Over the Summer I found a cookie put on my computer by the school's network that seemed like it could be a problem. It stored authentication information and (long story short) I found if you put in other people's easily attainable information, you become signed in as them. Slow but sure, I discovered 3 security exploits that, when working together, compromised ALL security on the website. In theory I could sign in as teachers, access any student's email (with capabilities to send), adjust all grades, anything I wanted to do, I could do. They have since fixed this error, not only is the cookie gone, but the site is replaced with a Microsoft Sharepoint foundation instead of their "roll your own" system.
I didn't research this to take advantage of the exploit. I did it because these exploits would allow MY information to be viewed by ANYBODY, a student of the school or not. So I went to my School's IT so that they would fix it. They did, and almost a month after they fixed, I decided to write a 2 page-ish article on my blog. I'd link to that page now except that the head of IT has asked that I take the page down. He claims we agreed that I'd never talk about the exploit to anybody outside of IT. I know I never agreed to that because since square one I wanted to take credit for my 3 or 4 weeks of hard investigation and work, I fully intended on telling people about the problem.
I wrote my article with discretion. I never mentioned the school's name and it had very little subjective content, it was primarily how I found the exploits, what they were, and how they could be used. The idea was that if I talked about it from the point of view of the discoverer, it'd show insight into how to develop against it. The school was very appreciative that I did not use these exploits and that I came straight to them with the intention of fixing it.
I only blog about Software Development concepts. Finding security holes in the wild like this is a perfect subject for my blog. Also, I want to make a name for myself in the cyber security world, Bruce Schneier linked me to an article in his blog talking about how if you want to make a name for yourself in the cyber security, you need to break ciphers, find security holes and fix them, and such.
In short, I feel I deserve credit for the hard work I did, they feel that the school's image is more important even though the security hole is more than fixed. What's the best way to go about getting my credit here?
I have posted a pseudo censored version in the mean time.
UPDATE: no more pseudo censored version, I just put up a new article that's a little more ambiguous about it even being a school. New article can be found here.
