Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canvas online again as ShinyHunters threatens to leak schools’ data

theverge.com

Post reply on HN
Print view View original

201–210 of 690 posts

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#201

Post by gchallen »

Gabriel54 wrote: post #190

I'm surprised how few comments there are on this thread. This is probably affecting millions of students at the most stressful time of the year. Incidentally I've always hated Canvas and probably every other LMS provider, but what is particularly amusing about this current outage is that it is occurring at exactly the time when universities are demanding that all professors put all of their materials on Canvas, witho…

They have not succeeded in forcing me, yet. But it's sad how many computing faculty apparently can't operate the basic online infrastructure needed to support their courses. Not that universities make it easy for us.

And of course the other serious concern I have with Canvas is that they are likely using all the materials faculty upload to train their AI replacements. Many of my colleagues engage in dark humor about this but I haven't noticed much action.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#202

Post by JumpCrisscross »

blahedo wrote: post #176

Perspective from the trenches: I teach at a university that uses Canvas. We are in our final exams period right now. We got our first email (from Academic Affairs) notifying us that it was down at 5:17pm EDT this afternoon, with little info; followup emails were sent at 6:24 and 6:57 with more info, but mostly about how we would be compensating for it and not about what actually was going on (other than, "nationwide…

> the students themselves don't have the artifacts to resubmit via email because they were done in Canvas

It’s so simple to send an e-mail to the student with relevant records on completion of a quiz or whatnot. They don’t do it, because they want to control the data. (And universities don’t insist on it for who knows what reason.)

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#203

Post by somebudyelse »

thecatapps wrote: post #38

I remember when I was in high school (2016? 2017?), I found a super simple XSS in the assignment submission form and told the programming teacher. Canvas then proceeded to lock my account and got me my first (only?) detention. Good times.

Somewhat similar vein, the school's blocking software would block YouTube and embeds unless they came from Canvas. They were smart enough to disable the HTML editor for posting discussion comments, but forgot that since it was a rich text editor, you could just copy-paste in an embed by putting the code in data:text/html, then copying the element as formatted html.

I also ran the entire DOMPurify sample XSS and managed to find one way to download custom content onto someone's computer.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#204

Post by jameshart »

hsbauauvhabzb wrote: post #124
phainopepla2 wrote: post #112

Earlier quoted context omitted.

How could you possibly make it illegal to host insecure services? Is any service 100% secure? And if it were how would we know? I do agree with the audit and punishments for clear failure to adhere to established standards.

No building has a 100% chance of not caving in, yet somehow I think charges would be laid if a skyscraper caved in.

This analogy seems to be portraying 'ransomware hackers' as an unstoppable force of nature akin to gravity.

I'm not sure that's a fair analogy.

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#205

Post by MagicMoonlight »

bawolff wrote: post #128
phainopepla2 wrote: post #112

Earlier quoted context omitted.

How could you possibly make it illegal to host insecure services? Is any service 100% secure? And if it were how would we know? I do agree with the audit and punishments for clear failure to adhere to established standards.

This is a solved problem in pretty much every other domain of life - if you are following best practises but something that wasn't reasonably forseeable happens, then you're fine, but if the bad thing happens as a result of negligence then you are in trouble.

In civil law maybe, but you aren’t allowed to blame a rape victim for choosing to walk down rape alley…

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#207

Post by Gabriel54 »

dang wrote: post #191
Gabriel54 wrote: post #190

I'm surprised how few comments there are on this thread. This is probably affecting millions of students at the most stressful time of the year. Incidentally I've always hated Canvas and probably every other LMS provider, but what is particularly amusing about this current outage is that it is occurring at exactly the time when universities are demanding that all professors put all of their materials on Canvas, witho…

(Comments were split across multiple threads and we've since merged them.)

Definitely not a criticism of your (hard) work here. Thank you!

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#209

Post by altairprime »

Gabriel54 wrote: post #190

I'm surprised how few comments there are on this thread. This is probably affecting millions of students at the most stressful time of the year. Incidentally I've always hated Canvas and probably every other LMS provider, but what is particularly amusing about this current outage is that it is occurring at exactly the time when universities are demanding that all professors put all of their materials on Canvas, witho…

Not much overlap between students and HN these days, though? I’m an extremely rare outlier afaik :)

The administration has so far opened with one “Canvas said” and then an hour later one “Canvas is down indefinitely” email noting that they’re aware it’s serious.

(Canvas is a glorified wiki for teaching students, with quizzes and such, for those unaware.)

Re: Canvas online again as ShinyHunters threatens to leak schools’ data

#210

Post by rcoveson »

parliament32 wrote: post #106
myrandomcomment wrote: post #89

1. It should be illegal for any company to pay ransomware attacks. Period. No pay out ever. 2. The penalty for being the attacker should be linked to the system they violated. If you do this to a hospital and someone dies you are life in prison / chair. The minimum sentence should be so painful that it deters the attack. No this will not stop this and companies need to be held accountable for their lack of security i…

> It should be illegal It should be illegal to host insecure services, especially when you're dealing with PII. Breaches keep happening and nobody gives a fuck, because the worst that'll happen is you might lose a handful of customers and buy some "credit monitoring". Incidents like this should be followed by an audit and charges being laid. Send corp officers to jail for negligent security failures. If you can go to…

I don't think that criminal negligence is the most helpful legal tool for incentivizing improved security. It's too hard to prove negligence.

Instead, there should be standard civil penalties for leaking various degrees of PII paid as restitution to the affected individual. Importantly, this must be applied REGARDLESS of "certification" or whether any security practices were "incorrect" or "insufficient". Even if there's a zero-day exploit and you did everything right, you pay. That's the cost of storing people's secrets.

This would make operating services whose whole "thing" is storing a bunch of information about individuals (like Canvas) much more expensive. Good! It's far to cheap to stockpile a ticking time bomb of private info and then walk away paying no damages just because you complied with some out-of-date list of rules or got the stamp of approval from a certification org that's incentivized to give out stamps of approval.

Post reply on HN