EVERY SINGLE student at College will have at some point logged on to their UCL computer account. Few, however, would have given thought to the fact that every time they did so, their data was at risk.
Using programs freely available online and the know-how of an ordinary student, The Cheese Grater was able to access email details and password information of over 57,000 users on the UCL network. Furthermore, by exposing loopholes in the WTS (Windows Terminal Service) system we were able to enable key logging features which we should not have had access to.
Key logging
It took The Cheese Grater less than a minute to enable key logging without having to install any special software or even log on to an ordinary computer in a nondescript cluster room. Within one day, we could have gathered a considerable number of usernames and passwords.
The cluster room we used was in an unfamiliar department, readily accessible to anyone walking along the street outside; clearly the key logging problem is a glaring vulnerability. Alarmingly, by turning on this feature and then calling the Information Systems (IS) helpdesk, someone could easily report a fault on a PC and return a day or so later only to find the logon details of an IS technician – someone with a far higher level of clearance than the average student.
The key logging issue was news to IS, despite the fact that our source had contacted them on two separate occasions about the matter. Having been given assurances that the details had been passed on to the relevant department, our source heard no more of the issue. The demonstration given to The Cheese Grater showed that nothing had been done. Since being presented with this information, IS have pledged to do something about the vulnerability and at the time of going to press, should have rolled out an updated WTS with any keylogging related weaknesses removed. IS Director Robert Clark told The Cheese Grater that, “This is being addressed as a matter of urgency.”
Password cracking
However, the vulnerabilities on the UCL system run deeper than ability to log usernames and passwords. Using software already installed on the WTS and a few basic commands gleaned off the Internet, it took a matter of minutes for us to call up a list of email addresses, associated username aliases and more worryingly password hashes – an encrypted form of each users password. We were able to call up the details of any user we chose and were free to run a program in an attempt to crack a password. Using commercially available software, it took just 15 minutes to crack a password based on a dictionary word on an ordinary, five-year-old personal computer.
With the username and password for a student that we had never met before, we could have easily logged into Portico and gained personal details such as home addresses and phone numbers. Furthermore it would not have been difficult to install a program on that person’s profile to log all data used in a session. For example, it could have taken a matter of days to obtain debit card information.
So how was it that we were able to do this? Unfortunately, unlike the keylogging problem, the issue of preventing password hacking is fiendishly complex. With so many different computer requirements at UCL, IS has attempted to implement what is known as ‘synchronized single sign-on’, essentially that each user only needs one username and password to use every service. In order to do this, all user information is stored centrally on a UNIX system commonly known as the Network Information System (NIS) or ‘Yellow Pages’.
However, NIS has an inherent weakness in that through basic commands, any user logged on is able to view a file containing all the usernames and password hashes on the system. Not only does this raise the risk that anyone could potentially get hold of password information but also email addresses and mailing lists as well. Nearly every student and staff member at UCL will have noticed the increased volumes of spam that have been occurring, and the fact that it is so simple to take over 57,000 email addresses off a UCL cluster room PC within minutes is no comforting thought. IS claimed that larger amounts of spam to UCL email address is largely due to more advanced spamming techniques in terms of bypassing filters and getting addresses in the first place. This may be the case but it is not an excuse for the fact that at any undesirable company could get hold of the email address for every student at UCL with a few key presses.
Solutions
So what can be done? At the moment, passwords for staff and students alike have a limit of eight characters all drawn from a 96 character set. Lengthening passwords is one option but it would arguably only be a short term solution, thus if someone were determined to crack a password, it would just take a little longer. Similarly, limiting the number of authentications allowed is not easy. By only allowing a user 3 attempts to get their passwords correct and then locking them out of the system should they fail, IS could protect users from blatant attempts to guess passwords. But this measure is easily abused, and given that most people forget their passwords at some point, only creates unnecessary trouble when IS are forced to unlock accounts. Furthermore, the nature of the NIS weakness means that the password hash file can be taken offsite, where there are no limits to the number of authentications that can be made.
IS are, to their credit, well aware of the problem with NIS and the potential problems associated with it. When The Cheese Grater met with senior IS staff they assured us that if they had been able to eliminate the feature on NIS allowing ordinary users to view passwords, they would have done so long ago. There are more secure servers and authentication systems available but the amount of time and money required to change the entire UCL network over to them is simply not feasible at present.
However the fact that password hashes are so readily available to anyone on the UCL network needs to be made clear to students. The use of the password file cannot be monitored and as such, the possibility of someone attempting to crack your password is always present. The passwords that we cracked were either dictionary words or at least variations on common phrases or names. IS has a clear policy on this mat ter and most students will know that when changing passwords, it is very difficult to use a common dictionary term. Information Systems claims it runs audits on passwords once a week and users with any unsuitable passwords are immediately notified. If, one week later, the password hasn’t changed, the system will reset it for the user.
Ultimately then, some responsibility lies with the end users, students and staff. By choosing an obvious password, a person is far more vulnerable to having their password cracked and their account accessed. By regularly changing passwords, and ensuring they are as random as possible, the success of cracking is greatly reduced. A random, 8 character password has a one in a billion chance of being cracked.
IS certainly cannot be accused of complacency with pass words, you only needs to glance at their section of the UCL web site to see a detailed guide on how to select a secure one. Students need to be more aware of why it is important to choose a good password and also that if they don’t follow the guidelines, just how easy it is to crack. Robert Clark told us; “There is a need to raise awareness amongst students and indeed staff on the importance of choosing and maintaining robust passwords.”
Clark is right but the unfortunate truth is that most people will not bother. Until IS can move the network onto a newer, more secure server they cannot ensure data security. The inherent weaknesses mean that if UCL students and staff are not vigilant then they run a great risk of having their data misused. We may have reported our findings to IS, others will not.