CySecurity News – Latest Information Security and Hacking Incidents
When Erik Johnson couldn’t make his university’s mobile student ID app work properly, he found a different way to get the job done. The app seems to be important, as it lets students in the university paying meals, get into events, and lock/unlock dormitory rooms, labs, and other facilities across campus. The app is known as getting Mobile, made by CBORD, it is a tech company that assists hospitals and universities by bringing access control and payment systems.
However, Johnson, and other students who gave the app “1 star” due to poor performance, said that it was very slow in terms of loading time. It can be improvised. After studying the app’s network data while unlocking his dorm room door, Johnson realized a way to mirror the network request and unlock doors via a one-tap shortcut button on the iPhone. To make it work, the shortcut needs to send an accurate location with the door unlock request, or the doors won’t open. For security purposes, students have to be in certain proximity for unlocking doors via the app.
It is done to avoid accidental door openings on the campus. To make it even better, Johnson decided to take his talents elsewhere too. CBORD has a list of API commands that can be used via student credentials. (API allows two things to interact, in our case, it’s a mobile app and university servers that store data). Johnson identified a problem, here the API wasn’t checking in case of valid student credentials. It meant that anyone could interact with the API and take control of other students’ accounts, without having the need for passwords.
How a Simple Vulnerabilty Turned Out to be University Campus ‘Master Key’