From the University Times: “The owner of the account claimed to have been able to acquire the username and password for the site which would have allowed him/her to tamper with the vote. ”

Source please?

That simply isn’t true. At no point did I claim that I had passwords which I could use to tamper with the vote.

Cross site scripting vulnerabilities,  Edugates use of SSO, and no requirement for at least 2 factors for authenticating voters, means there were known & demonstrable methods of casting fraudulent votes.

The original login details I had for the Simplesaml installation (which bridged USI & Edugate) were username: admin, password: starlight.

It was these passwords which I used to access the admin back end of the SAML application, and made a video showing this –http://www.youtube.com/watch?v=O7FMWc1foKg

At no point was the claim made that I could directly tamper with votes by accessing that.

From the University Times: free fees campaigners had sought to undermine the credibility of the voting system by pointing to perceived security flaws.

If someone can access a password protected area without authorisation, that tends to be ‘perceived’ by most people as a security issue.

If your developer is so lax about online security  that they use their business name as their password –  it’s a security issue.

Basic common sense would suggest that if something is password protected, it’s protected for a reason.

If USI and the developer don’t know what that reason is  – it’s a security issue.

If they allow unlimited login attempts without captchas, time delays, or IP blocks – it’s a security issue

If you use a Single Sign-On service, and allow people to vote without always their entering passwords right before voting – it’s a security issue

The sites forms lacked proper input/output validation which made cross site scripting possible.

If your developer is  too inept to code forms correctly, leading to xss vuln –  it’s a security issue.

A proof of concept for xss was demonstrated in video, in addition to screenshots from a web security app called Netsparker confirming the xss.

If you download a free web security scanner and use it, you’d be able to find the xss issues on the site yourselves.

If your developer doesn’t perform security scans before launching a site – it’s a security issue.

USI were informed of those xss issues on Saturday, and failed to clean all of them up – that’s a security issue, it’s also negligent.

It looked like  SQLi was also possible, but I didn’t test it.

FWIW, here’s a quick scan for TCDSU – it shows that SQL injection may be possible:

Those could be false positives, and would have to be tested (proof of concept). Basically, an SQL injection could allow admin access, and possibly a full list of usernames & passwords could be obtained – if I wanted to be malicious, I could keep that quiet and exploit it.

Those penetration testing tools are incredibly useful for finding issues like that.

These issues are incredibly easy to find, exploit, fix, and prevent.

The fact that USI was willing to dismiss xss vulnerabilities & someone having unauthorized access to parts of the site, shows an alarming naivety when it comes to online security.

The reason these issues were publicized was to press the developer to fix those issues –  ‘full disclosure’ – it’s deemed by most people to be better than ‘security through obscurity’.

If anyone doubts the info I’ve posted, I suggest that they actually ask someone who works in IT, and is independent from USI.

If you’re a newspaper, perhaps try going to a neutral source like the Irish Reporting and Information Security Service (not a radical idea).

Well Done Maynooth SU

Following the post about xss vulnerabilities, MSU posted a notice on Facebook warning students to make sure that they use the correct login page.

Considering that xss vulnerabilites existed, that was the correct, and intelligent thing to do, so here’s some free advice for their new site:

Install BulletProof  Security and Limit Login Attempts – 2 free WordPress plugins.  Your site will be more secure than USIs ever was.

*******

As stated publicly several days ago:

My intentions were to a) see how secure the voting process is, and b) see if any security issues could be used for fraudulent means.

Before any online voting system was launched, a basic security audit should have been carried out. That doesn’t appear to have happened, or if it did, it was inadequate – so I carried out my own.

The answer to ‘a’ was ‘not very’ and the answer to ‘b’ was yes.

*********************

For PK, here are some tools:

Security Scanners: Netsparker, Burp Suite, Acunetix.

Pentest extensions for Firefox – https://addons.mozilla.org/en-US/firefox/collections/adammuntner/webappsec/

OWASP Project – https://www.owasp.org/index.php/Main_Page

Penetration Test – http://en.wikipedia.org/wiki/Penetration_test

Irish Reporting and Information Security Service – http://www.iriss.ie/iriss/index.htm