Hacker News Reader

Also the incentives of the university staff are not at all aligned with "the truth". If they spend a hundred hours investigating it and find that they really did falsely accuse her and cause her harm, it advances their careers no more than rubber-stamping her expulsion

"MAC addresses can be changed – nearly all ethernet controllers and some wireless chipsets support changing the MAC address"

Just to be clear.

Windows 10, MacOS and Ubuntu, all allow one to set/override their MAC address usually via a dialogue box.

I don't recall ever using a DSL/Cable modem that did not support setting/overriding the MAC address.

Cable modems actually never allow you to change the MAC address. You're thinking of consumer routers which commonly allowed cloning a MAC because old internet services would hardcode a single MAC address per account in order to prevent customers from just grabbing 10 public IP addresses each.

Just about every single DOCSIS network still in existence uses BPI+ to encrypt the traffic to each customer to make sure that you can't just sniff traffic for the entire neighborhood and steal service. BPI+ has a certificate that is minted and signed at the factory with the device's MAC address in it. If you tried to change the MAC address, even if you had root, you wouldn't have a valid certificate so the modem would never get a connection.

Yes, of course you are correct. I did mean consumer routers.

Cellphones. Mine certainly doesn't allow me to alter my mac.

FWIW, that says more about your relationship with "your" cell phone than its own capabilities.

Protocol wise, a MAC address is fundamentally the choice of the client. And for cloning, they aren't even obscure but printed right on every device.

That this has to be continually re-explained to lawyers unfamiliar with technology, because they see some identifier and immediately assert it's immutable until rebutted, is getting to the root of the real problem here. An ethernet MAC is at best, circumstantial - acceptable for tracking down a lead, but means jack-squat when it comes to proof.

Furthermore, the fact that we're still going over this in a technology forum demonstrates the probable lack of competent diligence done by the school's IT department before presenting their "expert" opinion.

You must not be using android, because my android allows it without rooting

Some manufacturers and/or carriers require the phone to have developer options enabled (aka developer mode) for the MAC address to be changed, for example...most Verizon phones.

It does if you try a little bit. But, you said truly, not if you don't.

Your MAC address doesn’t leave your local network, so I am not sure how that can be used to track anyone?

"said to be traced from either her computer — based off a unique identifier, known as a MAC address — and the network she allegedly used, either the campus’s wireless network or her off-campus residence. When her grades went up, sometimes other students’ grades went down, the school said."

I'm guessing that the evidence they've got is that the IT dept have the MAC address that was used by the devices that connected to their network, and have associated MAC addresses with the IP addresses allocated. Then that IP was used to connect to their internal system to change grades.

It's pretty flimsy evidence, as anybody who had received a packet from her machine on the same network (i.e. if she ever connected to the university, which she allegedly did) would know the MAC address. So when I say it's public knowledge, I suppose I should've said it's public knowledge given you can connect to the same network. It really wouldn't be that hard to frame someone that way, and things like iTunes library sharing really help – because they conveniently tell you whose library is being shared.

It's quite possible that somebody who knew who she was and who knew her MAC address could have done this. That could have been somebody sat in the same class. It's also entirely possible that she had the technical skills to pull of the technical side of the hack (bypassing 2fa) and didn't know a thing about networking.

It also sounds like they have figured out the IP address that she has used to connect to her own university intranet account and found that it matched the IP that accessed the hijacked account. That's again pretty inconclusive.

I came here to comment that too. It didn’t sound like she was on a campus network from the article, so there is literally no way the university would know what MAC address was used.

that letter was hard to read. it was from someone who had already made up their mind and put up a reflector. her response made me think of someone playing play investigator and reminded me of michael bluth and maritime law in arrested development.

> Anybody suitably competent to pull off the technical side of the attack is likely to be able to spoof MAC addresses.

From reading the article, the technical side of the attacks seems to be illegitimately using an administrators password. There are no details of how the hacker obtained the password, perhaps they just glanced over the shoulder of the library staff member as they entered it?

The more important part of the letter regarding the photos is the fact that they weren't produced until after the student was given the exact time periods of the incidents.

Obviously there would of been no point in producing random photos until they counted for an alibi.

That's true. But nevertheless it's still low quality evidence of her innocence.

They could have said, ok, send us photos from this wide date range and then we will look to see.

Even so, if she knew when she hacked the accounts she could create edited photos without them telling her when she hacked them (assuming she recalled when she did it)

Not necessarily, if she enlisted someone else to do it.

The possibility would be there though, forcing anybody considering the evidence to consider the possibility that she was the culprit and, as the culprit, was capable of fabricating evidence of her innocence.

The standard of proof in cases like these isn't "beyond a reasonable doubt".

I'm well aware, not sure why you think I'm not.

If she were guilty of hiring somebody to do the hacking but not actually doing it herself, then she might not know when the sensitive times were and would therefore be unable to fabricate evidence covering the sensitive times. That's what you pointed out, however it's not particularly relevant. The possibility that she was the technically competent hacker who was capable of fabricating EXIF data is a strong enough possibility for the university to meet their low standard of proof, and consequently determine she's guilty.

The letter sounded as if it was part of a written conversation between two spouses fighting over when/what/where.

Far too emotional and completely out of place for a Dean writing an official letter.

Surely it would have been more suspicious if she had offered alibis without having been told when the incidents happened?

Sure, it would. She could have turned over all reasonable photos between a range of dates, though.

Is she supposed to just give every photo of herself to the school?

She obviously doesn't have to, but the manner in which she turns over photos certainly impacts their credibility as evidence.