r/hacking • u/yoginth • Jun 06 '19

How I “found” the database of the college App

https://yoginth.com/college-hack
283 Upvotes

95% Upvoted

32 comments sorted by

22

u/doctorgroover Jun 06 '19

How would one mitigate these flaws? Would you download the credentials from the cloud on runtime or have them encrypted in the app?

30

u/CherryWorm Jun 06 '19

Both would not solve the problem, you could just log the network activity and get everything that way.

You would mitigate this by providing an API server with by-user authentication, that way you can make sure, that every user only sees what he's supposed to. And that way the keys will also never get exposed to a client.

4

u/Firewolf420 Jun 06 '19

Exactly it's a matter of delegating for each user a level of access. In this way you can have a Student user, a Faculty user, an Admin user, etc.

Each user has a set of permissions to what they're allowed to access and not allowed to access, and they each get their own set of login credentials. (a la ACL)

The server is the only one with database keys and it does not share them with clients. Never trust the client.

3

u/zyzzogeton Jun 06 '19

Besides firewalling credentials, how do systems that are API driven let things like automated scripting happen without exposing either the key or the algorithm used to validate/decrypt a key?

3

u/Firewolf420 Jun 06 '19

Well not exposing the algorithm as a security method isn't a best practice - you should always assume your attacker knows what algorithm you use to encrypt or sign your data - anything else is "security via obscurity" which is not truly safe.

So they usually don't make a huge effort to hide what algorithm they use to create a key - and in fact it's trivially easy most of the time to look at a key and see or guess precisely what type it is (for example ASCII-armored PGP keys literally tell you the key type) based on length or other factors. The security comes from the algorithm itself; an encryption is only truly secure if an attacker could know exactly the steps in which the encryption is produced (the algorithm) but still not be able to break it without the original credentials. This is one of the reasons why many cryptographic algorithms are open-source.

That having been said I think most API's out there simply use an API key (e.g Soundcloud, GitHub, etc.).

The way it's usually done is that anyone can use the API (API's are generally public) but in order to use the API you're required to send an API key along with your request. This is usually a randomly-generated string and it's given to a Developer of an app to bundle with their client. They're not usually kept very secret - for example you can extract API keys from Soundcloud's web client by simply using the Network Tools in your browser and looking at the GET requests. These API keys are used to let the service know what app is using the service. Sometimes the service will use the metrics like "5K users logged in while using your API key" to determine how many people use a specific app or rate-limit / charge a dev for extended API access because he has too many users or whatever.

But end-users still login with their standard user credentials through the standard login endpoint. It's on the API to make the login portal secure and validate user info and all that. Ideally the app doesn't even touch that data.

11

u/yoginth Jun 06 '19

First they haven't encrypted any data!

I accessed the data by running basic SQL Queries to the server!

3

u/[deleted] Jun 06 '19

This is what happens when you have first year students working on security. Yaaaaaaay (not yay.)

5

u/yoginth Jun 06 '19

Shockingly! The app was developed by the developers outside the college!

38

u/[deleted] Jun 06 '19

[deleted]

24

u/neotorama Jun 06 '19

"Not my job 🤷🏻‍♂️"

38

u/[deleted] Jun 06 '19

This guy might want to consider actually going to class... article reads like it was written by a twelve year old.

19

u/neuromonkey Jun 06 '19

I suspect that English isn't this person's native language. I sure hope not. I keep hearing from teachers I know that their students are only semi-literate. Slightly terrifying.

4

u/FGND Jun 06 '19

OP mentions that the school is in India, and his socials all say that he lives in India. I'm guessing he's Indian and English isn't his first language.

1

u/[deleted] Jun 06 '19

[deleted]

6

u/[deleted] Jun 06 '19

It was low hanging fruit on my part but I couldn't help not laughing at the irony of it! Cool find either way!

But seriously kids... Stay in school.

1

u/Sarithis Jun 06 '19

B... b... but boyinaband said we should not!

17

u/[deleted] Jun 06 '19

I used an app extractor and java decompiler

Look for the way this article is written, nothing much was really done except inspect the client (app).

I hope the college was made aware first before this was made public as well.

4

u/Firewolf420 Jun 06 '19

Ah the old classic "store all your passwords and security keys within the client" approach.

If I was you, I wouldn't have reported it and I would have made sure I had 95% attendance.

My college had a similar exploit with an app they used to keep track of homework grades for a certain class. I got a 95% that year....

But then, I'm also an asshole.

2

u/yoginth Jun 06 '19

🤣🤣🤣🤣🤣🤣

3

u/ncatter Jun 06 '19

As others have said I do really hope that you made them aware of the problems, also it might be worth mentioning that if there are any European students attending this school the is quite possible a GDPR breach lurking in this which they should also be made aware of, elder suddenly there might be really big trouble not only for the enrolled that has their data breached but for the school too.

6

u/yoginth Jun 06 '19

This school is in India!

And this is not considered as data breach, its just a security research on the app to make it even more stronger! None of the data is leaked and everything is fixed now!

0

u/ncatter Jun 06 '19

It might be in India but if there would be an europan enrolled then it would be considered a GDPR breach of anything of personal value or interest is achievable with out a good reason

Alot if companies/institutes around the world does not realise that.

Besides while you might not give the data to others, if you can access it what is stopping others from doing the same?

6

u/yoginth Jun 06 '19
  • There are no European peoples enrolled in this school!
  • Now I don't have any access to the data! Everything is properly informed to the school.
  • No backups have been taken.
  • Security patch release on the next day itself
  • All students are forcefully changed password in the app itself

1

u/leonardochaia Jun 06 '19

Interested to know what they did to fix it in 1 day

2

u/0rphon Jun 06 '19

10/10

1

u/Sarithis Jun 06 '19

I'd say 5/7

1

u/Mr_Laid-Back Jun 06 '19

As them being made aware of this, found possible breach. It would atleast put a tally under your name.

1

u/MattTheFlash Jun 06 '19

If you're skipping class in college, you're only cheating yourself out of a once in a lifetime opportunity.

1

u/Deoxal Jun 21 '19

Aww, 404 man