How we hacked more than 10,000 user accounts at the University of Amsterdam

I seem to have missed this one a few weeks ago, but this post on Auke Zwaan is definitely worth noting:

Last year, Bram ter Borch (a fellow student of the Master System and Network Engineering at the University of Amsterdam) and I did a security review of the Blackboard implementation at the University of Amsterdam. In a couple of days time in total, we managed to find several vulnerabilities in the system, which eventually led us to take over more than 10,000 live user accounts. In this blogpost, I will try to shed a light on how we did this and what the impact was/is.

The official paper, as presented to the board of the UvA and as handed in for our study, can be found at here.

Before we begin, I want to make clear that ethics played a big role during the entire review, for which we had full cooperation and written consent of the people responsible at the university.