Puzzle

A student suspects there is a vulnerability on a system where student grades are stored. She tests this by trying to exploit the vulnerability from the network (because she is not authorized to use the machine and does not have an account on it). She succeeds, becoming \user{root}, and reports both the hole and her exploiting it to the system staff, who in turn report it to the chairperson of the department. She is promptly hauled before the Committee on Behavior of Students on the charge of breaking into a computer system.

1. Did the student act ethically by testing the system for the security hole before reporting it?
2. Did the chairperson act ethically by filing charges against the student?
3. The system staff did not fix the hole, because the action taken by the CBS would deter any future break-ins through that hole. What do you think of this?

Matt Bishop Office: 2209 Watershed Sciences Phone: +1 (530) 752-8060 Email: mabishop@ucdavis.edu

ECS 153, Computer Security Version of April 1, 2018 at 1:42PM

You can also obtain a PDF version of this.