One of the most widely used tools for Schools monitoring kids and restricting pupils’ internet use in UK schools has a serious security flaw which could leave hundreds of thousands of children’s personal information exposed to hackers, a researcher has warned.
Impero Education Pro, a product that restricts and monitors’ students’ website use and searches, is used in 27% of UK secondary schools, according to the company. In a controversial pilot programme, a version of the software looks for extremism-related searches such as “jihadi bride”.
But last month the security researcher Zammis Clark posted extensive details of a flaw in the company’s encryption protocols which could allow almost anyone to gain full access to computers running the Impero software, run software such as spyware on the systems, or access files and records stored on them.
The company said it had released a temporary security patch and was working on a permanent upgrade.
Clark said the flaw he found would leave affected schools’ networks “completely pwned”, online slang meaning in this context that the networks’ security would be fully compromised and information on it would be rendered vulnerable.
He said he had posted it publicly, rather than privately disclosing it to the company, for several reasons. “One was that I was against the ‘anti-extremism’ stuff, the other was because not being a customer, I didn’t know where to send it.”
Schools using Impero’s software said the company had notified them of the security flaw in the middle of last month but they were offered few details of its potential scale.
One school IT manager said the response from Impero was vague and required managers to contact the firm for more information. “Impero are crap at communication,” he said.
Three schools and chains using the software that were approached by the Guardian said the company had been slow to deliver promised software patches. Impero also offered fixes to schools that were using the software without contractual support, but left it up to those schools to make contact.
One school said the most recent update on the situation from Impero arrived by email on Monday.
The company is known on school tech forums for its pushy sales techniques, but the software remains popular because of the lack of quality alternatives.
Impero stressed that no data had been compromised, it had already issued a temporary fix for the vulnerability and it would install a full solution before the start of the next academic year.
“On 13 June 2015, we were made aware that someone had maliciously and illegally hacked our product, subsequently making this hack public rather than bringing it to our attention privately and in confidence. No customers have been affected by this and no data has been leaked or compromised,” it said.
“We immediately released a hot fix, as a short-term measure, to address the issue and since then we have been working closely with our customers and penetration testers to develop a solid long-term solution. All schools will have the new version, including the long-term fix, installed in time for the new school term.”
The company said “the methods used to identify and communicate this particular issue were not legal” and they would take a “firm stance”.
“Impero Education Pro is designed to protect and safeguard children in schools and any attempt to jeopardise this by illegally obtaining and publicising sensitive information will be dealt with appropriately,”it said.
On Monday, a month after Clark first disclosed the software vulnerability, lawyers acting for Impero demanded in a letter that he should remove all of his online postings about the company, under the threat of civil proceedings for breach of confidence and copyright infringement and criminal proceedings under the computer misuse act. The letter admits the potential seriousness of the vulnerability Clark disclosed in schools’ systems.
“By publicising the encryption key on the internet and on social media and other confidential information, you have enabled anyone to breach the security of our client’s software program and write destructive files to disrupt numerous software systems throughout the UK,” it said.
Impero said the hack “could only be exploited if basic network security does not exist” and would require the hacker to be physically present in a school.
Publicly disclosing details of security vulnerabilities is a controversial practice in the online security world. Some believe private disclosure is better initially, as it gives companies time to fix flaws before they are made public, but it rarely results in legal action.
Mustafa al-Bassam, a security engineer and former member of the hacking collective Lulzsec, said the legal threat against Clark was bizarre, especially when such exploits can be used or sold for profit, rather than posted online to be fixed.
“Responding with a legal threat to a security researcher that highlighted a serious security flaw in your software is bizarre and shows utter disregard for customers,” he said.
“Unfortunately it shows a theme that is too common in the software industry: companies view security as an external PR issue because it often affects their customers more than it affects them. And they should be grateful that this security flaw was disclosed publicly instead of being sold to malware developers like Hacking Team.”
Impero’s Education Pro software serves a variety of roles in schools’ systems, including blocking inappropriate web surfing – such as adult sites – and monitoring students’ activity, as well as rationing printing and making IT administration simpler.
However, last month – just days before Clark discovered the flaw – the Guardian reported Impero was offering a new feature to monitor keywords potentially tied to terrorism or extremism before the implementation of new counter-terrorism legislation introducing a requirement on schools to monitor pupils for such signs.
The pilot, introduced in 16 UK schools and five in the US, monitors for phrases such as “YODO” – You Only Die Once – “War on Islam”, and “Storm Front”, a neo-Nazi group.
The Department for Education said: “We have been clear that schools are expected to ensure that sensitive pupil information is held securely. The Data Protection Act of 1998 is clear what standards schools are expected to adhere to and we provide guidance on this.”
sources:
https://TheGuardian.com
https://pdf.yt/d/fRcZ1TWHaDkwz-Ea
