[ISN] School district investigating illegal grade changes

[InfoSec News]

Forwarded from: William Knowles <wk at c4i.org>

http://www.palmbeachpost.com/pbccentral/content/local_news/epaper/2006/03/22/s1a_SKGRADES_0322.html

By Nirvi Shah
Palm Beach Post Staff Writer
March 22, 2006

Someone used a school district employee's computer access to change
grades and possibly other confidential records that may have affected
students' college applications.

The Palm Beach County School District recently sent letters to
colleges and universities - they would not say how many - informing
them that some of the records they received could be wrong.

Since December, school police have been investigating one or more
instances in which someone altered grades without hacking into the
computer system, school district spokesman Nat Harrington said.  
Whoever did this got to the records using the identity of someone
authorized to access student records.

The school district has beefed up security to prevent breaches from
the outside, Harrington said. They repel attempts to break into the
network from the outside all the time. But it's harder to determine
when someone who is authorized to use the district's computer network
is doing something improper.

"The system is built on the basis that everyone has a certain level of
clearance," he said. "With a higher level password, you can go pretty
much anywhere in the system."

The computer intruder could have gotten the information by simply
looking over someone's shoulder, he said. "We don't have any
indication that the person is an employee," Harrington said.

School district employees are now stuck trying to figure out exactly
what was changed and fix the grades and other records so they are
accurate. Parents and students districtwide haven't been told that
student records may have been viewed, Harrington said.

"We'll cross that bridge when we get to the end of the investigation,"  
he said.

When the district's investigation is finished, those responsible face
serious consequences.

"Once we have more information, we intend to pursue criminal charges,"  
Harrington said.

Last year, an Inlet Grove High senior was arrested for allegedly
hacking into the district's system from home at least nine times,
although he wasn't accused of changing any records. In that case, a
school district technician noticed the network had been hacked after
former student Ryan Duncan uploaded several programs onto the network
in January 2004. It turned out later that those programs would have
allowed him to control computers throughout the district from his
home.

Since then, Duncan has made a video on the consequences of hacking
that has been shown at schools all over the district and on its TV
station, Adelphia Cable Channel 19.

Harrington refused to say which schools were involved in the latest
incident.

However, a parent at Dreyfoos School of the Arts said the school
recently created an integrity committee to prevent situations like
this in the future.


 
*==============================================================*
"Communications without intelligence is noise;  Intelligence
without communications is irrelevant." Gen Alfred. M. Gray, USMC
================================================================
C4I.org - Computer Security, & Intelligence - http://www.c4i.org
*==============================================================*