Comment On Security Index out of Bounds

It was nearly impossible to find an available and fully-functioning PC in the large campus labs at West Thomson-Friedman University. It's not like the student lab administrators were lazy. Oh no, in fact the clueless-users-who-were-far-too-dangerous-for-their-own-good and the malicious-users-who-were-far-too-bored-for-their-own-good made the student admins really earn their minimum wage. [expand full text]
« PrevPage 1 | Page 2 | Page 3Next »

Re: Security Index out of Bounds

2009-10-15 09:03 • by justsomedude (unregistered)
Unrelated news: At my college, they asked you to FTP in homework but didn't read protect any of the uploaded files...four years after being notified it was still that way.

Re: Security Index out of Bounds

2009-10-15 09:06 • by JohnB (unregistered)
I would have been FRIST but my keycard was propping open the lock yesterday.

Re: Security Index out of Bounds

2009-10-15 09:09 • by Inhibeo (unregistered)
Sysadmin was a jackass, made a simple mistake.

Re: Security Index out of Bounds

2009-10-15 09:12 • by Anon (unregistered)
And this was not noticed in testing because...?

Captcha: lud(icro)us

Re: Security Index out of Bounds

2009-10-15 09:13 • by GD (unregistered)

Re: Security Index out of Bounds

2009-10-15 09:16 • by t3knomanser (unregistered)
@Anon: It wasn't noticed in testing because the system probably wasn't tested beyond, "Hey, does it put video files down? Awesome."

Re: Security Index out of Bounds

2009-10-15 09:19 • by DOA
...or they could just set up the PCs in the comp sci lab to only allow comp sci students to log in. Like they did at my university. A decade ago.

How old is this story?

Re: Security Index out of Bounds

2009-10-15 09:19 • by justsomedude (unregistered)
288053 in reply to 288051
Hey have a heart, it creates folders too. Sheesh!

Re: Security Index out of Bounds

2009-10-15 09:22 • by Jeff (unregistered)
Maybe it's just me, but when I worked as a lab assistant at my university, we just didn't have these problems.

The labs were open access, required you to log in with a student id, and only one (the main) was staffed.

Our biggest problems were filling the paper trays in the satellite labs and the lady who declared that we were chinese spies.

Re: Security Index out of Bounds

2009-10-15 09:23 • by Warren (unregistered)
I posted this comment on October 14 so FRIST!

Re: Security Index out of Bounds

2009-10-15 09:25 • by bui (unregistered)
BOFH in training

Re: Security Index out of Bounds

2009-10-15 09:25 • by Anonymous (unregistered)
Ah, the Nazi sysadmin, a very common breed indeed. Excuse my French but f*ck those guys, right square in the face.

Re: Security Index out of Bounds

2009-10-15 09:34 • by Fred (unregistered)
My university didnt have a sysadmin, we had a "help desk".. presumably a middle-person that conveyed messages between group='people' and group='god' (aka sysadmin).

Saying that, I have been lucky at my job, the sysadmin is some giggly rastafarian.

(BTW, preview first, then submit, and it works first time)

Re: Security Index out of Bounds

2009-10-15 09:46 • by jwgl23 (unregistered)
Actually, he would be looking at the next day's files. Mar 29 would be recorded to Mar28. If he looked for Mar28 he would have seen Mar 29 video feed. I guess he was lazy and never attempted to look at video on the day of the incident.

Re: Security Index out of Bounds

2009-10-15 09:53 • by Postnam (unregistered)
288063 in reply to 288060
Saying that, I have been lucky at my job, the sysadmin is some giggly rastafarian.

You sure, he isn't a pastafarian?

Re: Security Index out of Bounds

2009-10-15 09:56 • by Jake (unregistered)
The sysadmin physically shoving a student and getting away with it is also a huge WTF.

Re: Security Index out of Bounds

2009-10-15 10:03 • by someone new (unregistered)
288065 in reply to 288062
jwgl23:
Actually, he would be looking at the next day's files. Mar 29 would be recorded to Mar28. If he looked for Mar28 he would have seen Mar 29 video feed. I guess he was lazy and never attempted to look at video on the day of the incident.


He saw the video labelled "MAR-21" and correlated it with the log from the 21st day of March.

Except the video was from the 22nd day of March, so he was correlating video from day N with log from day N-1.

So the Sysadmin saw someone who used terminal 15 hold the door open on the video from from the 22nd of the month (MAR-21 video), and correlated it with the person who logged in at that terminal at that time on the 21st.

The explanation in the article isn't complete, but it does make sense.

Re: Security Index out of Bounds

2009-10-15 10:05 • by dpm
Ignoring the fact that anyone who would create filenames with zero-based numbers for "day" would surely use zero-based numbers for "month" instead of three-letter strings, I like how Eric could navigate through folders looking at MAR-211415.mov but never notice the date/timestamp showing "3/22/2009 2:15 PM".

Re: Security Index out of Bounds

2009-10-15 10:05 • by pjt33
288067 in reply to 288060
Fred:
My university didnt have a sysadmin, we had a "help desk".. presumably a middle-person that conveyed messages between group='people' and group='god' (aka sysadmin).

Saying that, I have been lucky at my job, the sysadmin is some giggly rastafarian.

(BTW, preview first, then submit, and it works first time)

In my experience the preview button is as likely to redirect to error.html as the submit button.

And in submitting this message I previewed, then submitted, and got an error on the submit.

Re: Security Index out of Bounds

2009-10-15 10:06 • by Junkie
Grandpa Joe: Mr. Wonka?
Willy Wonka: [pointedly ignoring them] I am extraordinarily busy, sir.
Grandpa Joe: [tentatively] I just wanted to ask about the chocolate - The-the lifetime supply of chocolate, for Charlie. Wh-When does he get it?
Willy Wonka: He doesn't.
Grandpa Joe: Why not?
Willy Wonka: Because he broke the rules.
Grandpa Joe: What rules? We didn't see any rules, did we, Charlie?
[Charlie shakes his head briefly]
Willy Wonka: [springs up from his chair, angrily] Wrong, sir! Wrong! Under section 37B of the contract signed by him, it states quite clearly that all offers shall become null and void if - and you can read it for yourself in this photostatic copy:
[grabs a magnifying glass and reads]
Willy Wonka: I, the undersigned, shall forfeit all rights, privileges, and licenses herein and herein contained, et cetera, et cetera... Fax mentis incendium gloria cultum, et cetera, et cetera... Memo bis punitor delicatum!
[slams the contract copy and the magnifying glass down, continues shouting]
Willy Wonka: It's all there, black and white, clear as crystal! You stole fizzy lifting drinks! You bumped into the ceiling which now has to be washed and sterilized, so you get nothing! You lose! Good day, sir!

http://www.imdb.com/title/tt0067992/quotes

Re: Security Index out of Bounds

2009-10-15 10:09 • by dpm
288069 in reply to 288060
Fred:
(BTW, preview first, then submit, and it works first time)
You mean you haven't figured it out? It's simple, the software requires that submissions occur on an *even* second. If it receives a request and the current time (on the server, remember) has a "seconds" value ending in 1, 3, 5, 7, or 9 . . . error!

Just do what I did: re-calibrate your system time to that of Alex's server and synchronize your "click" to a 2, 4, 6, 8, or 0 --- allowing for network transit time, of course --- and Bob's your uncle!

Re: Security Index out of Bounds

2009-10-15 10:16 • by The Sussman (unregistered)
FRIST

Re: Security Index out of Bounds

2009-10-15 10:20 • by justsomedude (unregistered)
288072 in reply to 288067
pjt33:
Fred:
My university didnt have a sysadmin, we had a "help desk".. presumably a middle-person that conveyed messages between group='people' and group='god' (aka sysadmin).

Saying that, I have been lucky at my job, the sysadmin is some giggly rastafarian.

(BTW, preview first, then submit, and it works first time)

In my experience the preview button is as likely to redirect to error.html as the submit button.

And in submitting this message I previewed, then submitted, and got an error on the submit.


Just make the quotes yourself and use reply+submit, seems to work for me.

Re: Security Index out of Bounds

2009-10-15 10:21 • by DaveK
288073 in reply to 288069
dpm:
You mean you haven't figured it out? It's simple, the software requires that submissions occur on an *even* second. If it receives a request and the current time (on the server, remember) has a "seconds" value ending in 1, 3, 5, 7, or 9 . . . error!

Re: Security Index out of Bounds
2009-10-15 10:09 • by dpm

LOL, bad luck!

Re: Security Index out of Bounds

2009-10-15 10:25 • by Guillaume (unregistered)
This sounds a whole lot like Carleton University, not West Thomson-Friedman University.

Everything down to the chairs propping open doors and the rational rose (real-time) assignments sounds right.

Re: Security Index out of Bounds

2009-10-15 10:27 • by Ed (unregistered)
288075 in reply to 288073
DaveK:
dpm:
You mean you haven't figured it out? It's simple, the software requires that submissions occur on an *even* second. If it receives a request and the current time (on the server, remember) has a "seconds" value ending in 1, 3, 5, 7, or 9 . . . error!

Re: Security Index out of Bounds
2009-10-15 10:09 • by dpm

LOL, bad luck!



Mate, that timestamp is -1 indexed. Duh.

Re: Security Index out of Bounds

2009-10-15 10:32 • by Anon (unregistered)
288076 in reply to 288072
justsomedude:
pjt33:
Fred:
My university didnt have a sysadmin, we had a "help desk".. presumably a middle-person that conveyed messages between group='people' and group='god' (aka sysadmin).

Saying that, I have been lucky at my job, the sysadmin is some giggly rastafarian.

(BTW, preview first, then submit, and it works first time)

In my experience the preview button is as likely to redirect to error.html as the submit button.

And in submitting this message I previewed, then submitted, and got an error on the submit.


Just make the quotes yourself and use reply+submit, seems to work for me.


I believe it is a social engineering experiment by Alex to see how many myths and superstitions will pop-up around the random error messages when you try and submit a message.
Personally, I spin around in my chair three times first and then make sure I click the mouse with my left hand. Works every time.

Re: Security Index out of Bounds

2009-10-15 10:42 • by P. Edant (unregistered)
288077 in reply to 288076
I think I'll give that a go. Right, how do I go about borrowing your left hand?

Re: Security Index out of Bounds

2009-10-15 10:44 • by SR (unregistered)
288078 in reply to 288076
Anon:
I believe it is a social engineering experiment by Alex to see how many myths and superstitions will pop-up around the random error messages when you try and submit a message.
Personally, I spin around in my chair three times first and then make sure I click the mouse with my left hand. Works every time.


Winner!

(2nd attempt as I'm clicking with my right hand).

Re: Security Index out of Bounds

2009-10-15 10:47 • by keycard (unregistered)
am i missing something? why would you need to look at the video to determine who had entered the lab at a certain time? don't the keycards identify whom they've been assigned to?

Re: Security Index out of Bounds

2009-10-15 10:48 • by Anthony (unregistered)
288080 in reply to 288069
Except for the fact that your post is on an odd second...

Re: Security Index out of Bounds

2009-10-15 10:58 • by hikari
288081 in reply to 288079
keycard:
am i missing something? why would you need to look at the video to determine who had entered the lab at a certain time? don't the keycards identify whom they've been assigned to?


My supposition is that the cards were just dumb cards that opened the door, without being tied in to a central system.

Re: Security Index out of Bounds

2009-10-15 10:59 • by cardkey (unregistered)
288082 in reply to 288079
I'm assuming you could open the doors from the inside without the key card, so you could prop the door open even if you weren't the last person to use a key card. Or even without that, you could prop the door open on someone else's activation.

Re: Security Index out of Bounds

2009-10-15 11:25 • by yer facilisis could use some resources (unregistered)
288084 in reply to 288074
Guillaume:
This sounds a whole lot like Carleton University, not West Thomson-Friedman University.

Everything down to the chairs propping open doors and the rational rose (real-time) assignments sounds right.

Whoooosh!

Re: Security Index out of Bounds

2009-10-15 11:27 • by Sysad = jackass (unregistered)
When I was in college back in the 80s we all shared a network of Prime minicomputers. Without exception the staff were temperamental, lazy, deadbeats, some of whom also got a kick out of throwing their weight around. Look the wrong way at the woman whose job was taking printouts from the computer room and eventually putting them out and you'd get your password changed and have to beg for it back. I wouldn't work in academe if they offered me a quarter of a million a year.

Re: Security Index out of Bounds

2009-10-15 11:52 • by Your Name (unregistered)
I think I am getting old. Do students still use lab computers, especial those in compsci programs? I graduated 15 years ago and the only time I stepped foot in a lab was to either use a free laser printer or to grab printout from a line printer.

Re: Security Index out of Bounds

2009-10-15 11:59 • by dpm
288088 in reply to 288080
DaveK:
Re: Security Index out of Bounds
2009-10-15 10:09 • by dpm

LOL, bad luck!
Anthony:
Except for the fact that your post is on an odd second...
(sigh) The timestamp here shows only HH:MM. Where are you seeing seconds?

Re: Security Index out of Bounds

2009-10-15 12:07 • by logged in (unregistered)
Our school gave CompSci students a login ID which only worked in their labs, in addition to keycard access. Never had this kind of problem

Re: Security Index out of Bounds

2009-10-15 12:09 • by Daniel (unregistered)
288091 in reply to 288074
Guillaume:
This sounds a whole lot like Carleton University, not West Thomson-Friedman University.

Everything down to the chairs propping open doors and the rational rose (real-time) assignments sounds right.


Not to mention the $10 security deposit that can only be handed in in the dank basement of an admin building halfway across campus.

Also the Tuesday Morning from 8 am to noon restriction on that office being open was fantastic for those of us who had jobs and stayed up all night writing assignments.

Re: Security Index out of Bounds

2009-10-15 12:11 • by Dan (unregistered)
288092 in reply to 288084
yer facilisis could use some resources:
Guillaume:
This sounds a whole lot like Carleton University, not West Thomson-Friedman University.

Everything down to the chairs propping open doors and the rational rose (real-time) assignments sounds right.

Whoooosh!


Whooosh indeed--I totally missed the WTF reference myself. Bravo for cleverness.

Re: Security Index out of Bounds

2009-10-15 12:14 • by Yardik (unregistered)
288093 in reply to 288066
Not everyone uses Details view in windows.. some like their ugly huge icon views.

Captcha: wisi - Umm.. yea.

Re: Security Index out of Bounds

2009-10-15 12:14 • by Bim Job (unregistered)
288094 in reply to 288087
Your Name :
I think I am getting old. Do students still use lab computers, especial those in compsci programs? I graduated 15 years ago and the only time I stepped foot in a lab was to either use a free laser printer or to grab printout from a line printer.
No, you're still young; it's only CompSci departments that have got past it.

"Rational Rose midterm project..."

Say it ain't so, Joe. But I assume it is. And I assume that IBM isn't about to hand out those worthless licences like the confetti they are.

Rational Rose in a college environment? The world is going to Hell in a hand-basket, I tell you.

Mind you, at least the OP featured a SysAdmin with a brutally honest knack of introspection. "What are we even here for?"

That's rare to find in any area of University Administration. Sadly, it was a question asked by the boot-boy, not by the Dean.

Re: Security Index out of Bounds

2009-10-15 12:16 • by Lars Vargas
Something tells me that Eric had problems with dates in computers, with women, and in general.

Re: Security Index out of Bounds

2009-10-15 12:17 • by Herohtar (unregistered)
288096 in reply to 288087
Your Name :
I think I am getting old. Do students still use lab computers, especial those in compsci programs? I graduated 15 years ago and the only time I stepped foot in a lab was to either use a free laser printer or to grab printout from a line printer.


I graduated 5 months ago and can confirm that students still use lab computers quite a bit, especially those in computer science or even various engineering programs.

Re: Security Index out of Bounds

2009-10-15 12:35 • by topspin
TRWTF is obviously this whole physical access bullshit!
WhyTF do the non comp-sci students even have accounts? (The story implies that at least there are accounts. Otherwise it would be even worse)

At my uni you walked into the lab, logged in somewhere and were good to go. You can only fuck up your _own_ account anyway.

Re: Security Index out of Bounds

2009-10-15 12:51 • by Rod (unregistered)
288099 in reply to 288098
topspin:
At my uni you walked into the lab, logged in somewhere and were good to go. You can only fuck up your _own_ account anyway.


At my uni, you walked into the lab, turned all the monitors upside down, then legged it

Re: Security Index out of Bounds

2009-10-15 13:06 • by tarded (unregistered)
Not sure why people who see MAR00 would instantly think it was a zero based index. It looks more like a year to me, like maybe the sys-admin was looking at the 2000 year, or maybe reusing the media without having the device in record mode or something.

Re: Security Index out of Bounds

2009-10-15 13:06 • by savar
<pre>
Way too common. But it makes sense. Why does that guy have a job as a sysadmin, and not a good work-study job writing code for a research project or TA'ing?

Because he lacks the technical chops and people skills to get himself into any of those good jobs. This is why there are some job categories that are doomed to have terrible people working in them.

Same goes for the guy that sells computers at Best Buy. They need somebody who knows something about computers, but anybody with marketable skills already has a better job. So they hire fucktards instead.
</pre>

WTF? How do you predict when community server translates newlines to HTML tags and when it escapes all of your HTML? Are there different settings for front page posts than for forum posts?

Re: Security Index out of Bounds

2009-10-15 13:14 • by n (unregistered)
288104 in reply to 288096
Herohtar:
Your Name :
I think I am getting old. Do students still use lab computers, especial those in compsci programs? I graduated 15 years ago and the only time I stepped foot in a lab was to either use a free laser printer or to grab printout from a line printer.


I graduated 5 months ago and can confirm that students still use lab computers quite a bit, especially those in computer science or even various engineering programs.


I am currently in College, and yes we use the computer labs. If only because the labs (especially the Computer Science labs) because they have the expensive and really expensive software that is required to complete the coursework.

Those that are not in Comp Sci will also use the other labs because, at least at my College, the entire system is very flexible and you can do *anything* to the computers including most malware and just restart the computer and you are back in business because of DeepFreeze. The only real problem with DeepFreeze is when the image has out of date software on it that the person that created the image forgot to turn off the auto update (java and Firefox updates come up everytime the system booted), but then this is a admin issue.

Re: Security Index out of Bounds

2009-10-15 13:28 • by Peter (unregistered)
288105 in reply to 288080
Anthony:
Except for the fact that your post is on an odd second...

And how can you tell that? Times are only displayed to the minute.
« PrevPage 1 | Page 2 | Page 3Next »

Add Comment