Security Matters

1
Security Matters

• Scott D. Anderson
• Wellesley College
• scott.anderson_at_acm.org

2
Blame it on

• Last year, David Musicant told about how his
  students inadvertently launched a denial of
  service attack on Carleton Colleges mail server
• Ah, but I can top that.

3
Background

• I teach a course in Web Databases, which covers
  MySQL, several middleware technologies (PHP,
  Perl/CGI and Java Servlets) and miscellanous
  related topics
• I am also my departments SysAdmin, so I should
  know better

4
Check your email first

• Monday, December 5th, 2005
• Panic The CS web server is down! Class material
  unavailable!
• Ah, network jack is bad switch to working jack.
• Problem solved
• Go read mail

5
Let Tim tell it
6
The Phishing email (extract)

• From Comerica Bank mailtocustomers_at_comerica.com
  
• Sent Monday, December 05, 2005 109 AM
• To orders_at_westburypharmacy.com
• Subject Comerica Bank Online Department Notice
• In order to safeguard your account, we require
  that you
• confirm your banking details. To help speed up
  this
• process, please access the following link so we
  can
• complete the verification of your Comerica
  Online
• Banking Account registration information
• http//cs.wellesley.edu/webdb/apache/comerica/CO
  NSUMER/LOGIN/index.htmlhttps//webbanking.comeric
  a.com/CONSUMER/LOGIN/login.asp

7
How did this happen?

• Spring 2005, I taught my Web Database course
• Introduced new material on file upload (e.g.
  pictures)
• Included a working demonstration
• Later, discussed web security
• All course material is online on the web

8
Aftermath

• From the logs, we found only one IP accessing
  that script, with what appeared to be the initial
  upload and a few tests
• The IP was from Romania, where the trail ran cold

9
Moral(s)

• Consider security first

10
Moral(s)

• Consider security first
• Horror stories make great lessons

11
Moral(s)

• Consider security first
• Horror stories make great lessons
• White knights abound

12
Moral(s)

• Consider security first
• Horror stories make great lessons
• White knights abound
• I was forgiven

13
Moral(s)

• Consider security first
• Horror stories make great lessons
• White knights abound
• I was forgiven
• So, be bold. You cant do worse than Ive done.