AN OVERSIGHT ON the UCLU website that experts say would have taken “about 30 seconds” to fix meant that student logins and passwords were available to anyone with a bit of internet know-how. To make matters worse, it seems UCLU staff were first informed of the problem back in February, but er… nothing was done about it until The Cheese Grater took a closer look.
Easy access
When you input passwords or other sensitive info into most websites, they switch automatically into a secure mode (https) and send off your details in an encrypted format. The UCLU homepage wasn’t set up to do this, despite it being a fairly standard and routine task, so any login details typed in were sent off in plain text format - plain for everyone to see. Hackers could easily intercept the data, giving them access to students’ emails, homepages and - more worryingly - their detailed Portico records.
Wide open windows
So who was responsible for such a lapse in security? Step forward Kitsite, the company UCLU paid £80,000 to give www.uclu.org a complete makeover two years ago.
This comes as quite a surprise as Kitsite had supposedly dealt with security concerns already. When the sabbs got worried about password security around the time of the October elections, they contacted UCL Information Systems for a security certificate: a lengthy process, involving “considerable overheads”. But although online voting was made secure, the login problem wasn’t solved. As one IT security expert told The Cheese Grater: “Having gone to all that trouble, [leaving the passwords unencrypted] is a bit like getting new locks for all the doors and leaving the window open.”
This isn’t the first time that Kitsite had appeared unsuitable for the job of maintaining the UCLU website. Back in June a Union administrative meeting noted that Kitsite had “failed to meet some deadlines,” and at the start of October, General Manager Robert Taylor noted that “the service Kitsite has provided has at times not been of the highest quality.”
Kitsite told The Cheese Grater that they only have a “fairly minimal support contract with UCLU” and that when they first made the union site they “weren’t given the facility to put [secure logins] on the site.” They added that although they were willing to address the security issue, they were “not obliged to do anything about it.” The flaw has since been fixed.
But this doesn’t resolve the issue of why such a glaring oversight was allowed to happen in the first place. Robert Clark, Head of IS informed us that steps were being taken to ensure all pages connecting to the UCL servers for authentication use secure encryption but that “more work is needed to achieve a target of 100%.” Since Kitsite had covered all the groundwork necessary to achieve a security certificate, it was safe to assume that they wouldn’t make such a mistake – but never mind eh? After all, it was only an £80,000 contract they had to fulfil.