Berkeley HS student tried to rig his own election, exposing cybersecurity flaws

https://www.berkeleyside.com/2019/04/09/berkeley-high-student-tried-to-rig-his-own-election-exposing-flaw-in-districts-cybersecurity

by incomplete • 7 years ago

145 128 7 years ago

berkeleyside.com

bowmessage• 7 years ago

My HS used birthdate as account password, for both students and teachers, with no option to change! I hope they've updated since.

mfoy_• 7 years ago

My bank only allows for up to 6 alphanumeric (no special!) characters.

https://www.bmo.com/olbb/help-centre/en/my-profile/change-pa...

b_tterc_p• 7 years ago

I believe this is because you may be required to enter it on a phone using the dial pad. This also means it’s secretly just 6 single digit numbers.

walrus01• 7 years ago

5 bucks says that's because it's stored in plaintext, no crypto, no hash, no salt, in some gargantuan ancient mainframe system database.

https://www.theglobeandmail.com/technology/digital-culture/w...

Scooty• 7 years ago

Why is this such a common thing? Just about every bank I've used has had one of these issues on their website:

- Password can't be long

- Password can't be pasted

- Password must contain symbols

- Password can't contain symbols

I even locked myself out of my credit card (AMEX) account 3 times in less than 2 days because they have multiple different password reset forms, but one of them doesn't enforce their password length limit, so I successfully set my password to a password that was too long for the web/mobile login forms.

cabaalis• 7 years ago

Microsoft will not let me go past 16 on my O365 email.

Msft employees: change this!

Humdeee• 7 years ago

This was changed actually. You can change your password to something more secure now. The help files appear to not have been updated.

cperciva2• 7 years ago

BMO changed that a few weeks ago! I guess their website hasn't been fully updated yet.

Someone1234• 7 years ago

“It just shows that people don’t make healthy cybersecurity decisions,” said Stern.

You mean like the administrators of the school? You can set a temp password to immediately expire. What's notable is that even after this incident they still didn't do so, just encouraged students to change the default password during orientation.

OliverJones2• 7 years ago

Indeed. An immediately expiring temp password is the usual workflow for new private-labeled Google accounts. I suppose, though, that somebody thinks middle schoolers can't handle it.

thaumasiotes• 7 years ago

Students were casting ranked-choice ballots via a Google Form accessed through district-provided Gmail accounts
The investigators were also able to determine that the false votes were cast from a computer

I bet the real votes were cast from a computer too.

smelendez• 7 years ago

Presumably they mean as opposed to s smartphone, which might be the more common way for students to vote.

depressed• 7 years ago

I think they meant that the false votes were all cast from a single computer.

RandomBacon• 7 years ago

Ah, computerized highschool class elections.

I could have rigged the vote to win at my school too, except that I wasn't in the right cliques. It would have been very suspicious if I won, and everyone knew I was "good with computers".

Our program actually saved who voted for who in plaintext. At least I got to see who voted for me.

veryworried• 7 years ago

In a situation like this the best action is to install a puppet who you can blackmail. Then use them to push policies you find favorable to you.

AnimalMuppet2• 7 years ago

I don't think student governments get to push policies that can actually help students very much. I don't think school administrations let the student government have any real control whatsoever.

gwbas1c• 7 years ago

Joke:

Like Trump and the rumored pee-pee tape?

(Sorry, couldn't resist!)

nkrisc5• 7 years ago

The perpetrators should be punished by being made to give a presentation on how they automated the process, what poor security practices allowed them to pull it off, and recommendations for preventing a similar incident in the future.

tickthokk• 7 years ago

I was suspended in high school for "hacking"; this was in 2000. I added two (crudely named) folders to an old DOS style typing teaching software.

My presentation would have just been "I pressed F10, and typed in bad words", but it would have been preferable to a three day suspension, haha. I hope this is the outcome!

Waterluvian• 7 years ago

Ahh those were the days. I once sent a WinPopup message to every computer in the school board. So thousands probably.

As an idiot I used my account and immediately got suspended.

leetrout• 7 years ago

Ha I was “hacking” and “changing my grades” because I brought a laptop to school in 2002.

labster2• 7 years ago

How would a presentation be preferable to a 3-day holiday from prison^W school? At least at home I could read my textbooks in peace.

I got a five day suspension for showing a teacher I could log in before accounts were authorized while they were watching. Loaded the school's official website in a browser. Best week of high school.

Datenstrom• 7 years ago

Around the same time I was one of the first kids to have a laptop in my highschool and was actually just doing homework on it in studyhall. The proctor was aghast and thought I was going to infect all the school computers with viruses. I tried explaining that I was not even on the school network and she tried to tell me that they could spread through the power supply.

trhway• 7 years ago

And that presentation should be given in Russian.

sctb• 7 years ago

Would you mind posting thoughtful and informative comments instead of snarky one-liners?

https://news.ycombinator.com/newsguidelines.html

kemitche3• 7 years ago

Suppose I walk into the neighborhood 7-11, and steal the money from the cash drawer when the cashier glances away. I'm only caught once the tapes are reviewed and they find my license plate. Should my punishment be to give a presentation to the cashier that they should be watching everyone at all times?

Obviously the answer is no. Sometimes, catching someone breaking rules/laws after the fact is sufficient - 100% prevention of a crime before it happens shouldn't be the only way crimes are avoided.

Did the school make some poor choices with their cybersecurity? Sure. But an open/unlocked door does not give permission to steal or break the law, whether that door is digital or physical.

leothecool• 7 years ago

Is it a mock 7-11 for educational purposes?

nkrisc5• 7 years ago

Are you suggesting these kids are criminals and committed a crime? Because I don't really see the connection between theft and what this article is about. It sounds like this can be turned into a learning opportunity. Learning seems appropriate for a school setting as opposed to vengeful retribution.

If, as you suggested, you commit theft, engagement with the criminal justice system seems appropriate, but maybe not if you rigged a school election.

radicaldreamer• 7 years ago

I’m getting deja vu around how Aaron Swartz was treated when he was charged.

These are young people, who deserve leniency and opportunities to make mistakes and learn.

turtlecloud• 7 years ago

well perhaps the criminal can explain to the judge how society failed him or a rough traumatic childhood caused him to be this way. Also add in the presentation how easy it was for him to get a gun and how the cashier should have been automated. I do think cashiers will be an outdated job in a few yrs.

I believe it is fairly simplistic to just say good/bad without understanding the nuances and shades of gray in between.

wongarsu• 7 years ago

An open door doesn't give permission to steal, but as any insurance will tell you the blame for the theft will fall on both sides: The justice system will find the thief guilty and punish him, and the insurance will find the shop owner guilty and punish him.

If the security problem is more subtle than an open door it's not unheard of to consult the criminal, who may be given a lesser sentence or other freedoms for helping make everyone more secure.

Of course in this case all of that is kind of moot. The rigging attempt was crude and quickly detected. Everything worked as it should, and while organizing an election brings a high burden of ensuring no manipulation occurs, everything was executed perfectly. The real problem was students not being forced to change their default password, which is akin to an open door, just from a different department.

floatingatoll• 7 years ago

In this analogy, the 7-11 is a student-run business, and so: Yes, the punishment should be precisely that.

stcredzero8• 7 years ago

punished by being made to give a presentation on how they automated the process, what poor security practices allowed them to pull it off, and recommendations for preventing a similar incident in the future

So punish them by sending them to DefCon?

dontbenebby2• 7 years ago

So default password was student ID? Who wants to bet there was a list of names and student IDs available somewhere that made this trivial to automate?

(Or they were sequential with blocks for each class)

hbosch• 7 years ago

Or more simply, what pattern do student IDs conform to? I’d be absolutely shocked if they were randomized.

dontbenebby2• 7 years ago

I wish there was a name for this kind of thing, because I see it a lot. Something is used a username in one context, then a password/authentication token in another.

(Ex: many libraries use your barcode number as your username)

I suspect the mistake stems from not understanding how passwords are stored.

(Eg: while yes, well set up systems hash passwords, usernames or any other identifier paired w the password are in cleartext, and in many cases huge swathes of the userbase can access them)

ryanmjacobs2• 7 years ago

A bit late, but in my high school, we realized that our student IDs were chunked by which feeder middle school we came from. This was after we scraped the entire ID->Name mapping database.

For example, 7500-7600 was Middle School "A"; 7600-7700 was Middle School "B" and so forth. Within those chunks, we couldn't really discern an order, alphabetical or otherwise.

mountainofdeath• 7 years ago

I did something very similar to this for my high school's prom queen vote who I wanted to win for teenager reasons. The voting system was just a bunch of laptops in front of the lunch room running a web app and all that was needed to vote was to know a student id. A few hours and some javascript later, I voted more than the entire senior class. It was only discovered after the event.

dustindiamond• 7 years ago

Amanda?

OliverJones2• 7 years ago

Internet voting. What could go wrong?

In my opinion these two have done us all a service by showing what could go wrong.

anbop• 7 years ago

LOL. Reminds me of LBJ’s Senate election in 1948.

stcredzero8• 7 years ago

“When we spotted it, it was incredibly obvious,” said Stern, 17. “There were just massive alphabetical votes at random hours.”

Reminds me of an interview question: How would you do a reasonably good job of randomizing an incoming stream of items, while minimizing auxiliary storage?

greiskul• 7 years ago

Never heard of this question, how do you do that? Do you mean getting a random sample from an incoming stream, using only O(1) space?

stcredzero8• 7 years ago

I'm thinking of randomizing the entire stream, and getting something that looks "reasonably random" to casual inspection by human beings, using only O(1) space.

MagicPropmaker• 7 years ago

He didn't expose flaws. They caught him.

will_pseudonym• 7 years ago

The flaws exposed were of general cybersecurity--they had default passwords comprised of a static string for every student + their student ID, and did not require students to change that default password immediately upon first login.

"If a student does not change the default password, “anyone with access to your student ID number will be able to access and delete your emails, schoolwork, personal documents and anything stored on your Google Drive,” Stern wrote in his message to the student body."

jlrubin• 7 years ago

I'm glad to see that it seems the student in question was afforded a measure of process and admitted guilt -- I could easily see the story ending where the weaker opponent casts fake votes for their competition to get them eliminated!

zaroth• 7 years ago

Besides the fact that this "online voting" was immediately hacked, I wasn't fond of the notion that the votes had everyone's name attached.

ryanmjacobs2• 7 years ago

Gosh, I did this back in my high school as a Senior, two years ago. Got myself suspended for two days and ruined my perfect attendance, oh well. It scared the shit out of me when two police officers barged into my U.S. History class and pulled me out.

The usernames of our voting system were our 5 digit student IDs. And the passwords... same as the usernames. I wrote a puppeteer script that looped through 2000 IDs and voted for everyone. They tracked me down through my home IP address -- if there is a next time, I'll definitely use Tor haha.

EDIT: Yeah, the school's VP picked up on it because normally about 40% of the student body actually votes -- but this time it was 100%; plus when student's started signing into their voting accounts, it claimed they already voted. Not my brightest moment.

ggm• 7 years ago

The number of responses which go to "...I did this too" are fascinating. I also did stupid things in my past which nowadays would incur severe penalty, as hacking. They felt mild right up to the point I was caught (this is 35 years ago) and then they stopped feeling mild very quickly.

I feel very sorry for people in todays world who don't get the "everybody gets one free pass" on these things we did back in the day. I think we need a clear statute of limitations on some stuff done by minors and near-minors, regarding their future lives. Nobody is going to be eligible for election to senate or the law courts, or to work in federal or state bodies if we don't work out how to deal with this kind of thing.

That said, I am pretty sure rigging an election is a good indication you have need of some ethics. Amusing, but also not a good idea.

This ranks (in my books) with the recurring "we thought we'd make a film about a bank robbery without informing the bank or the shopping mall about it" type cock-up: Actions have (unforseen) consequences.

dangrover• 7 years ago

Schweng said the culture around this election, from the outset, was different than what she’d seen in the past. There were more reports of students taking down candidates’ posters, and more activity on social media. Some students suggested to the principal that the stakes felt higher because colleges are becoming increasingly more selective, and extracurriculars like student government are consequently more important.

This part was the most interesting revelation in the article to me! It never would have occurred to me as a HS student to "cheat on extracurriculars"! I just did the stuff that was interesting.

bhsalumni123• 7 years ago

Nowhere in the article is it mentioned where the student gained access to a mapping of student IDs to student first and last names. As a recent BHS alumni, these ID numbers are not obviously derivable from a student's name (but I do think they are allocated sequentially). Getting access to this list implies some sort of social engineering or threat vector elsewhere.

QuamStiver• 7 years ago

This kid is going to be fighting off job offers.

Berkeley HS student tried to rig his own election, exposing cybersecurity flaws

Related Stories