Revision as of 22:14, 14 April 2005 (view source) Techieb0y (talk \| contribs) No edit summary ← Older edit		Revision as of 22:31, 14 April 2005 (view source) Techieb0y (talk \| contribs) mNo edit summary Newer edit →
The ISO Login isSystem, aformerly Campus ~~page~~Password, at(see http://www.login.mtu.edu/ ~~that~~) gives you a cookie that allows websites all over MTU to authenticate you. This system generates an x509 certificate signed by MTU's [http://www.login.mtu.edu/downloads/public/mtuca.crt CA] certificate]. The certificate expires 8 hours after you login and contains only your username, not your password. Around the begining of the Spring 2005 semester [[User:Jon787\|Jon DeVree]] and [[User:Dark-Fx\|Brian McPherson]] found a flaw in the system that allowed any self-signed certificate to be authenticate by the system. This allowed them to generate cookies that expired in years instead of hours and even cookies that were for other users. They utilized this to create phony users like [[EERC_Tree]], and vanity userids for [[User:Dark-Fx\|Dark-Fx]] and [[User:xobes\|xobes]] on the [[Barkboard\|Barkboards]]. DCS fixed the flaw shortly after Jon and Brian reported it.

ISO login (view source)