A security breach in Georgia has led to questions about the integrity of Ohio State’s BuckID software.
Blackboard Technology’s software is used at more than 400 universities in 16 countries, including OSU, to run student ID programs, according to Michael J. Stanton, a Blackboard employee.
The software allows students to use their ID cards to make purchases, check out library books and get into residence halls.
The security problem began when Billy Hoffman, a student a Georgia Tech, and Virgil Griffith, a student at the University of Alabama, broke into an ID terminal in a Georgia Tech laundry room attempting to prove that Blackboard’s software is not secure.
Hoffman and Griffith recorded the break-in on a video cassette and planned on showing the tape at a convention for the computer group Interz0ne on April 11-13, said Gregory S. Smith, one of Blackboard’s lawyers.
The tape was never shown because the students were served with a cease and desist letter by Blackboard’s lawyers, which meant the students had to stop all activities involving the break-in, including presenting the tape at the convention.
“The threatened actions, if true, would allow and encourage an unknown number of unauthorized parties to access Blackboard’s systems,” Smith said.
Griffith and Hoffman are no longer allowed to talk about their findings because Blackboard served them with a restraining order.
“I can’t talk about anything that is on the Web site, which I had to delete because of the court order,” Hoffman said, “Everything we found was on my site. That would have answered everyone’s questions.”
While Hoffman and Griffith claim to have gained access to the Blackboard system, there is no proof they actually did.
“According to the dean of students’ office, we are not aware that any students’ IDs have been accessed,” said Amelia Gambino, associate director of Institute Communications & public affairs director at Georgia Tech.
OSU students have no reason to be alarmed, said Jon Gear, director of BuckID Card Services.
“The security and privacy of student records is a primary concern of the BuckID system,” Gear said. “We have designed the system to protect student’s money and their personal information.
“We are aware of the issues raised by the students at Georgia Tech and Alabama and we do not feel that they present a problem for our system,” he said. “This particular discovery is not a cause for alarm, but we remain confident in the integrity of the Blackboard Transaction System.”
