Hacker News Reader

Comment by tomatohs | Hacker News Reader

When I was a junior, I mentioned to my housemate that I had forgot my Blackboard password. "It's just your birthday" he said, and I looked at him shocked.

30 Minutes later I was in my professor's account. Their birthday month and day were public on Facebook, so it was only a matter of guessing their age.

I reported this to our IT department and they were not pleased. They let me know they had the power to expel me but wouldn't.

A week later, I found another exploit. I think blackboard group chat allowed JS execution outright. I redirected the class to "disney.com" but never disclosed it to IT because of the earlier threats.

View on HN

We used It's Learning in "high school". It had login without https at the time, and on the school wifi it was then easy to listen and get other's credentials. Some people got hold of some teachers' credentials, and tried to remove or alter some minuscule data.

One guy however, decided to sell grade-editing as a service to others. Of course it was noticed by the school, and it became a big deal with police involved and everything. Happy ending, though, the two people I know that was involved got master's in compsci a few years later.

Must've been fixed. My school used It's Learning for a while until this year, and it was fairly secure. HSTS of course.

Yes, this was 10 years ago. I may even misremember, maybe it was a unsecured single sign on in front or something where the fault actually was.

Did this happen to go down in Florida?

I have and forever will find it extremely stupid to threaten someone with expelling them for trying to HELP you do your job.

I got in-school suspension for the last 1/3 of senior year in HS because I took screenshots of a shared network directory permissions problem.

Me too, but unfortunately it's standard idiocy both in schools and in large companies. Whether you're a curious student or a white-hat pentester, it's still the case that if you find something and say something, you're treated as if you were the danger.

School (the institution) is not about learning. School (the institution) is about conformity. And finding exploits is anything BUT conformity.

It should be about learning. I think finding exploits should be encouraged and rewarded.

Agreed.

Perhaps in some places, but not everywhere.

Having worked for a public school district, it is my experience that things almost never go down as parent said. What actually happens is that they get caught and make an excuse (I was about to report it!) or their "report" of the problem is in the form of some leet-speak shit-talk on a public message board. A common theme you'll notice when people describe these events, even from their own perspective, is how they absolutely did change something, deface the page, etc.

“I reported this to our IT department and they were not pleased. They let me know they had the power to expel me but wouldn't.”

This response is grounds for immediate dismissal of the IT person in my view.

By parent's own admission they actually did break into their professor's account. The fact that they reported it did not exonerate them from that act, but did at least get them off with a warning.

The first response should be to be horrified about their own system and fix it quickly. Such a simple hack shouldn’t be possible.

For the most part people in IT departments aren't stupid, they know precisely how crap the software they're stuck using is, they just don't have any real input on the decision process. Blackboard, for instance, is notoriously awful but is everywhere in schools. This often applies to policies as well, unfortunately.

I agree but they still. shouldn’t threaten people who show these hacks with expulsion. The real bad guys will do their thing without telling anybody and you can assume that this is going on

True, but it is nice to have some customer (student) verification of how crappy it is. It helps with future negotiations. Plus, wanting students to trust the IT department is not their enemy is the basis of a good security experience when we notice something about a student's laptop or other device.

You're way cooler than me. I just injected rainbow css banners into my BB posts. I was too scared to try anything else.

I like this so much better because it beautifully demonstrates the problem without cluing anyone else in that there is an exploit unless they care to look at how you're injecting the rainbow CSS banner. And if anyone tells you to stop doing it you can just explain that you thought it was an intentional feature that just wasn't very well documented.

Reply on news.ycombinator.com