Thinking Beyond the Box

“It was pretty cheap,” Oberheide wrote in an instant message.

The costs of starting an Internet-based business have decreased dramatically as hardware and software costs fall, because technological advancement has made professional-grade equipment less expensive. Internet-based businesses usually require no more space than a website, generally contracted to data management companies and web hosts such as Oberheide’s own FocalHost, as well as a website design. The cost of website design varies depending on both the design skills of the student as well as the cost of freelance designers. In an experiment, a posting to the Ann Arbor version of the Craigslist.org classifieds site requesting a simple website design returned four replies from a group of web designers varying in skill, cost and geographic location in less than 24 hours, with professional-looking results for less than $250.

Because of this, technologically oriented students like Oberheide have abundant access to the basic tools to start their own companies. For those less inclined to start and maintain their own corporate operations, the Internet also offers students the capability to interact with communities worldwide from their homes, allowing student programmers to join Web-based, open-source projects such as those listed on SourceForge, www.sourceforge.net, or connect with professionals for freelancing and full-time positions in any industry with job sites such as Monster.com and Craigslist.org, which list contractual positions as well as permanent careers.

The Internet’s adaptability and nature as an outlet for creative expression has the potential to place academic institutions such as the University’s College of Engineering in a position unlike it has previously seen. Students now have a large range of options, both paid and unpaid, to explore before doing traditional undergraduate research. Although glorified startup success stories such as that of Harvard grad Mark Zuckerberg’s Facebook.com social networking software dominate the talk of the technology sphere, not all student entrepreneurs leave academia to pursue more profitable corporate interests.

Oberheide, for example, plans to return next fall for graduate school.

“I find the academic research more personally rewarding,” Oberheide said.

He has not neglected the University’s own opportunities. On May 16, 2004, Oberheide found a vulnerability in Wolverine Access, the site students use for most University administrative duties, such as tuition and scheduling. The vulnerability allowed any Wolverine Access user the ability to view the social security numbers of any University affiliate in the database.

The hole was promptly closed by University IT personnel. After IT resolved the problem, Oberheide was called by various University divisions, such as Michigan Administrative Information Services, which runs Wolverine Access. Shortly after, Oberheide received a call from a detective in the Ann Arbor Police Department.

“The University doesn’t enjoy my activities too much,” Oberheide said.

Shortly after the discovery of the Wolverine Access bug, Oberheide began working at the Housing Information Technology Office, which maintains networks for the residence halls. Oberheide said MAIS contacted HITO, and told them that Oberheide was a “threat to (HITO’s) security,” a fact that Oberheide learned in one of his last days working at HITO. “They had taken like two months to reply after my interview, and at the time they had said that they had forgotten about me; they told me later (that) they were debating whether to hire me or not,” he explained.

Contrary to MAIS’s belief, Oberheide certainly wasn’t a threat to security – his intentions in finding the Wolverine Access flaw were good. In fact, Oberheide is responsible for the new MCard requirement. While still at HITO in the spring of 2005, in a “super geeky” decision, Oberheide purchased a magnetic card reader and discovered a vulnerability in the MCard system that allowed him to write copies of anyone’s MCard for his own use.

“I went and asked people for their full (MCard) account numbers so that I could try to determine what they stood for,” Oberheide said. He discovered that most card readers only read a small stripe of data on each MCard which linked directly to the student’s UMID. By writing his own magnetic stripe, he could emulate any student, faculty or staff member with a UMID, allowing him to access buildings and purchase meals with their identity.

“Since it was on a white-plastic, shady-looking card, I only used the vending machine,” Oberheide said when asked how he exploited his newly-discovered vulnerability. “I had a lot of Snickers bars that week.”

After his MCard adventures, Oberheide left HITO for a research and development position at Ann Arbor-based Merit Network, a nonprofit organization that maintains Internet connectivity for public educational institutions in the state of Michigan, including the University. “Merit was a much better opportunity,” Oberheide said. At Merit, Oberheide’s work is “all academic,” with all of Merit’s projects benefitting not only the University, but other Michigan learning institutions such as Michigan State University, Central Michigan University and smaller schools like K-12 public schools. Oberheide’s work at Merit is currently in use at the main University network operations center, as well as in network hubs at other educational organizations.

Other students are less drawn to academia’s atmosphere. Engineering senior Vikas Reddy left his undergraduate research last year to work on IBM’s WebSphere product line, an expansive set of corporate software used to manage e-commerce websites across diverse networks.

“I did research with Professor Martha Pollack for a year on the Autominder project,” Vikas said, referring to a University research project designed to help elderly people remember common tasks. Rather than stay in Ann Arbor for the summer, Reddy headed to IBM’s San Francisco office. When Vikas returned from IBM’s San Francisco offices for the fall 2005 semester, he worked over the Internet, via a process known as “telecommuting” on the WebSphere project. When asked what work he felt was more rewarding, Vikas felt that his work for IBM was less rewarding but the opportunity to live in San Francisco put it over the top. Reddy also felt that his work at IBM was better to have on his own resum