Blackboard Campus IDs: Security Thru Cease & Desist

On Saturday night, Virgil and Acidus, two young security researchers, were scheduled to give a talk at Interz0ne II on security flaws they'd found in a popular ID card system for universities. It's run by Blackboard, formerly by AT&T, and you may know it as OneCard, CampusWide, or BuzzCard. On Saturday, instead of the talk, attendees got to hear an Interz0ne official read the Cease and Desist letter sent by corporate lawyers. The DMCA, among other federal laws including the Economic Espionage Act, were given as the reasons for shutting down the talk (but -- update -- see the P.P.S below). I spoke with Virgil this morning.

Virgil was there two years ago when Dmitri Sklyarov was arrested and led away in handcuffs at Def Con 9. He's not in handcuffs now, but in speaking to me, he had to stop and think about everything he said, and every third answer was "I really shouldn't talk about that."

The DMCA is largely to thank for that. Section 1201 states that no one "shall circumvent a technological measure that effectively controls access to a work," and that no one "shall... offer to the public... any technology" to do so. Blackboard Inc., whose card system is called the Blackboard Transaction System and known to end users under various names, uses a network of card readers and a central server, and they communicate over RS-485 and Internet Protocol -- using, or so they apparently claim, measures that effectively control access.

For the record, none of what I learned about the Blackboard technology was from him or Acidus after the restraining order was sent. I spoke to other people, who have not been served with a restraining order. Google has a less enlightening mirror of the slide titles from this weekend's PowerPoint presentation and a more enlightening mirror of Acidus's "CampusWide FAQ" from last July. And, most enlightening of all, this mirror has an updated version with details on what they figured out how to do and what their talk was going to be about (click "CampusWide" for the text description, the PowerPoint slides, and Acidus's timeline of the last year).

At many schools, Blackboard's system is the ID: you swipe your card for your meal plan at the cafeteria, to get into your dorm, maybe even to get your final exam.

A swipe at a vending machine will get you a soda -- a money transaction from your campus debit account. When you use a swipe to do laundry and make copies, money has to be involved. Blackboard even notes that they can set up a merchant network on- and off-campus: "a cashless, safe, and secure way to transact on and around campus while offering parents the assurance that their funds will be spent within a university-approved network." (Emphasis added. Maybe readers who go to schools that use such a system can expand on how that system is used.)

The kicker, of course, is that this network is not very secure, or at least Blackboard doesn't think it's as secure as... well, as lawyers. One anonymous Slashdot submitter wrote that: "The authentication system is so weak that [Virgil and Acidus] have been able to create a drop in replacement for the CampusWide network debit card readers used on coke machines on campus."

Virgil couldn't provide me any details about what he had learned about the system. Based on the mirrors, it looks like a man-in-the-middle replay attack -- which is a pretty simple attack, repeating messages sniffed over the RS-485 protocol, or even over IP -- can have effects like convincing a Coke machine to dispense free product. Or, it's claimed, the attacker can create a temporary card, with no name attached, and free money in its account. Hmmmmm.

Or, more ominously, someone else's identification might be sniffed, and then replayed from a security terminal. If a thief gained entrance to a building by sending the message "open the door, my name is John Doe," the real John Doe might be sorely inconvenienced the next morning.

So, if you're a student at a school that uses Blackboard, do you feel more secure now that the DMCA has tried to stop you from learning about its security flaws?

If you're a parent putting money into a Blackboard-based debit account, do you feel more confident of its safety now that this information is ostensibly hidden?

This card system has been installed on many campuses and its roots go back almost twenty years. My guess is that replacing the card-reading hardware would be necessary to improve the security of these devices. Obviously, Blackboard would be hard-pressed to replace thousands of hardware devices at all its locations, even if they'd started in late 2001 when Acidus claims he called to tell them of the flaws he'd found (and "was blown off").

So, assuming that's not possible -- is the DMCA a viable tool to ensure security?

P.S. Virgil tells me that he has a good lawyer. They are scheduled to argue on Thursday that the restraining order not be made permanent. Slashdot will keep you apprised of what happens in our Slashback stories... stay tuned.

P.P.S. Update: 04/15 02:30 GMT by J : Now online are the restraining order, which just lists the six things that Acidus and Virgil are not to do, and the more detailed Complaint. Now that these are available, as Declan McCullagh points out, it turns out the DMCA was only in the lawyers' threatening letter and not considered as part of the Complaint itself. I'm not sure why it would be included in the letter -- some of the language of the Georgia Computer Systems Protection Act is similar, and who knows, Section 1201 might be mentioned later on, as this case progresses. Maybe the lawyers are just keeping their options open. Meanwhile, I love this part of the Complaint:

"Mr. Hoffman openly acknowledges on his website that 'I am a hacker.' His website then defends the process of hacking. See Exhibit B."

obviously not

[ih8apple]

To answer the question "is the DMCA a viable tool to ensure security?"

Here's [bbc.co.uk] an article from the BBC [bbc.co.uk].

and here's a good presentation [treachery.net] from toorcon.

and lastly, this [itworld.com] is a good article from ITWorld.

Try dotLRN - the Free and Open Source alternative!

[tsmoke]

dotLRN [mit.edu] is the free and open source alternative to Blackboard and WebCT. It is released under the GPL. It is totally open source, supporting PostgreSQL as well as Oracle.

It was originally funded and built by the Sloan School of Business at MIT [mit.edu] and has recently been adopted by the University of Heidelberg in Germany, the University of Bergen in Norway and parts of Cambdridge University in England.

This past weekend I attended the dotLRN Seminar [collaboraid.biz] in Copenhagen and over 70 people from over 20 institutions worldwide were present. dotLRN's future is very bright!

Also, you can rest assured that no learning institution will ever face silliness such as this.

talli

Re:*cough* Clueless *cough*

[HeghmoH]

Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances.

Sounds to me like "you can say what you want, when you want, and no consequences" to me.

Re:Another way to go about this?

[Dyolf Knip]

Obviously, Blackboard would be hard-pressed to replace thousands of hardware devices at all its locations, even if they'd started in late 2001 when Acidus claims he called to tell them of the flaws he'd found (and "was blown off").

And you know very well that this is not the first time this sort of thing has happened.

Re:Another way to go about this?

[Anonymous Coward]

This is a snippet from Acidus' old website. It relates the timeline of events. I hope you enjoy.

Sorry for posting AC but since this does come from Acidus' website ....

Spring 2001 - I got interested in the Buzzcard network on Campus. Based on the AT&T logo, I went to the Internet and soon found out about the system. Lots of Web research done, and fieldwork on the connection between the device and the reader. Locked Cabinet with Multiplexes was opened and photo was taken of insides. Determined which wires to cross to make doors open, laundry machines get credited, etc.

Summer 2001 - Continued exploring the system, called the company (now Blackboard), and interviewed Jim Resing.

Fall 2001 - With Publishing of my Fortres article, increased last minute field research, and finalized my notes. Called Blackboard again to tell them all the flaws I found, was blown off.

Spring 2002 - Wrote Article, and was published in Spring 2002 issue of 2600.

6/2002 - Blackboard learned of my article. The Blackboard Usergroup tried to track me down; finally figuring out I went to Tech, saw my web page and was very upset. Concerns about how accurate my article was are posted by schools around the country to the list-serve. GT tells the list-serve that they are looking into it and they would reply again soon.

GT Police asks to speak to me to determine if crime was committed. GT Police never file charges and indeed I am told there is no long an investigation. Buzzcard Office conducts internal audit of their systems. I go to Buzzcard office unsolicited to try and assist them in securing their system. They were not happy to see me. Office of Information Technology (OIT) on campus starts a test of the Buzzcard system to see if any of the attacks described in article are valid.

Buzzcard office asks that I remove picture of inside of the locked cabinet from my web page (since its hosted on GT machines), which I did. Buzzcard center asks me to remove AT&T cached pages, which I refuse to do. (Its not theirs, if AT&T wants it down, they can ask me).

Buzzcard office reluctant to talk with my about my article, since they don't want to confirm or deny how accurate I was. They do confirm the VTS could be hacked and money can be added to any accounts as I describe. However parts of my article (namely how to clone a card through the VTS), are, they claim incorrect. They ask if I would write a letter for the list-serve that explains what parts were incorrect. I agree as long as my letter will be unedited, and I get to also stress what parts are accurate to let colleges learn what they need to secure. Buzzcard office agrees but continues to cancel my meetings with them and not return phone calls. I am contacted by several colleges that are on the list-serve. They tell me that Tech has all along been posting that they have interviewed me, that my article is totally false. Tech uses such loaded statements as "As any experienced administrator should know, these security holes are not possible." These colleges are concerned Tech is not being truthful, and want to talk to me. I see that the Buzzcard center was stringing me along, and cease my attempts to contact them, or help them fix their pathetic security.

OIT concludes their investigation, and confirm that everything in my article is correct, except about how to clone a card. Tech does not post these results to the list-serv.

Dean of Students is involved, and is checking to see if, while no laws were broken, if I broke institute policy.

Re:Try dotLRN - the Free and Open Source alternati

[op00to]

Yes, I'm sure some open source courseware project will kick the pants off of Blackboard, which is a closed-source electronic commerce system for vending machines and POS. Way to go, Einstein.

Re:What about this analogy

[Frobnicator]

or should the person go tell the bank so it can fix it?

They DID try to tell the company, and were "blown off".

But what if the bank ignores you? Should someone be allowed to convey information about a problem with a system if the system controllers refuse to fix it? I'd still think not - it'd be one thing to state that there is a vulnerability, and that in good conscience could not state what the vulnerability is, and quite another thing to go explaining the vulnerability to everyone else.

This is something compuer security has had to deal with for quite some time. The normal ethical guidelines are to first contact the vendor and attempt to work with them to find a solution, and release the information once the vulnerability is corrected. If they either ignore it or fail to correct the problem in a reasonable time frame, the consensus is to take the problem to the security experts and users of the security system generally. This is based on the theory that criminals may already have such knowledge, and therefore the users need to know in order to protect themselves.

Hope that helps with your question.

Re:*cough* Clueless *cough*

[Ungrounded Lightning]

Congress shall make no law [...] abridging the freedom of speech, or of the press; [...]

Sounds to me like "you can say what you want, when you want, and no consequences" to me.

What you want, yes.
When you want, yes.
No consequences, no.

The amendment has been interpreted to mean that the congress can't stop you ahead of time, but can set up rules for punishing you after the fact if your speech meets certain criteria. (Like harming others, soliciting crimes, or otherwise interfering with a "compelling state interest".)

While I'm with you on this one (the GOVERNMENT shouldn't be setting up any content-based penalties for speech, before or after the act), the Supreme Court says otherwise. And there's no appeal beyond the supreme court - which is why it gets to rule on the constitutionality of laws and have the rules stick.

(Oh, well. They say two out of three ain't bad...)

Re:Try dotLRN - the Free and Open Source alternati

[pythas]

You're thinking of another thing called Blackboard [blackboard.com].

Way to read the article, champ.

I have a OneCard

[Feztaa]

I'm a student at the University of Alberta [ualberta.ca], and I have one of these OneCards.

There are various machines around that let you deposit money onto your OneCard, but there is no "university-approved network" of stores that accept the OneCard as payment.

The OneCard is primarily used for borrowing books from the library, and for operating the photocopiers/printers on campus, and there is exactly one vending machine on campus that allows you to pay with your OneCard.

As for people living in residence who have meal plans (like me), there's a separate card for that, provided by Aramark [aramark.com]. To get into our dorms, we have keys. Laundry is coin-operated. The OneCard has absolutely nothing to do with the on-campus residences.

For most finals and midterms, we're required to show our onecards and/or driver's licenses as photo ID, but the OneCards aren't swiped through a card reader or anything, it's just photo ID, nothing more.

There are restricted areas on campus that you can access by swiping your OneCard and punching in a secret code, but as a first year undergrad, I don't have access to any of those places so I can't say what it's like (though for most of the places that aren't top-secret nuclear research facilities, it's almost trivially easy to get in by walking in when somebody else walks out -- we're friendly here in Canada, generally we hold the door open for people we don't know).

So, if you're a student at a school that uses Blackboard, do you feel more secure now that the DMCA has tried to stop you from learning about its security flaws?

Gee, I dunno. This is Canada, there is no DMCA here (as far as I know, anyway). Hopefully some Canadian security researcher will hear about this, and continue the research here...

Re:ThoughtCrime!!!!

[ZeLonewolf]

You must mean "doubleplusungood"...

Re:Could someone please not be a wuss about this?

[ccoder]

We are standing up and fighting it. In the past 48 hours, the local CBS station (who would be doing more, but needs more validated information which they don't yet have), Salon.com and a few other _news_ organizations have been very interested.

Subscribe to [e-mail] ([e-mail]) if you want to chat with the locals about this... or have tips. The con organizers for likely reasons can't comment on enough information, but other people have... more information.

-Iridium (on that list)

Trade secrets and the Economic Espionage Act

[Animats]

The Economic Espionage Act of 1996 [cybercrime.gov] is worth reading. It's overly broad, and its definition of trade secrets is broader than that of the Uniform Trade Secrets Act.

Trade secrets used to be frowned upon by the law. Patents were legally preferable, so that when the patent expired, the knowledge went into the public domain. A trade secret could be lost easily; any publication by anybody erased trade secret status. All trade secret law really did was to put some teeth into confidentiality requirements for employees. It didn't affect outsiders.

All that has changed in the last decade. Between the Economic Espionage Act, the DMCA, and several court rulings, trade secrets now look more like property rights.

Re:Companies hurting themselves

[Anonymous Coward]

http://www.se2600.org/acidus for the source. Seriously, anyone who was there knows exactly what is going on. Too many people ALREADY KNEW for them to do ANY GOOD blocking Acidus and Virgil from talking.

Good luck lawyers. Bite me.

DMCA isn't about security

[Planesdragon]

So, assuming that's not possible -- is the DMCA a viable tool to ensure security?

The DMCA isn't about secruity--it's about copyright. Read the DMCA [copyright.gov], also known as Chapter 12 of Title 17, USC, and decide for yourself.

IMO, the law should either be moved to a general security law, or it shouldn't be interpreted to cover anything except the aiding and abeiting of real anti-copyright infringment sale aid--that is, unless a device is intended to protect a document that's transmitted / broadcast, the DMCA shouldn't touch it.

Then again, these are new positions for me--reply and you might change me again.

Re:*cough* Clueless *cough*

[Frobnicator]

Sounds to me like "you can say what you want, when you want, and no consequences" to me.

Not quite true. The first ammendment does *NOT* apply when the speach is contrary to the purpose of the Constitution, which is: [T]o form a more perfect union, establish justice, insure domestic tranquility, provide for the common defense, promote the general welfare, and secure the blessings of liberty to ourselves and our posterity[.]

First, the standard IANAL but I play one on /., and seek legal advice regularly.

Now for an example, yelling about a fire or a bomb in a movie theater is a violation of the Constitutional protection on speech. The courts have been working on establishing the guidelines for different classes of speech that are protect and that are not, such as informational (IE: a book about ways to kill people) and those that are functional, or produce actions (a book that entices people to kill others). Informational speach is protected, functional speach may be restricted.

The same is true for technical issues, although I wouldn't want to be a lawyer in that case. Arguing on first-ammendment lines, you would have to demonstrate that the claims are purely factual, that the research was conducted legally (many laws explicitly allow exemptions for researchers), and that the paper is purely informational and not functional. If the paper were functional, then it might be interpreted as being restricted by the various laws.

But then, as other posters have said, if a student or university does lose money due to this flaw (which is likely) then they can take it back to the company and sue it for not repairing or disclosing a fatal, known flaw in their systems.

[sigh]

Maybe someday we will be free from the IP garbage that has been spewed out over the past decade. Or maybe we'll get a utopian world where everyone will be honest and do the 'right thing'. No more need for security systems, and software flaws will be presented, evaluated, and repaired quickly...

frob.

Re:it's over

[Qzukk]

Yes, the same could be said, but unlike photography where you have to take a picture of a child to make child porn, did you know that a major entertainment company once convinced a judge that your DVD player makes a copy of the DVD to play it (naturally, this copying was only authorized in authorized DVD players, using any other player was to be considered unauthorized copying, they insisted). Just keeping your nose clean means nothing when the RIAA starts to insist that because your speaker level was above 20%, you owe royalties for every one of your neighbors because they might have been able to hear your music too.

The fact is, the people in charge are so technologically incompetant that the laws they wrote are being rewritten in legal precedents as companies twist them and the weak minds of judges and juries. The DMCA could have been a great copyright protection tool. Too bad it now covers everything from Wal Mart's prices to garage door openers, a far cry from its intent. How long before the internet is illegal under the DMCA and everyone with a computer is fined for possession of a circumvention device?

So yeah. You have free will. You can choose to live your life on the straight and narrow. And you'll even get away with it as long as the MPAA, RIAA, or someone else doesn't want your money. Or you can sell your computers and live like a hermit.

Just like the unibomber.

My univ. uses this system

[Anonymous Coward]

So, if you're a student at a school that uses Blackboard, do you feel more secure now that the DMCA has tried to stop you from learning about its security flaws?

The security on the system is almost laughable. Multiple unchecked user input flaws have come over bugtraq in the past couple months that allow one to retrieve MD5 hashed passwords of an account of your choosing, exploitable over the internet. Some of these holes have been patched.(If memory serves its possible to brute force a password that hashes to the same MD5, thereby logging in as anyone who has access to the system) Professors use the system for quizzing, grades and god knows what else. Last I checked even the quizing system's timer was controled by a Javascript countdown timer (need more time to complete that final? No problem, set your system clock back by an hour). We have the ID cards that work like the ones described also, but ours until very recently were encoded with our social security numbers (!!!).

How can I tell if I'm vulnerable?

[Jester99]

I go to Cornell University. I have one ID card that swipes *everything*. Access to dorm hall. Attendance count at mandatory lectures. Meal plan. Laundry account. Snack/soda machines. Credit card.

Some people have been asking "what 'University approved network'" in other posts. At least here, we've got an account tied to our cards called "city bucks" that lets us spend a declining balance at local off-campus restaurants, and I think a couple supermarkets too. While City Bucks is Cornell-specific, I'm sure other universities have similar things.

I think there are other accounts too, but I forget them. The point is, I'd like to know if I should complain to someone in administration.

Anyway, we have a server with the Blackboard Courseware website software on it, but that doesn't mean we've got their card system too.. but how can I tell if we do use their card swiping system? (There isn't a logo on my card that would identify it as any particular brand.)

Re:Wait a second ...

[Corydon76]

They did - or more precisely, Acidus did. This is not the first go-around with Blackboard. Read the FAQ. The first time he published the exploits of Blackboard, they stonewalled him, all the while claiming to their customers, "Anyone with half a brain knows these exploits aren't possible." The only problem was that most of their customers had full brains - and understood that Blackboard was bullshitting them (and contacted Acidus directly to confirm this).

Re:Duh...

[harvardian]

Actually, the US Supreme Court recently ruled that cross burning is, in fact, illegal [suntimes.com].

But the supporting opinions agreed that it should be illegal because it is a form of intimidation, and I don't think anybody believes that a presentation on the security flaws of a popular transaction system is intimidating...just dangerous to a certain corporation.

Buzzcards

[X_Bones]

We use Buzzcards here at Georgia Tech. It's been the experience of me and most people I know that the cards are only used for laundry, dining hall meals, and admission to athletic events and facilities. This is the first I've heard of any flaws in the reader system, but to be honest I don't think it affects people too much. There doesn't seem to be many places for students to put money on a Buzzcard, and when someone does, it's usually just enough to do wash their clothes this week and maybe get some snacks from the food court. I just don't see it as being a big issue.

That being said, I don't think that threatening these folks with the DMCA and acting like the situation doesn't exist is the best possible way to make things safer. Hopefully situations like this can help get part or all of that legislation thrown out.

Re:I know a little about this...

[JahToasted]

The sentence "swiping really fast after the transaction" is a violation of the DMCA. Seriously.

Lawyer's info

[Anonymous Coward]

Here is the info on the lawyer that wrote the letter: Gregory S. Smith Counsel, Washington Office 202.383.0454 [e-mail] Bio at this page [sablaw.com] And Blackboard corporate communications: Michael Stanton Senior Director, Corporate Communications Blackboard Inc. Ph: 202.463.4860 x305 FAX: [phone]

using DMCA to hide problem: easier than fixing it

[jdunlevy]

Reminds me of an episode in "Surely You're Joking, Mr. Feynman!": Adventures of a Curious Character. Richard Feynman pointed out problems with security of file cabinets containing secret documents at Los Alamos. The "solution" to the problem? Easy! Keep Feynman away from the cabinets!

Re:Could someone please not be a wuss about this?

[EricWright]

Really? How do you know a user's intent? It's been established time and time again that you DO NOT need to decrypt the content of a DVD to copy it. What is inherently illegal about a software DVD player that isn't part of the DVDCCA cabal?

google cache of Acidus' yanked pages

[emcron]

The main page:
http://216.239.37.100/search?q=cache:aCrSrlgFxsYC: www.yak.net/acidus/campuswide/&hl=en&ie=UT F-8 [216.239.37.100]

Text document covering network infrastructure, database, servers, etc. for blackboard system:
http://216.239.39.100/search?q=cache:fM1kWpR_dbQC: www.yak.net/acidus/campuswide/campuswide.txt&hl=en &ie=UTF-8 [216.239.39.100]

These are the old cached ATT webpages, full of Technical details Blackboard wished weren't floating around:
http://216.239.37.100/search?q=cache:www.yak.net/a cidus/campuswide/oldatt/index.html [216.239.37.100]

Acidus' card system FAQ:
http://216.239.37.100/search?q=cache:www.yak.net/a cidus/campuswide/faq-campuswide.txt [216.239.37.100]

Creative use of cut and paste within the google cache should let you hit any of the other links within those pages that you may be interested in.

Restraining Order

[bellings]

I must be missing something. Has a lawyer sent them a cease and desist letter? Or has a restraining order been granted against them by a court?

Because, all the links point to a cease and desist letter, which are as cheap as lawsuits in the United States. Any schmoe can send a cease and desist letter. Hell, I could send CmdrTaco a letter claming that the space aliens he keeps in his laundry hamper are interfering with the workings of my tin-foil reflector beanie. You certainly don't have to do what the cease and desist letter tells you to do, any more than I have to follow instructions from the little voices in my head. Sometimes the little voices in my head give me good practical advice, like "change your socks." But you would be a fool to follow the advice of either the voices in my head or a random lawyer's cease and desist letter without question.

But, I understand a restraining order as an entirely different thing. A restraining is handed out by a court, and unless you're fond of the inside of jail cells you would be well advised to follow it to the letter.

So, did these people actually get a restraining order against them? Or is this just another badly misleading slashdot article?

Already a zillion exceptions

[A nonymous Coward]

You can't lie under oath.

You can be sued for libel and slander.

Lying in a contract is a no-no.

Making false claims in ads is frowned upon.

Yelling FIRE in a theater is not in the cards.

The Secret Service will come after you if you make threats against givernment officials.

What part about make no law don't you understand?

Re:Hey!

[Anonymous Coward]

At my university (we don't use the Blackboard system), people figured out that if you swipe your card, unplug the machine's network cord, buy your drink, and plug the cord back in, you wouldn't get charged. There was even an article in the school paper where a university official warned students that the machines keep track of failed purchases, and they will be caught if they do this repeatedly. A few of the machines had cages around the back to prevent this, but on most of them you can easily access the network cord. I don't know if the machines are connected to the campus internet, but with a machine on every residence floor it would be easy to install a hub, run some cable to your room, and sniff traffic.

You could also get free food, drinks, and laundry if you used the machines when the card system was offline (this happened at the same time every week, I'm assuming the database was down for maintenance or something). You couldn't always get free food (although I once saw people completely clear out a set of vending machines), but when your food purchases failed, it was generally a good time to do free laundry (laundry purchases never failed, even if the system was down - I guess they didn't want people to be unable to dry their wet clothing). It's best to do this when you have no money on your card, then there's no risk of being charged later.

Building security was (and is still) pretty weak. Access is controlled by cards at night (different cards from the vending machines), and I don't know of any way to circumvent this system. But generally, there was at least one door on each building that was never locked (sometimes the doors were locked, but pushing the button for the automatic door opener would open them). Many of the buildings were linked, so one unlocked building could give you access to several locked buildings. IIRC, there are only 3 or 4 buildings locked securely at night.

Re:Duh...

[ngrier]

Actually, IIRC, the article doesn't quite state the facts clearly. The supreme court was split in that it supported one case and returned the other to the lower court. It ruled that the two men who got drunk and burned a cross on their [black] neighbor's lawn did so for the purposes of intimidation and that this was not a protected form a speech. (see for example their recent ruling on the illegality of the anti-abortion websites posting "wanted" ads of abortion doctors.).

They did, however, uphold the right of the KKK to burn the large 30' cross as a form of protected speech (i.e. political, without an immediate threat of harm or intimidation). It was for this reason that Thomas dissented - his comments indicated that the history of cross-burning is such that there is never a time when cross-burning is not meant to intimidate.

So to return to the question at hand, the Supreme Court has clearly, multiple times, made a distinction between types of speech and that some are protected and others aren't. Regardless of the first amendment, you can't make threats on the life of the president (no matter how much of a ditz he is). Similarly, you can't give away state secrets. No matter how inane or ludicrous the DMCA is, there is a long precedent for restricting certain types of speech. (So the question of its constitutionality is not one that is easily answered.)

Re:I say publish all the details overseas

[Anonymous Coward]

Well, the guy (one Serge Humpich) certainly got a lot of media coverage. Some people say he rubbed people the wrong way in approaching the involved companies, other that the aforementioned companies just set him up to silence him more easily. At any rate, that was a dumb move, since the details ended up as (semi-)public knowledge. Besides, all the guy was interested in was actually working with them to _fix_ the problem.

IIRC, the idea was to make a card with a chip that would always approve the current transaction. Meaning that you could use the false card in older vending machines and the like. You couldn't get cash with it, though.

Blackboard Follies

[theoddball]

I go to a school in the northeast that relies heavily on Blackboard. (I also work computing support here, so I know what a pain it is on the backend, but I digress.)

Oddly enough...I had a discussion about this with a CS prof a while back. Turns out he and another tenured prof figured out how to make all the vending machines (which are on the card) spit out free stuff by using a card with purposely malformed data.

This worked so well that the machines would dispense free stuff until somebody came along and unplugged/restarted them...

But anyway, if Blackboard wants to, two highly respected, published CS profs could be prosecuted under the DMCA.

Another problem popped up a couple years ago that never became common knowledge: if your account balance was between 0 and $0.05, you could buy as much as you wanted, and your balance would never change. I'm not sure if that was a Blackboard bug or something else we did here.

Another one of those through-the-grapevine stories that I suspect is true--the host "machines", whatever they are, for the locks operated by these cards communicate via TCP/IP with a central server. Last year a CS student figured this out and started sending a variety of packets at one of the hosts, crashed it, and summarily locked 200 students out of their dorm.

Ah, Blackboard, how I love thee.

And I've just committed multiple crimes under the DMCA, I believe...

It's pretty much the same system used in arcades

[jdeitch]

Most of the card reader systems used in arcades (a-la Dave/Busters, Gattitown, et al) use a RS-485 network as well.

When these units need to be repaired, they are plugged into a "dumb server". This server basically takes ANY card input, and sends back an "OK" to the reader to allow it to start up a game.

The only critical knowledge needed is the location/site ID code the reader is setup for, and (obviously) the format that particular manufacturer/provider uses for their network.

I can't imagine it would be difficult at all to do the same thing for a coke machine, or any other device, on a CampusWide Network.

- litz

Contact the Lawyer.

[mikedaisey]

here's the contact info for the lawyer who sent the cease and desist letter.

http://www.sablaw.com/profiles/bio.asp?ID=000032 25 1170

eyewitness

[Anonymous Coward]

I wish I didn't have to post this as an AC, but I have reasons (mainly legal).

Acidus has been telling Blackboard about the flaws in their products for at least 18 months.

I saw Acidus' talk at both Interz0ne I and PhreakNIC6, plus the 2600 article has been out for a while too. Blackboard has known that people were discussing these flaws for quite some time and chose to ignore it.

At Interz0ne II, a cease and desist email was received by the con chair on Friday night, and two FedEx packages arrived at the con hotel Saturday morning. Inside were paper copies of the email, plus restraining orders, unsigned by a judge. A courier arrived Saturday afternoon with signed restraining orders; I was in the lobby and personally witnessed this, saw the paperwork, etc. I couldn't read the Judge's signature before the organizers left with the papers, but I did see "DeKalb County" on the restraining orders, so I assume that's where they came from (the con was in DeKalb County as well).

Acidus and Virgil were not sure of their legal status. Neither were the con organizers. Try finding a lawyer or getting in touch with someone from the EFF, ACLU, etc, at 4pm on a Saturday; their talk was scheduled at 7pm. If I was an evil bastard lawyer, I would have timed it that way too. Organizers, have a good-guy lawyer or three onhand at all times during future cons, ok?

They erred on the side of caution, which probably kept them all from actually getting arrested (as one of the con organizers pointed out, someone reporting to Blackboard or the law firm had to have been attending the con, otherwise they wouldn't know if the cease and desist and restraining orders had been observed).

Keep checking the Interz0ne website for updates, and there will hopefully be further talks at DefCon, Dragoncon and PhreakNIC7 this year.

I am not Virgil, Acidus or any of the con organizers (Rockit, JohnnyX, Iridium, etc).

Re:I say publish all the details overseas

[hondo_san]

The story of Serge is here [bbc.co.uk]