Sydney Uni escapes censure over privacy breach

The NSW Privacy Office has let Sydney University off with a warning following its admission and swift action to plug a website that leaked student details in January.

The university student website had a web application hole known as an  insecure direct object reference in its system that exposed private details. It allowed anyone to gain access to a student's contact details, which courses they were enrolled and ther costs by entering a student ID number; no password was required.

But in his report, acting NSW Privacy Commissioner John McAteer found the university breached the Privacy Act by exposing data.

“The university had not taken reasonably available steps to avoid the risk that the leaks would eventuate,” McAteer said in the report.

 

He said the exposure was avoidable with “appropriate testing”.

But the office would not enforce penalties because the university quickly closed the flaw and investigated the incident.

“In light of the steps the university took to fix the problem and [ntroduce] security reviews and testing of the penetration potential of various information systems, the acting Privacy Commissioner considers that the university responded to being informed of this breach of security with urgency and effectiveness.”

Sydney University student data was previously exposed through a separate insecure direct object reference in 2007 but it failed to apply a patch to fix the hole in an update later that year.

Insecure direct object references ranks fourth in the OWASP Top 10 most critical web application flaws.