Background:
A few years ago, I asked this question about disclosing somewhat serious vulnerabilities found in my high school's computer network.
More than two years later, the principal was made aware (by overhearing other students talking) that I was rumored to be a "hacker" and called me into his office to ask about (unrelated) suspicious network activity. The assistant superintendent and two of the district's IT personnel were present in this meeting. Misunderstanding the situation, I assumed they were aware of the extent of what I knew and explained the issues I had found:
- The network administrator password is accessible to all users, and is located in a plain-text file on every computer
- Every computer has a local administrator account that requires no password to log into
- The security cameras throughout the building are accessible from the wired and wireless network, and can be streamed live, turned, set to stop recording, disabled, or otherwise messed with; the streams are unencrypted and the web-based camera control panels use the default (or no) credentials
- The web-based sign-on for the (otherwise password-less) wireless network can be trivially circumvented, allowing anyone to access it without authenticating themselves as a student
- The content filtering and website blocking system can be trivially circumvented
I also explained that I had found the issues several years prior, and had neither expoited nor reported them out of fear of the consequences. I think my unexpected disclosure of several major vulnerabilities took the prinicpal by surprise, and he said that I would not be suspended or expelled if I stopped all "exploration" of the network and stopped bypassing the school's content filtering system. I also think I may have embarrassed the IT guys in the room a little; they explained that they would not have known anything about my activities had I not told them.
I have since graduated, however right before graduating (roughly a year after my conversation with the school principal) I wanted to check whether the problems I had found were fixed, in spite of being explicitly instructed to not do so. Not a single one was. I have graduated, but I still take these issues very seriously. I feel that the vulnerabilities I found pose a major security and safety risk for the school district's thousands of students. This is especially true if the vulnerabilities are used in combination, since anyone can, for example, access the wireless network (and therefore the cameras) without authentication from outside the building.
Question:
I am wondering about the best course of action, keeping in mind that I directly disobeyed my principal's explicit instructions, that the issues are known to multiple levels of district administration and IT personnel, and that they have been aware of them for a full year. My identity is also now known, which means if I brought these issues back up, it would be difficult to do anonymously. With those factors in mind, my questions are as follows:
- What are the likely consequences of pursuing this further? Are they different now that I am no longer a student?
- How can I do my best to make sure these issues are resolved without resorting to speaking with the press as is suggested by some here or suing as suggested here?
- In spite of the seriousness of these issues, is it worth pursuing this further, or have I basically done all that I can?
