Princeton Hacks Yale, Harvard Not Surprised

Semji Rkim writes: "Yale Daily News is running a story of several occassions in which Princeton officials entered the Yale Online website and viewed admissions decisions. Princeton officials claim they were simply researching security for their own website. Reportedly the website, on initial log-in, would show applicants either a congratulatory fireworks display or a rejection notice. Princeton officials informally mentioned that they had accessed students' records on Yale's admissions site at an Ivy League deans' conference. The Yale website apparently used names, birth dates, and social security information as unique identifiers to allow access to the site. They are considering adding a PIN in the future."

Acceptance letters?

Just because you can do something with technology doesn't mean you should.

Bing, bang, boom.

Yaledailynews has met it's doom. Slashdotted that is.

The Yale website apparently used names, birth dates, and social security information as unique identifiers to allow access to the site. They are considering adding a PIN in the future.

Maybe they could use a credit card number as a PIN. Then it could be a one-stop shop for the lazy identity-thief.

Re:Sneaky

If anything, it shows that the guys at Princeton can 'think outside the box' more than those at Yale.

Unfortunately, they wandered into someone else's box.

-c.

Obligatory Simpson's Quote

Sideshow Bob: Are you still angry about being kicked out of clown college?

Cecil: I'll thank you not to refer to Princeton that way.

In case of slashdotting

Here's the original article:

HTTP/1.1 Server Too Busy

Nice

Reportedly the website, on initial log-in, would show applicants either a congratulatory fireworks display or a rejection notice.

Fireworks? What's their rejection notice, then? Top rejection notice graphics:

-- Picture of Nelson saying "HA! HA!"
-- Picture of MacDonald's and link to "Hamburger University"
-- Picture of funeral with the casket labelled "your future" slowly being lowered into ground
-- The Dell guy saying, "Dude, you're goin' to Community College!"

Re:Nice

By the way, just in case anyone thought I was kidding, there really is a Hamburger University [mcdonalds.com]. :)

working link!

you might want to link to this [yaledailynews.com]--the "high traffic" version of the article, since it actually works.

MSNBC.com story

Here is the story on MSNBC.com.

http://www.msnbc.com/news/785677.asp [msnbc.com]

Re:Ah, a true nerd's war

My sister graduated from princeton and they teach you to hate hate hate yale and harvard. At their triangle shows (a really funny play that the theater group puts on), if they say Yale at any time during their show, everyone in the theater must immediately say SUCKS. There is something similar for harvard, but I haven't been to a show in so long so I forgot). From the outside it seems lame, but it sure is funny.

Well, what's lame about it is that the rivalry exists solely on the Princeton side. Yale and Harvard focus their mutual dislike on each other, with Princeton carrying on their one-sided grudge from New Jersey and MIT periodically playing geekish pranks on Harvard. (Pasadena being too far away for routine hacks.)

March, march on down the field, fighting for Eli,
Break through that crimson line, their strength to defy...

Security?

Names, birth dates, and social security numbers? So they're saying they didn't use any sort of security on the site, then. Hmmf.

They weren't hacking.

Just think... if they had notified the Attorney General's office it would have been legal. Well. In a few months.

SSNs should be published in the phone book

This way stupid schools won't be tempted to use them as security codes.

"hack"

How many times have people here wailed at the non-tech press for using the word "hack" to describe what most would technically term a "crack"? Well if you ever actually read the article, you'd see that Princeton didn't hack or crack. They used the ssn and birthdate supplied to them by their own applicants to access Yale's pages. In other words, they had the users' login and passwords and used them. Not a hack, not a crack. Thoroughly evil of course, but "merely" a lie.

Re:"hack"

Actually the term hacker originally had nothing to do with unauthorized use of computer systems. Its a very old term (>20yrs). Read about it.
You don't know what you talking about. Get over it.

Re:"hack"

ESR's authority to "deprecate" the meaning of the word for his or anyone else's little ego reasons.

The correct term is amelioration - the changing of the definition of a word to a better connotation. Happens all the time in the world. ESR doesn't have the authority, but users of the language do. The opposite is pejoration. Examples of amelioration are praise (originally a synonym for appraise), knight (originally a servant), and earl(originally just a man). More examples of amelioration and pejoration are left as an exercise for the student.

Re:"hack"

Happens all the time in the world. ESR doesn't have the authority, but users of the language do.

Exactly the point. A dictionary should reflect the language usage, not attempt to mold it. That's why I find ESR's attempt to change the meaning so offensive. He's corrupting the very purpose of a dictionary.

MIT

Fortunately MIT does this a little differently and slightly more hacker proof. They don't rely on any publicly (to any admissions office) available information but assign you with a unique 9-digit id number from the beginning of the application process and all of your online information is tied to this id.

I should point out that you can only view your status (summary of received documents and final decision, nothing else) if you have this id and a last name but to actually update and change information on their information system you require a kerberos identity, the passphrases for which are sent (regular mail) after you're confirmed and accepted admission. I recall that the initial id-number is sent to you via regular mail with a confirmation that they received your application and assigned an interviewer etc.

Basically as long as you're not a complete moron (I think it is safe to assume this if you have been admitted to MIT) you're probably not going to give out your ssl-certificates or give out your id/uname/pw-combo plaintext over internet (and if you do you're totally responsible for all the misuse - they're not going to clear your name).

So I suppose MIT beat all the other ivy-league schools with respect to not getting hacked but then again what should you expect from the home of "hacks". [mit.edu]

SSN for Login is a bad idea

I'm starting college in the fall, at Southern Polytechnic University. Going through the registration process (which they had us do entirely online [from the campus computer lab]), I noticed a few things that left me, well, disquited to say the least, paranoid to say the most. To login required a username and PIN. The username was of course you're student ID number. Unfortunately, your student ID number is *pause for dramatic effect* your social security number. And the PIN's not much better. A six digit number initially consisting of...guess. Yup, the student's birthdate. Needless to say, first thing I did was change my PIN. Just wish we didn't have to toss our SSN around so much. If you think I'm overly paranoid, well, you have a knack for discerning the obvious.

Love and Peace,
Valen

This happens all the time

I work for UC Santa Barbara [ucsb.edu], and I've seen a lot of this before. We force users to select usernames and passwords, and until recently, did not encrypt the users passwords in our database. Just out of curiosity, I tried using the applicants username/password on the e-mail accounts they entered.

Sure enough, I was able to access many of the e-mail accounts. I quickly stopped, realizing that some of these people probably also used the same username/password combinations for their bank accounts, etc.

Now, when users log in, an MD5 hash is compared against the hashed password in the database.

Many of the people were Hotmail users. Just think when your .NET Passport is also your bank and credit card authentication, or your NationalID card authentication, or...

Exclusive schools do all kinds of sneaky things

Supposedly MIT and Harvard talk about who got admitted where. If you would have been admitted both places for engineering, they'll often only admit you at MIT and the other way arround for humanities and some of the pure sciences. And of course, if it seems you cn't live without "highest honors", they flag you for Brown. (Boo, hiss, yeah, I know. I really wanted to poke at Harvard, but Brown is so much worse in that respect.)

There was some fuss a few years ago about all of the Ivy League schools talking about what they were going to offer for financial aid, and then offering identical packages to the same student. They claimed it was so that only the studen't opninion of the school made the difference, some students felt it was illegal anticompetitive behavior.

In any case, schools always have gambles with who to let in. Admitting a student means you have to find space for her/him. Empty beds cost you money. The University of Michigan Anne Arbor is notorious for wait-listing students they think will go elsewhere. They wait-listed me and I got into MIT with no wait. The same thing happened to several of my friends at MIT.

High acceptance percentages also help pestige, which give you better students and more proud alums. More proud alums are better donators and better students make for more rich alums.

Re:I might just be an Oxbridge dummy but...

I just (barely) graduated from Yale, so I'll bite...

1. Why would Princeton want Yale rejects?

Because Yale (like many other schools of its type) gets so many good applicants that the admissions office claims you could get just as good a freshman class from the rejects each year. Since admissions is pretty much just dumb luck anyway, some quality people get rejected. And, of course, there's quite a bit of competition for applicants. Hell, some people get rejected from Yale and accepted at Harvard.

2. How crap is Yale for allowing something stupid like this?

Without going into too much detail, pretty dumb, yes. Most things here are given more careful thought.

3. How stupid are Yale for getting caught?

That's "Princeton" you meant. I think that's probably dumber. But it's hilarious all around. You just can't make this shit up...

In Defense of Princeton

There's plenty of evidence to back Princeton's excuse that they were just "testing" the system. Princeton doesn't have any system up to inform students of their admissions decisions online; Yale does. Princeton IS evaluating ways to do this, and it would appear that they were actually testing how well Yale's system works. In doing so, they found that Yale's system did NOT work so well.

And what did they do? Like the responsible hackers who merely hack to test for security holes and whose stories are sometimes linked here on Slashdot, they tried to tell the Yale people that their system was insecure. How does Yale respond? Do they thank Princeton for the warning? No, they report them to the police! If this were any "normal" hacker warning of security holes they found, everyone here would be up in arms!

OK, so what Princeton did was obviously stupid, immoral, and probably illegal, and certainly deserving of punishment. But while the Yale Daily Herald does mention Princeton's explanation/excuse, they do so in very dismissive terms, and several friends of mine who read the article entirely missed the excuse and thought that this hacking was purely malicious. It was NOT, and it would be nice if that were noted. Then again, this is Slashdot, which isn't exactly famous for its impartiality =)

(Disclaimer: I was one of the students who got into Princeton this year, so I'm biased. Any other current students or incoming freshmen here?)

Yale Knew They Had a Problem--Or Should Have

I just linked to the Daily Yalie site, and in their comments on the article there's a note from a former columnist in the Yale Herald: back in 2000 he wrote a column [yaleherald.com] pointing out Yale's prediliction for using the SSN for a password, and how anybody with half a brain could use that to hack all sorts of Yale systems. Definitely worth a look--and it will lead you to the conclusion that Yale's admissions people are, well, stupid.

John Murdoch
Penn '80

points out a major security flaw some systems have

At almost every credit card company, bank, and stock broker I have ever belonged, I have found them using a very simple set of data to identify callers as "legitimate":

• Name (of course)
• SSN (even though they are not supposed to, and variously the full number or just the last 4, which can vary between calls to the same company)
• Mother's maiden name
• address
• zip code
• phone number

Only my last broker has taken the additional step of asking me what my major current holdings were...

The problem, of course, is that everyone in my immediate family knows all of this information about me, including my SSN. So do all of my doctors/dentists, etc. In fact, a number of genealogical sites can find out almost all of that, too. Also, anyone intercepting my paper mail can find out from brokerage mailings what my holdings are. However, getting these people to add another form of ID to the accounts is always either impossible or very difficult.

Anyone else notice this problem, and have other suggestions or comments? I feel like lying on my mother's maiden name line from now on, and putting a password in it.