Monday, July 11, 2005

Change a grade, go to jail 

Here's a story of a student who went online to change her grades along with several other students last March. She's been sentenced in a plea bargain to six months jail time.
The university�s grading system, eGrades, is an in-house program that professors can access via the Internet to submit and alter students� grades. eGrades uses UCSB NetID, a campuswide authentication system, to check a user�s identity. If a user forgets their password, they can reset it by entering their Social Security number and date of birth...

... Ramirez (Nancy, the student --kb) worked for the Goleta branch of Allstate Insurance, where she had access to the personal information of two UCSB professors who were insured with the company. Ramirez reset their passwords using private information she obtained from her job,

...Ramirez, who could not be reached for comment after repeated phone calls Tuesday evening, changed her grade in one class from a B to an A, Signa said. She also altered the grades of her roommate from an F to a B+ in one class and from a B to an A+ in another class, ...
You know, this could happen to someone who is asked for ID to cash a check at a local store, even. I wonder whether this automatic reset of passwords is common on campus grading systems. Many systems, including MnSCU's, uses birthday/SSN data for default passwords.