Comment by cyberferret | Hacker News Reader

Comment by cyberferret | Hacker News Reader

Parent Full thread

My first year of computer science, I was bored in the labs one day working on a basic Pascal programming assignment. Back then, our university had a VAX mainframe system that everyone worked on (staff and students alike).

I logged off my account, and then just for the fun of it, decided to log back in using my course unit (INF180) as the username and password.

Lo and behold, It let me in. As the course administrator. I could see student records and past assignment gradings for everyone else on my course.

Looking at the folders, it seemed that future assignments etc. were also stored within that account. I didn't go any further. I simply logged out and stayed quiet (and uneasy) about the whole thing. I was too scared to report it in case I was thrown off the course for 'hacking' the system.

A few years later (after I had well completed my studies), I was helping a friend in the same labs with an assignment. I wondered if they still had the same flaw, so I found a spare workstation and tried the same trick, but it wouldn't let me in. Glad they fixed that loophole.

Why didn't you report it anonymously then?

Small town, small class, small faculty - makes it all hard to stay anonymous. Plus there wasn't any formal reporting method that I knew of at the time.

In hindsight, I probably wasn't the only one who might have cottoned on to this. It was purely due to lazy systems administrators. All students were given their student number as their login, and the default password was.... our student number. It was strongly suggested that we change our password after first login, but it was never forced upon us, so not many did change it.

On that lazy day, I simply wondered if the same password 'policy' was in place for our lecturers too, so I guessed that their login might be the unit code, and the password would be the same. In a class full of bright CS wannabes, I am sure a few of the others had the same thought.

No doubt they became aware of this at some stage and that is why it was (thankfully) changed.

decided to log back in using my course unit (INF180) as the username and password...I didn't go any further. I simply logged out and stayed quiet (and uneasy) about the whole thing. I was too scared to report it in case I was thrown off the course for 'hacking' the system.

Since when have this country's schools been run by idiots? Not you, but the people who would have let such an idiotic situation come about and on top of it, have created a climate where one would fear repercussions for reporting on it? Since when has this country become run by uncomprehending idiot authoritarians? When did this come about!? AFAIK, High schools and colleges weren't like this in the 80's.

For what it is worth, this was in a small town in Australia back in the early 80's... Simply a case of lazy admins (see my comment reply above). Probably even only down to one guy's slack work ethic.

I think the entire university's IT department at the time consisted of 4 guys running around trying to keep the mainframe running. There probably weren't any solid policies on password security.

Back in high school (private boarding school) it was one of the math teachers who was running the mainframe. (And teaching the programming class.) Security consisted of students trying to break into each other's accounts and leaving Easter Eggs in each other's BASIC games.

Speaking as someone who checked the security of quite a few colleges in the 90s, I can say that for the most part, almost no one then had any idea that security was even a thing. So if they really were somehow better in the 80s it didn't last long.

Security was pretty sucky in both of those decades, but I didn't think anyone would have to fear for pointing that out.

Back in college I did a few things that today, might have netted me a visit by the Net Cops [1], but since I knew the sysadmins of the systems in question, I never got into trouble. A friend of mine though, who wasn't friends with the sysamins, did get in mild trouble.

[1] Much like the Phone Cops [2], the Net Cops could have cut my career short.

[2] Those Boys From Bell. Also, https://www.youtube.com/watch?v=cTPzTG1Lx60

It all comes down to the campus culture. Our CS Dean at the time was an 'old school' cranky pants kind of guy, so I don't think he would have taken kindly to such a breach.

On the other hand, the new Dean of the computing faculty that took over the year after was a really cool guy, and he is someone I wouldn't have had any hesitation to go to and report such incidents.

Reply on news.ycombinator.com