API tools faq
paste
Advertisement
BaSs_HaXoR

Hacking MyMathLab (Case-study; Software Sec.)

BaSs_HaXoR
Sep 7th, 2016
480
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.75 KB | None | 0 0
raw download clone embed print report
  1. MyMathLab exploit(ed):
  2.  
  3. Source: http://www.mikedoesweb.com/2011/hacking-my-math-lab/
  4. // ---------------------------------- EXPLOIT ---------------------------------- //
  5. // // Writings on Web Development and software in general // //
  6. // Hacking MyMathLab (a case study in software security best-practices) //
  7. // January 3rd, 2011 by Michael Jasper //
  8. // ---------------------------------- EXPLOIT ---------------------------------- //
  9.  
  10. // ---------------------------------- Details of Article ---------------------------------- //
  11. This article details an experience I had while using the software MyMathLab, and overviews software security best practices. There is no information in this article that would allow students to alter their grades or cheat in any way, but details minor exploits in the software and security infrastructure related to “locking down” a workstation. This post was written for educational purposes relating to software development and security.
  12.  
  13. In keeping with security best practices, the software vulnerabilities were immediately show to both a math faculty member and a campus IT employee sometime before being published in this article.
  14.  
  15.  
  16. // ---------------------------------- What is MyMathLab? ---------------------------------- //
  17. MyMathLab is a software product, owned by Pearson (one of the largest textbook publishers in the US), including:
  18.  
  19. The Art Institute of Houston, ASU, Baker College, Boise State University, Bossier Parish Community College, Cabrini College, Central Texas College, Chicago State University, Cleveland State Community College, Coastline Community College, College of the Sequoias, DeVry University, Florence Dablington Technical College, Florida State College at Jacksonville, Front Range Community College, Henry Ford Community College, Hillsborough Community College, Houston Community College, I State, Ivy Tech Community College, Jackson State Community College, Kapi’Olani Community College, Lone Star College Montgomery, LSU, Memorial University, Mesa Community College, Mississippi State University, Norwalk Community College, Odessa College, Quinsigamond Community College, Reading Area Community COllege, Riverside Community College, Rock Valley College, Sait Polytechnic, South Suburban College, Southern Illinois University, The University of Alabama in Huntsvilee, Triton College, Umpqua Community College, University at Albany, UHD, University of Idaho, UIC, The University of Mississippi, UT, The University of Toledo, University of Wisconsin-Stout, Volunteer State Community College, and Yavapie College
  20.  
  21. // ---------------------------------- WHY? ---------------------------------- //
  22. Why I Tried:
  23.  
  24. During the first-day-of-class-reading-of-the-syllabus my professor came to this line: “Do not use the computers in the classroom or math lab to use email, or use any other non-math website.” “Actually,” he said, “I’m pretty sure that the computer department locked down all of the computers, so why don’t you try, if you can actually get anywhere I’ll be pretty surprised, but come and show me.”
  25.  
  26. Challenge accepted!
  27.  
  28. // ---------------------------------- Finding the Exploit (recon/bugs) ---------------------------------- //
  29. MyMathLab Opening Screen
  30. During my first glance around the software, I gathered some basic information:
  31.  
  32. MyMathLab is a web-application that allows students to
  33. read from an e-text (a pdf)
  34. watch video examples (in quicktime)
  35. do homework in a flash application
  36. watch math presentations (powerpoint)
  37. MyMathLab runs in a stripped down version of Internet Explorer.
  38. The entire computer seems to be under the control of some type of user-access control system. Attempts to click on the start-bar or the windows time are met with an “Unauthorized Function!” dialog box. I seem to be completely sand-boxed in.
  39. There is no physical tower, or box powering my monitor, keyboard, or mouse. I seem to be using a terminal that connects to a MyMathLab server somewhere else on campus.
  40. Thinking back to my experience at a highly micro-managed yet highly incompetent call-center, I remembered that my first, and probably easiest route to escape would be to find a dialog box that I could hijack and turn into a make-shift explorer window. From there I could navigate to anywhere I had permissions.
  41.  
  42. // ---------------------------------- Failure 1 ---------------------------------- //
  43. Failure 1: The weakest point in any system is the reliance on any third-party controls or software to perform a critical function.
  44.  
  45. Administrators will perform their due-diligence in locking-down any user access that they have created, but often fail to check, or even understand third-party systems that they give rights to — assuming that the third-party system will always behave.
  46.  
  47. This route of attack was remarkably simple, yet yielded a remarkable amount of access.
  48.  
  49. // ---------------------------------- Step 1 ---------------------------------- //
  50. Step 1: find a dialog box
  51.  
  52. While the quicktime tutorials and the pdf e-text both opened in a custom reader, or at-least a custom shell of a known reader, the slides opened up right in a fully-featured Powerpoint session. I was a little surprised! I first went for the “open” button, which led to a “Unauthorized Function!” message. Good Job, guys. Open Recent and Save As were both dead-ends too.
  53.  
  54. “Let’s get creative,” I thought, and created a new document. That worked! I noticed that more of the ribbon appeared — I must have been looking at a read-only version of the math slides. Now I see more font control, as well as some shapes, as well as more buttons along the ribbon: Insert, Design, Animation, Slide Show, Review, View, and Format.
  55.  
  56. The Insert tabs looked like a gold mine: insert videos, images, objects(ole I’m assuming), etc. Inserting an image finally led to my dialog box!
  57.  
  58. // ---------------------------------- Step 2 ---------------------------------- //
  59. Step 2: Explore Access.
  60.  
  61. I held back my hopes as the Image dialog box opened for me. A couple things could still go wrong at this point: I might only have access to my sessions Documents and Settings Folder or the file-type could be restricted to images only. I held my breath and click on My Computer on the left of the dialog box…
  62.  
  63. Oh. My. Word.
  64.  
  65. C:/MyMathLabServer
  66. Network Places
  67. To test out my permissions, I right-clicked, created a new text file, and then proceeded to delete that file. Success.
  68.  
  69. // ---------------------------------- Failure 2 ---------------------------------- //
  70. Failure 2: Giving the user write permissions to system critical files.
  71.  
  72. Now for a look around: C:/ had all the normal stuff: program files, windows, documents and settings.
  73.  
  74. The most I dared to do was to open one the the DLL files in program files/mymathlab with notepad and make a small change in a comment section, save it, and then change it back after checking to see if it worked. It did. I also had access to the host-file entries that prohibited any access servers other than mymathlab. Probably the most damning however, was my ability to open the command prompt, which allows nearly unrestricted access to the inner workings of the local network, as well as the local workstation.
  75.  
  76. // ---------------------------------- Failure 3 ---------------------------------- //
  77. Failure 3: The workstation user account had access to the command prompt.
  78.  
  79. // ---------------------------------- OUTCOME ---------------------------------- //
  80. After class, however, my inner white-hat prevailed, and I ended up telling my professor what I had found, who then nearly sprinted up to the CS support lab and dragged a tech down for me to walk through my simple exploit. And seeing as I gave CS support adequate warning about the exploit, I now have no qualms about sharing my story, because I’m sure its fixed by now!
  81.  
  82. The moral of my story? Don’t be a bad programmer, don’t rely on third-party software/controls for essential functions, and most of all: don’t try and lock-down students, it just makes them curious.
  83.  
  84. // ---------------------------------- ABOUT THE AUTHOR/EXPLOITER' ---------------------------------- //
  85. Posted in Commentary, Featured, Math
  86.  
  87. Michael Jasper
  88. Mike Jasper
  89. github logo github.com/mdjasper
  90. github logo npmjs.com/~mdjasper
  91.  
  92. profile for Michael Jasper on Stack Exchange, a network of free, community-driven Q&A sites
  93.  
  94. Web development is a wonderful synthesis between logic and art. In an average day, I will consider color theory, design patterns, and the intricacies of a given language.
  95.  
  96. To best serve my existing clients, I am not taking new clients at this time.
  97.  
  98. Privacy Policy
  99. © 2009-2013 Michael Jasper
  100. // ---------------------------------- ABOUT THE AUTHOR/EXPLOITER' ---------------------------------- //
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!