Another issue Henry found was in the way Polk County used Microsoft SharePoint platform, a collaboration and storage tool, to manage data. He noticed that students and teachers were lumped together in a Sharepoint "user group" and had all been granted the same access to files stored in the system. This meant that students could access anything on the Sharepoint, including each others' data. One file was labeled as containing student usernames and passwords and was simply an unlocked, plaintext spreadsheet of student login credentials for school accounts.
Polk County Schools did not return a request for comment on Henry's research. At the July 2019 meeting where Henry shared his findings, though, members of the school board appeared to support his work. "I've directed him multiples times to our IT staff," Billy Townsend, the school board representative for Polk County's District 1, said. "I think he's done some very useful things, from what I understand. I think we should take seriously what he's saying."
Henry also found and reported similar vulnerabilities in the systems of two private Florida universities last year. He says that making all of these discoveries while he was still a student motivated him to pursue a career in ed-tech cybersecurity.
"When I took a look, there was so much that was vulnerable—just a stupid amount of vulnerability," Henry says. "It doesn’t feel good. When you participate in a capture the flag hacker competition or do a cool bug bounty, it feels good to find stuff, but you see these flaws in education systems and there’s nothing to be proud of as a researcher. You changed a number or you just looked! I’m not some genius. It's just very obvious that nobody else is looking."
After some esp ..
Support the originator by clicking the read the rest link below.
