Is it a security vulnerability if the addresses of university students are exposed?

Question

I am sorry for my lack of knowledge in this matter.

My university (basically an international university in the UK that has students from different countries) has a website which requires the students to login before they can access their examination results. These results also include their Name and Address.

But by inspecting the network transaction, I found out that it went to a page that directly takes student registration number in the URL and displays the examination result related to that. This page can be accessed without logging in to the student account and without any hassle, it gave me the examination result that exposed the student name and address. I tried multiple registration numbers similar to mine and all were processed easily.

Another problem is that these registration numbers are in fixed length, only contain numbers and are in ascending order. So for example if a valid registration number is 000001 then the next one would be 000002 and so on.

So in my opinion an attacker can easily create an automated program that could generate these registration numbers, randomly or in order, and get the names and addresses of hundreds of students.

My questions are:

1. Is it universally approved practice for universities to expose the names and addresses of students?
2. Is it universally approved practice for universities that strong security related to name and address is not important?
3. Is it a severe attack and do I have to report it to them? Or can it simply be ignored?

Update:

I received the reply from the university and they have now fixed it. Thanks to all of you.

Answer 1

I am sorry for my lack of knowledge in this matter.

You shouldn't be.

Is it universally approved practice for universities to expose the name and addresses of students?

As pointed out in comments, it depends on your local laws and regulations. You should certainly check it once. But the way you describe the application(changing the URL to get the details, including the result), it sounds like a bug, which should certainly be reported.

Is it universally approved practice for universities that strong security related to name and address is not important?

No, be it a university or a big MNC or a small enterprise, or your own personal account, security is ALWAYS important.

Is it a severe attack and do I have to report it to them? Or it can be simply ignored?

Yes, you have to report it to the university, as soon as possible. It should not be ignored.

EDIT: As pointed out in comments, there are some universities which do allow students' addresses to be made public.

Answer 2

This is a vulnerability, the way they have used sequenced guessable numbers to access records is a class of vulnerability called Insecure Direct Object Reference and is featured in the OWASP Top 10 (https://www.owasp.org/index.php/Top_10_2013-A4-Insecure_Direct_Object_References)

Depending on where in the world you live, the university may be contravening data protection laws. At the very least it is poor data control and violates your personal privacy, you should certainly tell them about this.

Answer 3

Since the university is in the UK, this is almost certainly a breach of the DPA 1998. That is, this is not narrowly a ‘security’ issue.

A student home address would certainly count as ‘personal data’ within the terms of the Act. The fact that you can retrieve the data in this way is, I'm very sure, a violation of principle 7, and probably 6 and 8 as well). The principles are that personal data must be

1. fairly and lawfully processed;
2. processed for limited purposes;
3. adequate, relevant and not excessive;
4. accurate;
5. not kept for longer than is necessary;
6. processed in line with users’ rights;
7. secure; and
8. not transferred outwith the EEA.

The fact that you had to very mildly hack this to get the information doesn't change things: it means that it isn't secure. Principle 7, in full, is ‘Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.’

A final degree classification would count as public data, in the sense that part of your contract with the university is that they would tell people that you've graduated. Internal/intermediate marks would probably not count as public data (and that ‘probably’ means that there would have to be a positive argument that they did count as public, before it was OK to make them available like this).

The university should have a DPA office/officer who will go ballistic when you report this to them (and I think you should), and should be able to get very senior pressure applied to change it. They might not seem to make much of a fuss in response to your report, but I hope they would take immediate action internally. If they don't fix it promptly (or perhaps even if you don't see immediate evidence that they have done so), then a report to the ICO, as suggested by @daiscog's comment, would be proper.

Regarding the question of reporting this anonymously, you could if you want, but I would hope it wouldn't matter, and that the DP Office would be appropriately discreet (this is very much their problem, not yours). If there were any comeback, I'm sure the ICO would be extremely interested to hear about that.

I'm in effect the DP officer in our (UK) university department, and I know how I or the university DP office would respond to hearing about this.

(I originally posted this as a comment, but on reflection expanded it into an answer)

Answer 4

It's possible that it is by design, and not thought of as leakage of sensitive information. If you were to look at directories online, MIT, CMU, Stanford, and any others I think of all publicly list students and staff directories.

Universities in the United States are generally more concerned about FERPA, which protects student education records.

"Directory information" such as name, address, enrollment status and dates are not protected by default. Here's a good list of what qualifies as directory information and can be revealed to the public. The relevant stipulation reads:

A student's directory information may be released to an inquirer, outside the University, unless the student specifically requests that directory information be withheld.

If I were you, I would look around for a privacy policy before contacting the university. It is likely intentional. Your university likely has an opt-out clause to protect your directory information.

Also, most websites have their directories on do-not-crawl lists so that your records are not online on search engines. You may wish to check the robots.txt.

That being said, grades should never be disclosed. In practice, under a rare FERPA case, grades refer to letter/transcript grades and not individual classroom scores which are sometimes considered to be "lecturer notes".

Answer 5

Although an answer has been accepted and both Priyank and Iain make some good points, I think its worth looking at the question of whether this is sensitive data in more depth.

First off, there is something of a difference between exam results (typically a student will have many exams during their course of study) and qualifications (i.e. the final award by the institution). So it is also possible to infer whether an individual is currently a student.

This information opens the door to all sorts of targeted phishing - people pretending to be a student loan provider, offering refinancing or pretending to be official alumni organizations.

It is also a great asset for identity fraud. While I've never come across a wish-it-was-two-factor question about higher education ("What was our first school" still seems common) such a facility would facilitate fraudulent job/credit applications.

Hence, the question about whether this falls within the organizations privacy policy or local regulation is moot: it constitutes a dereliction of the providers duty of care to their students/graduates.

But the flip side of this is that it seems crazy to me that the only way I can prove what degrees I have to someone who asks (e.g. a prospective employer) is to show them a bit of paper (relatively easy to fake). But I imagine that most people reading this would be able to think simple, effective solutions to securely revealing such information.

Answer 6

Personally, I am mostly concerned that the system reveals the registration ID of the students.

I don't know how things are at your university, but in my time as a student, we wrote the RI on our exam answer sheets so that the graders wouldn't know who was who.

At your university, the graders can look up who is who and that is, in my opinion, a severe security breach.

Answer 7

If the information on student grades can personally identify an individual, this is almost certainly an issue. If on the other hand, all you can see are the grades associated with some unknown individual i.e. associated with some number, but you cannot determine precisely who that number represents, then it may not be considered a security issue as it could be argued the data has been anonymised. A lot depends on the privacy legislation in effect (most likely the UK legislation, but this can be affected by the country where the data is hosted/located and the privacy policies of the institution. For example, students might be required to agree to allowing their result data being made public as part of the terms and conditions of enrolment. However, this is unlikely.

Most countries have privacy legislation which determine what is considered to be private or personal information and in some cases, impose additional responsibilities on the hosting organisation with respect to what level of permission they must obtain from the individual to make data public and what actions they must take should data be accidentally disclosed or breached via some sort of security failure. For example, in the US, if a company has an incident where personal data is either deliberately or accidentally compromised and that data has possible financial implications, such as exposure of credit card details, the organisation is required to provide credit monitoring services to affected individuals for a period of time. Some countries also have mandatory data breach reporting and notification legislation, which requires the organisation to notify individuals and often a central authority when data has been compromised.

Unfortunately, governments have struggled to develop clear and consistent legislation relating to privacy and to maintain legislation which is able to keep pace with technology. There are significant differences between countries with different emphasis and objectives. For example, the US has considerable policies relating to privacy and mandatory reporting, but they also have legislation relating to homeland security and anti-terrorism which some feel compromises personal data privacy. Germany and a number of other European countries have vary strong legislation to protect personal privacy. Australia has relatively recently updated personal privacy legislation, but is struggling to introduce mandatory data breach reporting legislation etc.

From your description, I suspect that you have indeed discovered a data access vulnerability and you should almost certainly report it to the University. Unfortunately, it isn't always easy to find out how to report such issues. The first place to check would be to look at the organisation's privacy policy. It is also likely the UK has a central authority, such as a privacy ombudsmen, which you could also report this issue to.

You should also be aware that you need to be vary careful about accessing this data, especially using the URL manipulation technique you described or providing specific details regarding how to access the data. In some countries, it could be argued that you have broken the law and you could be charged with 'hacking'. The pace of technical change combined with a lack of understanding within the legislative and judicial systems has resulted in some poorly drafted legislation and legal interpretation of that legislation. There have been a number of cases where individuals have been charged for publicising data access vulnerabilities. While such charges usually don't result in a conviction, the potential hassles this sort of charge bring with it are best avoided.

Answer 8

Indeed. Especially if the university agrees to keep such information private, this could be a huge violation of their own policies.

Answer 9

In the US, merely writing a simple script that scrapes such info can get you a 3.5 year sentence. If the university did no intend to make this info public, it will be considered a vulnerability.