concepts. Finding security holes in the wild like this is a perfect subject for my blog. Also, I want to make a name for myself in the cyber security world, Bruce Schneier linked me to an article in his blog talking about how if you want to make a name for yourself in the cyber security, you need to break ciphers, find security holes and fix them, and such.

In short, I feel I deserve credit for the hard work I did, they feel that the school's image is more important even though the security hole is more than fixed. What's the best way to go about getting my credit here?

I have posted a pseudo censored version in the mean time.

UPDATE: no more pseudo censored version, I just put up a new article that's a little more ambiguous about it even being a school. New article can be found here.

share|improve this question

closed as not constructive by David Thornley, Mark Trapp, bigown Oct 14 '10 at 15:31

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
What's the point of asking this here? You appear to be posting a one-sided and vague account of something, and asking for support. –  David Thornley Oct 12 '10 at 21:41
1  
I'm asking to get an answer. A more abstract question might be "When talking about computer security holes in a public context, how do you respond to censorship requests?" and mine has particular details. –  Corey Ogburn Oct 13 '10 at 5:13
    
This question could be edited to meets the 6 guidelines and could be reopen. –  bigown Oct 14 '10 at 15:33
add comment

8 Answers

up vote 10 down vote accepted

Of course you deserve credit for the hard work you did. But not at the expense of other.

If the head of IT asked you to remove the blog post, there is good chances that he thought it would be detrimental to him and/or the school.

The freedom ends where another's begins.

Now, I think it would be acceptable to publish something about your experience if:

  • You don't mention it's a school (people that know you will make the link)
  • You don't mention real names or anything that may let people identify people or organizations.
share|improve this answer
1  
+1, I would keep it up. –  Josh K Oct 12 '10 at 15:36
2  
Assuming his name is on his own blog (highly-likely), wouldnt it be easy to find out what school he went to? –  rmx Oct 12 '10 at 15:43
2  
That's why you shouldn't write that is was in a school. –  user2567 Oct 12 '10 at 15:50
1  
So we can never criticize a school's lack of basic security knowledge because it encroaches on their freedom? I'm not aware of the right to "freedom from criticism." Next time Microsoft fixes a hole, should we tell the security sites to withhold the company's name? OP shows how crappy some programmers can be. If they didn't code it, ask them who did. Nothing like a little embarrassment to better make sure something like this cookie approach doesn't happen again. –  webbiedave Oct 13 '10 at 18:25
1  
@Corey Ogburn: what rmx means is that it would take 5 seconds to find out where the author went to school. Reading your blog then finding this post one could deduce the author is speaking about his school: Oklahoma Christian University. –  webbiedave Oct 13 '10 at 18:42
show 3 more comments

Hold on to your article until you finish school. Once they don't have the upper hand (of possible suspension or expulsion), go ahead and post it and take all the credit you want.

share|improve this answer
    
-1 because I think this is bad advice. Considering that lots of recruitment happens while people are still in school, it could hurt the potential chances for finding work in the field. –  Steve Evers Oct 13 '10 at 17:26
1  
@SnOrfus Rather depends on the field, if your chosen field relies heavily on your ability to detect and reveal such security holes, then I rather think it would help. –  Orbling Dec 3 '10 at 1:49
add comment

A LONG LONG TIME AGO, I noticed a peculiarity on a section of SOME ESTABLISHMENT's website where all of the ESTABLISHMENT's services are centralized. Upon further inspection, it was a weakness in the site's authentication. For the record, ANY LIKENESS TO REAL EVENTS ARE PURELY COINCIDENTAL. This lead me to investigate what of THE information is made available through these exploits. I was driven to find out because THE information was available and you always assume that if you can get to it, anybody can.

Aside from the rediculous use of ALL UPPERCASE LETTERS TO ENSURE EVERYONE NOTICES YOU AREN'T TALKING ABOUT A PARTICULAR ESTABLISHMENT, I would say it's fine.

Some things to note:

  • Can they prove that this article is in some way connected to the school?
  • Is the school administration asking you to take it down? If so then you need to meet with someone and discuss. If it's just the head of IT then I would say it's a pride issue.
share|improve this answer
    
yeah... don't know if it was a good idea or not, but I prefer the pseudo censorship to the complete censorship of removing the article. The article is already in people's RSS feeds around campus. –  Corey Ogburn Oct 12 '10 at 15:43
    
Normally you leave a comment when you downvote. –  Josh K Oct 12 '10 at 15:43
    
P.S. I did not downvote. –  Corey Ogburn Oct 12 '10 at 15:45
    
@Corey: I know you didn't. ;) –  Josh K Oct 12 '10 at 16:00
add comment

Did you sign anything saying you wouldn't talk about it? What can he do if you post it? Honestly it look likes someone wanting to keep a huge mistake quite. Post your blog entry, as long as it's discrete about the school it shouldn't be much of a problem.

share|improve this answer
add comment

Why don't you post your article, leave it as is, and add a section identifying that security holes will happen and it's the quick thinking and quick reactions of organizations like this school that are required in the software industry to keep security standards up to date and information safe.

  • +1 career
  • +1 school rep
share|improve this answer
add comment

I think you have to decide which is more important, taking the credit for finding the security flaw or your standing as a student.

Assuming you in the USA, I think the school has most of the power if you are currently a student there. If you decide to push taking the credit, the school could push back saying that you violated the ethics they expect from their students and could try to expel you. Is that right? No, but it is how things seem to work in schools these days.

share|improve this answer
    
In that case I would deny that this article was in any way reference to that school and was part of another sites security analysis. –  Josh K Oct 12 '10 at 15:37
    
@Josh K: But if the school recognizes itself in the article, even if you don't mention it; it could still decide to take action. School administrators have too much power over students these days and it is very easy to lose if you push. –  Jeff Siver Oct 12 '10 at 15:41
    
Which would be a good case for sitting down and discussing the issue rather then blindly sending a cease-and-desist style note. –  Josh K Oct 12 '10 at 15:42
add comment

I'd be inclined to check with someone higher-up than the IT-guy before you publish it - it was his mistake, and he should take the stick for it. Don't defend someone else's mistake at the cost of your own success.

share|improve this answer
    
Don't be so quick to assign blame. It's may not have been the IT-guy's mistake. Universities typically have entire departments devoted to that sort of thing and may have bought the solution from another company. –  Anna Lear Oct 12 '10 at 15:49
1  
I see what you mean and I can sympathise with the IT-guy. But infact, if it was someone else's fault, or the fault of some third-party, all the more reason to publish, surely? –  rmx Oct 12 '10 at 16:04
    
@rmx in a sufficiently obfuscated form, sure. But if it identifies the school in any way, I can see why they'd want it taken down. It's a public image thing. –  Anna Lear Oct 12 '10 at 16:08
    
@Anna Lear, Sure they would want it taken down for public image reasons. But is that a good enough reason to not expose the truth? –  Oddthinking Oct 12 '10 at 16:15
1  
@Anna Lear, @rmx, @Oddthinking: I do not seek to shame my school. I love my school, I just hate it's IT as a group (the individuals are pretty cool). I don't even want to publicly shame the IT. I want credit for my work, I worked for 3 or 4 long weeks to fully understand the limits of this exploit. Instead of bringing down the school, I'd like recognition for my hard work. –  Corey Ogburn Oct 13 '10 at 5:19
show 3 more comments

They have no leg to stand on (the IT guys). Unfortunately, they might be in a position to screw you up. So you have to make the choice of whether to

  1. Post it and deal with the possible consequences,
  2. List item
  3. List item

Post it anonymously and wait till the time is right to take credit for it, or

Don't post it until much later (when you out of school), as a type of memoir or anecdotal chapter in a security blog or book.

Just because you did something that you should take credit just now, that doesn't mean you must take the credit right this moment. To build your career, it takes time. This can certainly count in a chapter, paper or blog on, say, Social Factors in Computer Security or something like that. Security is not just mechanical/computational. It is also social, and those who excel at security understand that.

Don't let ego get over pragmatism. Battles are not won by ego (at least not efficiently). Learn how to fight your battles if you want to build your professional reputation. It is essential that you do so.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.