Teen Researcher Exposes Massive Flaws in Student Data Systems
An 18-year-old security researcher uncovers severe vulnerabilities in popular school software, potentially exposing the data of over five million students and teachers.
Eighteen-year-old security researcher Bill Demirkapi reveals severe vulnerabilities in major educational software platforms, showing that student data remains largely unprotected. During his time in high school, he discovers critical security flaws in Blackboard's Community Engagement platform and Follett's Aspen student information system, which centralizes sensitive student records like grades, health data, and attendance.
Among the most damaging issues is an improper access control vulnerability in Follett's system that allows attackers to read and write to the central database. Additionally, a debugging misconfiguration in Blackboard exposes database credentials for numerous school districts and provisioning accounts, while SQL injection flaws in six databases trick the systems into handing over private student information.
These vulnerabilities impact more than 5,000 schools and over five million students and teachers. Demirkapi presents his findings at the Def Con security conference, emphasizing that student data deserves the same strict protection as medical records and calling for better defenses for those who cannot protect themselves.