IoT hacking and rickrolling my high school district
whitehoodhacker.net
whitehoodhacker.net
1. First day on the job, email to boss: "Hey, the computer lab at Springfield High has a ton of known security flaws that are begging to be exploited."
2. Reply, 1 week later: "Sorry, we don't have any money for that. Just keep everything up-and-running."
3. 3 weeks later the computer lab at Springfield High got "hacked". All the computers displayed a popup window that said, "Miss Krabappel is a dyke!" (sorry for the offensive language)
4. Next day, email from boss: "The computer lab at Springfield High was hacked! Figure out how to fix this and make sure it doesn't happen again!"
5. A few days later Miss Krabappel filed to sue the school district. The local newspaper picked up the story.
6. Email from boss, in full panic mode: "I need you to figure out who hacked the computer lab at Springfield High so we can report him to the police!"
7. A week later an independent consulting firm was brought in to help identify the person behind the "hack". I heard they were paid $50K and found nothing. However, the kid got ratted out when he told all his friends. (It wasn't Bart Simpson! ;) )
8. Several weeks later: meeting to discuss working with a consulting firm that's gonna fix all the security issues because the current staff (me and my team) lacks the skills.
9. About 6 months later, I quit.
I worked for them as a contractor for a while and one of the big issues they had was they had tons of money to implement new technology (mostly from grants and things like that), but nearly nothing to maintain old tech. They could buy new computers all day long, but if something needed to be repaired/updated/maintained, there was no budget or resources to do it. So there were all sorts of fun issues, like they would buy computers and before they could get deployed their warranty would expire (since they weren't allowed to buy 3 year warranties on the computers) and computers with bad HDDs would get disposed of, even though the fix might be $50 and 10 minutes of time.
On the bright side, we got comfortable with computers and ended up building our own little projects (in and outside of school). In 10th grade we souped up one of the engineering lab computers by consolidating a bunch of old graphics cards and played games on it, lol.
When I engaged in `net send` shenanigans at the local community college, at least the IT staff was smart enough to know where to scramble a runner whenever those dialog boxes popped up across campus.
"ALL YOUR BASE ARE BELONG TO US" was quite the meme then, but apparently they thought it was some form of cyber-terrorism.
His punishment was community service, and the service was having to be basically an intern for the school IT guy. Smart administration, really.
I'll never understand braindead school administrators whose response is "throw the entire CFAA book at them" for kids who do the most harmless sort of "hacking". I mean, they're literally 16-year-olds. How disconnected from reality does one have to be to think that police/legal action is appropriate for this type of stuff? It's like they're specifically trying to ruin lives and create criminals/blackhats.
Edit: And something I remembered while scrolling this thread... it's particularly disappointing when it's the actual IT staff who get mad and threaten to press charges. Like, sure, if it's a 60-year-old secretary who's worried about you starting WWIII by whistling into a payphone, that's just ignorance, that's one thing. But IT people ought to know enough about security/"hacking" to see how ridiculous they're being... just sad.
They don't ask that. They just want their computers to always magically work and having to dedicate mental resources to events in IT at all is an intrusion to their time - to them, throwing CFAA at them is "setting an example".
That semester of internship was pretty fun, all things considered.
I should have left it at that, but Ingot cheeky and also did a net send back to the origin saying something like “thanks for your interest in onionisafruit”. That got escalated and I was threatened with disciplinary action. It didn’t occur to IT that they shouldn’t allow arbitrary script tags in user profiles. The best response was just to threaten the people who were creative with what they were given.
My message to every single computer in our HS:
"Hey what's up!"
my friend added to this:
"Your network (H:/) drive is being deleted."
School administrators and teachers did not find this funny.
He was on phones, got about twenty calls including one from a VP - with even more popping in throughout the following week as people returned to workstations to see the dialog. We were able to play it off as "testing the network" (not wrong I suppose), but our manager was a responsible sort and had it blocked with a group policy shortly after.
Ha, yeah I got banned for using net send as an IM app with friends too. There were a couple of us in my school who were skilled, enthusiastic programmers - it is kinda stupid that the punishment they decided on was to prevent us from being educated :-/
*HELP. on a BBC Master
I changed the homepage to a webpage which redirected to file://c:/con/con (which for those who don't know caused a windows BSOD at the time).
IT teacher thought it was hilarious, used it as part of the lesson about how computers can be broken into, and told everyone "ok we've seen that, don't do it again".
Another time I remember writing a simple program, probably in qbasic, which captured passwords to a file. It only wrote a the first 4 or so letters to the file - showed what we could do, had a little fun, tricked the teacher into logging in, and then told him "ha ha".
As long as you came up with creative things (not just copying others, which is tedious), which didn't cause too much disruption (no deleting files), and stopped doing it once you proved it could be done, you were fine.
Networked IT was new and exciting then though, to the students and the teachers. A few years earlier and it was all BBC Micros, a few years later and everyone was on the internet and trying to install backorifice, but for a brief moment well meaning harmless (for a teenager) curiosity was rewarded.
Those folks came to me with a request for some sort of Net Send revenge.
I wrote a VB script which ran in a loop, which randomly 8-10 times a day would get a new message from the BOFH excuse generator and net send it.
Ahh, youth.
No condescension, no threats. Just treating me like an adult with a constructive conversation. It never occurred that anyone might overreact like many in this thread experienced. Makes me feel pretty fortunate now.
I remember getting yelled at for changing the display resolution and typing a few commands in DOS to change file names quickly.
Computers were never up to date of course, we had cathodic displays up to 2010.
They always have the money. They just don't care about doing things properly. It simply isn't a priority for them.
Makes me feel good when someone comes and exploits their negligence. It's like divine retribution and they're doing god's work. They tempt fate and the gods punish them by making them pay more than they would have paid had they done things right. Amazing.
One day one of the old macs was showing the frowny face in a in-session classroom. Boss sent me down there with specific instructions: "pull out the hard drive and beat it really hard with the handle of this screwdriver". I was like: "?" and he was like, "just do it".
So I go down there and let myself in, trying not to interrupt the class. I climb behind the computer on a cart and pull out the HD. I beat it with the handle, like a good 10 times. Of course this got the class all riled up. I blushed, but told them this was normal operating procedure. Plug it back in and it works. I was (secretly) as amazed as everyone else in the class.
Back in the IT office, I say it worked. IT boss smiles and nods. I ask how. Well as it turns out some of those old hard drives used a vegetable oil based lube that seizes up if it's not used for a while. So if you bash it it un-seizes and starts turning again.
Anyway great times, fun memories. We all got our CompTIA A+ certifications at the end, but don't ask me what IRQ number is for the parallel port these days.
Our education system is amazing ;)
More likely an armature rather than a platter. Violence also worked when the drive would get stuck on a bad sector. Bashing the drive horizontally, while it was on, would sometimes move the arm enough for the drive to reacquire and hopefully not hit the same error on the next read attempt.
Heh. Nice.
A coworker's Mac wouldn't boot. I couldn't hear the hard drive. It was a model with the tip of the spindle exposed. I found a pencil with a gummy eraser. Gave the spindle a twist as I turned the power on.
Told the amazed user, "Do not turn off your computer until after you have backed up your data. That probably won't work twice."
Good times.
HDD wouldn't be recognized, sticking my ear to it i could only hear the motor emit a beep-like sound, no spin up.
Her masters thesis on it, inaccessible, i've opened up the case, removed the HDD, unscrewed the top and there was the drive arm, stuck in the mid of the platters...
Took a Torx screwdriver, turned the platters backwards and unstuck the drive arm...
Copied all data off of it and sent here to the nearest computer hardware store to get another drive...
Master thesis was successfully recovered!
Also, awesome ;)
Mind you, this was not in a clean room and i tried to be as quick as possible to not allow too much dust into the case..
Here's an online article, might even be the same drive (this was a external WD drive, not sure about the capacity, i think 500GB or 1TB): https://dataanalyzers.com/external-hard-drive-western-digita...
(...wow that read head is tiny)
last Tuesday
That email chain could be used to prove that you did what you could before the incident. If you were so inclined.
If you work in tech/IT, and the big bosses consider you and your org disparagingly, leave immediately. Something bad will happen with their IT, and you will be blamed, hassled, and harrassed for it.
I of course didn’t really know what I was doing. Looking back, this was a very strange punishment. Jokes on them I guess - left Oklahoma after HS and am now a software engineer in the Bay Area.
Provided what was sent/defaced/etc wasn't hate speech or punching down on someone else, we should have really used these events as flags for identifying kids who could hone their computer skills into something "productive".
If I wanted to do something I would be told that there weren’t the resources. If I volunteered to be those resources — in my spare time! — I would be told it’s against policy. If I asked if we could revisit the policy I would be told I was welcome to ask the IT committee (closed door meetings, unminuted) to consider it for their agenda. Time passes. Proposal rejected.
I gave myself one term to see if we could find a working relationship. It obviously didn’t work out so I ghosted them and just did everything myself without asking, out of my own pocket. I felt like an asshole but at some point you’ve just got to move on, especially if your end goal is improving teaching and learning for the pupils.
In my one experience in a university, this how it’s done. Just set you own stuff up, hope you aren’t discovered and ideally have a friend high up the ranks.
> I don’t know if it was outright maliciousness, or just extreme anxiety from the IT team lead about job security
> If I wanted to do something, I would be told that there weren't the resources.
> [Volunteering my time] is against policy.
> I gave myself one term to see if we could find a working relationship.
For anyone in a similar situation, there are a few ways to "hack your IT person". It's nothing magical and can be applied well beyond IT folks, but I'm aiming at folks in this conundrum. While I've not worked for a school district, I spent the first 10 years of my career in several levels of support/systems and ultimately architecture with the first few being similar to the whole "small IT with too many users who hate IT[2]". First, understand what their motivation is -- less support, more time to improve/architect (or play WoW ;) ...). If you have the expertise, approach that person and "talk shop" -- don't reveal that you "have skills", just ask a question or two in an area that teachers/staff often know little about, or go with a simple "I wouldn't do what you do ... all these teachers, many of whom haven't touched a keyboard that wasn't on their phone since 2010 or so ... it's got to be hell". If you can get them to tell a "war story" or two you'll probably find a few opportunities to say something that will reveal that you have somewhat of a clue what you're talking about. Do this outside of work, on their schedule -- Happy Hour or off-site lunch (not often possible during the school day due to time).
If things go well, say something like "I can't imagine how you get anything done with such a computer illiterate staff to babysit (aligning yourself with IT over said staff) ... I'm happy to help out anywhere I can if you can think of something I can do to reduce that grief[0]" This IT person spends their work life dealing mostly with people who are unhappy about things that are broken and the staff they support place blame for those breakages, not the resolution, at their feet[1].
You're now in the magical role of "the teacher who believes IT isn't incompetent." If you are received well, make your ask. Make it very limited -- if you need to be an admin of your laptop, insist that it be temporary and that you'll call the IT person when you are done (offer to let them watch if they want. They won't). Insist that you'll not let people know IT made an exception and will provide the required excuse if someone notices you're running something they can't: usually "IT doesn't know about it" is settled on. Maybe it's something you want every teacher to have -- don't dare explain that, and if you have to, outright lie: "I'm not interested in seeing the district adopt this, I just want to use it myself." You're not shooting your grand plans in the foot, you're giving yourself time to provide hard facts/evidence to make the case that it should be deployed. If it works out well, start planting the seeds with your IT person: "I really love this application, thanks for letting me use it on my school laptop ... what do you think the support overhead for something like this would be if every teacher had it?" ... listen to their concerns, find answers to each of them, revisit the topic. Your IT person is used to management (administration in schools) saying "this is what we need on every PC" without care for what amount of work/grief IT will deal with to sort it out. Administration doesn't care about IT griping very much -- it's seen as IT, "yet, again", complaining about having to "do work" and treating completely reasonable (in their minds) requests as though they're equivalent to scaling Mount Everest. If you have the data from your unofficial pilot to back you up, and the right person in IT (at least) not working against you, and other financial considerations/contracts aren't in the way, you'll be successful. If you're successful and your project works, the next time you may not have to ask at all.
Your IT person makes just as many judgements about you and their users as they make about IT but there's a lot more of you than their are IT folks. Having an ally/expert among the "clueless users" has a much higher value to your IT person than having that person as your ally does for you, even if it doesn't seem that way[1--(again)].
[0] How much time is IT spending doing "Help Desk" kind of support for everyone outside of IT (regardless of title/responsibilities the IT person was hired in for)? It's probably 80% "User Support" and 20% "everything else" which means all of the effort put into "everything else" centers around reducing how often teachers have to take time away from IT. Your offer, if its trusted, will reduce that burden at no cost to the IT person. Don't make that promise if you're not willing to do it, but it's unlikely anything will be asked of you.
[1] In the "Game of IT Support" (or it's variants: "The Game of Network Security Administration", etc), you can never have a score greater than "Zero". Zero is "everything works". When something breaks, you lose points. When you fix it, you gain points up to (but not always) your top score of "Zero". Roll out massive new infrastructure for WiFi? You're at Zero (or less since it probably won't work as conveniently as it does at home). You're an expense who's purpose it is to make things operate the way everyone expects they're designed/intended/meant to work. They also expect that you (IT) shouldn't be necessary -- these things should just work like my router/PC/internet service at home works and shouldn't require so much "policy" to "avoid doing things".
[2] While I was still living with my parents, my neighbor referred me to the IT job -- he was in Development. I'll never forget when my Dad called me up asking "why is IT (where I worked) at (company) so bad?" after listening to my neighbor berate my company's IT operations teams (never me, specifically). We were so hated. By everyone, especially non-Support IT. That was an impossible conversation to have.
Outside of that, though, I've talked to folks who worked in IT at a nearby hospital[0] and knew several who worked in IT at a University a town over and heard variations of your story. After ransomware hit a few hospitals across the country, my hope is that this is less common but I'd be surprised if anything is meaningfully better.
The problem with getting non-technical people to understand the importance of securing things is that they assume that everything provides a basic level of security. They read about hacks/attacks and hear about them on the news but they have probably not experienced one, personally[1]. They apply physical security considerations to the virtual world -- for instance, the keys you use to lock your front door are almost certainly terrible[2] but requiring physical access to the lock makes attacks on them rare. And that's the rub, it's the mistake in thinking that "Nobody cares about my stuff enough to hack me" which is the evidence used to justify the "it's never going to happen to me". It's a failure to understand that even if it were true that an attacker would literally have no use for anything you're protecting with a password (which is absolutely false -- your identity is enough) that another target will be chosen ahead of you[3]. On the internet, every target can be attacked at once, silently, from a distance and targets are chosen based on whether or not the attack succeeds.
In a High School, you can fully expect there's at least one of me in every graduating class. I'm surprised things like this don't happen all the time given how little attention is paid to network security/endpoint security in these places. No amount of threats of expulsion, legal action, etc will serve to help when your attackers are High School students[4]. The same part of their brain that makes them believe they're immortal/causes irresponsible behavior early-on in driving causes them to not understand the real probability that they will face criminal charges which is coupled with them not fully understanding how badly those criminal charges will affect the rest of their lives.
[0] The discussion arose after he had watched Season 1 of Mr. Robot and said "that's exactly how it is here except we have a (technical) staff of two rather than one"
[1] I can't tell you how many extended family members have shared that they still use a single password for every account and in a few cases, that password might as well be a variation of "Password".
[2] I have a close friend who learned how to pick locks as a hobby; he filed me off a bump key and taught me how to use it, whacking it with a branch of a tree; I was able to open my supposedly "extra secure" dead bolt pretty consistently with about 15 minutes of practice, he's picked each of my locks at one time or another.
[3] The old "You can't outrun the bear, but if you and your friend are being chased by the same bear, you only need to outrun your friend".
[4] I used to tell my kids that our High School not only had no doors in the stalls of the mens room, there had never been any doors designed into the plan. The partitions were brick, there were no holes, anywhere, where doors had been removed. I figured this was to make it easier to catch kids smoking but while fixing his PC, I asked the principal about it. His answer was "vandalism" -- students would rip them out. Reallt?! I couldn't imagine this. Fast forward to this year, the doors on the stalls at my kid's HS were ripped out by students during the first week of class. The kids were caught, criminally charged and had to pay for the damage. Their reason? They saw someone do it on TikTok and didn't think they'd get caught (there are 2 dome cameras at the entry to each bathroom!). Despite paying for the damage, the doors are not coming back this year -- I'd wager they'll never come back.
Alternatively, you have staff pointing out a possible flaw. That staff's time was already allocated; their noticing a flaw is a) taking time away from their allocation, and b) tacitly critical of decisions made above their pay grade. And even if they are right, the manager won't get credit for prevention, and in fact will get punished for "wasting" resources in an ad hoc way, rather than what they were acquired for.
It is depressing in the extreme to work for such an organization, and you were right to quit, because over time these perverse incentives will start to shape you whether you like it or not. The very idea of owning your work, of caring about real-world outcomes, becomes anathema as a matter of survival. You have to exist, along with your org, in a checking-the-boxes, don't-notice-what-you-aren't-paid-to-notice, mode. It's safe and comfortable for the body; it is deadly to the soul.
These were the days when nothing had SSL, so you could just intercept and rewrite traffic!
My only requirement was: do no actual damage
It was implemented as a Debian live CD that you could drop into any school computer. It would boot up, then Ettercap would MITM the whole network by spoofing the router. It routed all HTTP traffic via Squid and a custom ICAP server that did the actual rewriting. If you removed the live CDs, the network just went back to normal within a couple of minutes.
Routing the whole school's network through one old Pentium machine wouldn't work though, so I figured out a way of doing distributed load balancing: it would do the ARP spoofing slowly and randomly. So, as you added more machines, it would just magically balance between them.
It worked great for about an hour then whole network mysteriously stopped working for the rest of the day. I left all the live CDs in the computers as a calling card.
Sorry, school network admins.
When I was in high school I was a huge Linux fan and had a side job as a network administrator for small companies in my town. I don't know if I would have gotten the "random ARP load balancing" idea, but overall it seems well within the knowledge admins of the days had about TCP/IP.
When I was between 15 and 17 or so, I wrote small HTTP, DNS servers etc. in C++ for fun (straightforward implementations and not better in any way, so in the end just learning exercises), and I definitely had friends who did similar things.
A couple friends and I pulled off some stunts of comparable non-digital complexity. (This was the 80s, schools didn't have networks.) They were more of the logistics and misdirection sort; for instance, having your own version of the printed graduation programs delivered, instead of the boring, official one.
Even the ARP balancing thing is the kind of too-clever-by-a-half solution a naive youngin' would come up with since it would lead all the nodes thinking each other are the gateway and crushing the network with routing loops.
I'm not sure I quite understand the details, though. I assume there was only one gateway for the segment, so were the spoofed ARP replies unicast instead of broadcast? Otherwise, wouldn't all clients just switch to whatever machine announced their spoof for the gateway IP last?
There were several subnets at the school, each with its own gateway. I remember having to set up live CDs in several computer labs to cover each of the subnets.
Something has to be "the leader" and you need a system for choosing a new one once the old one is offline for a certain amount of time.
Add in a sprinkling of how to figure out if you have more than one leader active at a time.
For example, I use AutoHotkey to implement my JKLmouse program, which turns certain keyboard events into mouse movement for precise control. It's similar to the MouseKeys that comes with Windows, but made for laptop keyboards without numeric keypads.
And yes, you could definitely do that Minesweeper hack in AutoHotkey! :-)
https://github.com/geary/jklmouse/tree/master/AutoHotkey/Sou...
One thing to note is that I wrote this to use on my ThinkPads, which have physical mouse buttons. On a laptop where the touchpad itself is the mouse button, it may be difficult to avoid nudging the mouse position when you click.
I've been thinking about adding support for using other keys as "mouse buttons", but haven't done anything about it yet.
https://superuser.com/questions/1467313/mouse-pointer-moving...
This is just pure evil.
First, that the pranksters were so egregiously responsible in the way they went about it. They avoided disrupting any actual educational activities; it was meant to be harmless fun, not vandalism. No harm came to anything here.
Second, that they documented their findings to the administration as part of the action, including recommendations for improvements.
Third, the administration took this as exactly that: a harmless prank by smart, ethical kids who ALSO did them a favor by pointing out the vulnerabilities. If the admin had a panicked fit about this, they could have made it an ugly situation.
My educational experience was populated far more by "freak out and yell" types than this school district, which was a shame.
Junior year in high school, I got suspended for "hacking."
The tl;dr is that I was using a proxy to fetch assignments for class (because the county decided "yeah, this state run Moodle instance is obviously not appropriate for education" and one of my classes used Moodle) and got caught with the proxy configuration screen open. I wish I was joking.
Anyway, when I was sitting in the guidance counselor's office as the teacher was talking up how "dangerous" I was, I noticed a sticky note with a username and password written on it. Turns out it was an admin account for the gradebook, though I think it was just intended for scheduling.
I never did anything bad with those credentials, but that really tanked what little respect I still had for the administrators there.
On a lighter note, when stack exchange & co got blocked the next year, I was good friends with the librarians since I helped out a fair amount fixing up their laptop carts (and doing other things the sysadmins were too busy to take care of), and they were able to get them unblocked. It taught me a lot about office politics: people are willing to return favors, so you should always make those connections.
I mean, why did you have any in the first place?
I've met very, very few employees of high schools who were worthy of any sort of intellectual or professional respect.
Assuming you took the video at the top of the article, it was presumably trivial to figure out who was in the class you were in and then rule out everyone who appears on camera as the camera man. Or just ask the teacher...
In our high school they didn't expose the gradebook in that you could get in and change it, but we were able to see everyone else's grades. Teachers would post grades for their class and "obscure" it by posting it with the student ID (you were only supposed to know your own) next to the grade. But when the posted, the entire list was still in alphabetical order so it wasn't hard to figure out everyone's grade and student ID.
And the cherry on top of this was that all the students' passwords were their student ID.
It was Rainmeter; I was showing it to a friend. The IT guy even was like "yeah Rainmeter's pretty cool, I read about it in a magazine". But it was auto-detected and school policy, apparently.
My own child will never use a school-issued laptop or school wifi.
Why report when you can simply administratively deny?
In my grade 11 electronics class, one project we were assigned was to create a digital clock with notifications for one of the teachers. Me and a friend set up a raspberry pi with magic mirror installed on it, and modified some available plugins at the time to allow a google calendar for test dates embedded on the display. The teacher was quite pleased with this, but we convinced him to hard wire it to the network for "stability". In the background we had installed a vpn connection to one of my vps that I used to host my website, and created a new set of sudo enabled credentials naming it magic-mirror or something. The teacher then reviewed the project and changed the normal user credentials etc. Then right before it was installed in the ceiling, we attached a wifi adapter to the pi. A week or so later we remoted in through the tunnel and enabled a wireless hotspot from the pi. This provided us with internet while we were close to the classroom for the next year. People also over time learned that you could extend the range by hot spotting additional jumps using laptops.
Therefore I decided I would email Tetris to every student (I emailed the executable, not a link to Tetris), making it easier for everyone to play also. As soon as I did this the entire system got very slow...apparently the server had no quotas or partitioning and the hundreds of copies of Tetris filled up 100% of the hard drive space. It was a disaster. The computer "specialist" had no idea how to fix the system and she was teaching an adult education class that evening that required the system to work. She was furious and wanted me to get suspended. It didn't happen though because I spoke up about the problem right when I knew there was a problem and also some other teachers intervened on my behalf.
The woman who was responsible for the computer system back then is now the superintendent of the school system. I wonder if she remembers me.
I also graduated in the early 90's and my children recently graduated from my alma mater. When I went with them to teacher conferences some of the same teachers were still there. Teachers that I didn't even have classes with remember me.
So, this is just to say... that places like education where people may stick around for a long while in the system and such. They probably do remember a bunch of events from even a decade ago. It's the good places that have a sense of humor or appreciation for a worthy harmless infraction. They may even be secretly proud or have some admiration.
Though I do sorta fear that I just happened to hit the tail end of old-school hackery where such things are such things are rewarded. Now get off my lawn.
My senior prank was going to revolve around the printers. We were shocked to discover every printer not just in BG but across the entire district was accessible with no authentication of any kind. We cooked up ideas and were planning to print either porn or I has cheezburger/lolcat memes via telnet (I'm dating myself.)
Ultimately I got into other trouble before we could execute and figured this wasn’t worth not graduating over. I moved on and so happy to see a much better prank on this same network happen so many years later with almost no repercussions. Congratulations and great prank!
Regularly, I would end up in trouble in my High School for things like bypassing the root account (using ShellShock), or nullifying their executable restrictions (because I needed to run my own executables for a work/study program). If I got caught, the IT admin would sit down and we'd chat about what happened, how they could improve their security and such. An administrator caught on to one of my shenanigans, bypassing the content block because I wanted to read a "hacking" article, and threatened me with suspension. Supposedly, she reported the incident to IT, and IT told her to not bother me anymore.
It was always disappointing when they took it too far and were directly caught by teachers or administration before I could tell them they were being a bit too blatantly malicious.
This is a beautiful touch, if somebody happened across his testing in the middle of the night they wouldn't suspect anything was amiss.
Luckily no one got in trouble (meaning me or my friend). Not so sure this would happen in 2021.
When my CS teacher filed a ticket asking “who has the user account ‘admin’ and why is the password ‘password?’” IT wanted to revoke my network login and probably put me in ISS for a few days. Fortunately, my CS teacher didn’t reveal who I was.
Very glad IT at this person’s school took it in stride, unfortunately this was just the MO of IT in my district.
Computer lab access revoked for 6 weeks. Jokes on them, now I send socket messages to my friend that says "Hi from Chicago" and there's nothing they can do about it.
My friend however keeps begging me to use this thing called 'email' because he claims he doesn't see the socket messages.
but i remember you had to do it from a library computer, because it said who it sent it from. so you had to do a little drive by walking net send as you walked out of the library to not get caught
In my next class, the teacher was talking about "Time for break" virus going around... :/
This was after the district IT wanted to suspend me for setting up a Windows 2000 domain for the yearbook lab, so I kept my mouth shut.
I never once got in trouble for it - the teacher would ask the class, directly looking at me, from time to time to stop it, but I never got in trouble.
I imagine he was just using those announcements to get me to stop from time to time, but knew this kid deserved it so he never did more than that.
I went to a small private Christian school back in the late 200X's, and not the type of private school that had gobs of money. For two years, our desktop computers in the computer lab and the English classroom ran Ubuntu Linux (presumably because Windows licenses were >$0). The only students with Linux experience were myself and a friend that I introduced to Linux (who is also now an IT professional).
For a month or two we systematically changed the remote desktop preferences to automatically accept new connections and not to display any messages saying that there is a connection. We tried to never sit at the same computer twice so that we could "adjust" as many computers as possible and to make a secret map of where each computer was by hostname.
If we were in the computer lab and feeling mischievous (always), we'd poll around English classroom hostnames to see if any were in use, or vice versa. We'd "help" people write their papers (very creatively, I might add), speedrun through other students' typing lessons, open a terminal and run "telnet towel.blinkenlights.nl", or whatever else we could come up with.
Well, wouldn't you know it, word gets around this is happening and we naturally get called in to the principal's office (because who else?). While expecting the worst, we were told "we know what you're doing, we don't know how to stop you, but we encourage you to stop and use your technical abilities productively instead" and were let off without punishment. We both came out of it with great respect for the administration because they showed us respect we didn't deserve, and we stopped.
My story: the "second best high school in the state" had an AT&T 3b2. They wouldn't let me take any classes that used it because they were afraid of what I might do to it (their words). I mean, they weren't actually wrong to worry, but it din't really have anything on it.
It didn't go over so well. It embarrassed them and lead to some major reprimands for me, almost to the point of losing my job for unauthorized access to systems.
I remember in high school poking around a network drive until I found an executable with the name "SEND" in the name. I had a sense that it would send some kind of message somewhere, but I honestly didn't know where or to how many people. I was quite surprised when all the screens in our computer lab froze and, five seconds later, my message appeared on all of them. (I later learned that my message appeared on every desktop screen in the school!)
I'm not sure exactly how they found me out, but I was called into the IT admin's office a couple of days later. She was furious with me. I told her the truth. I didn't know what exactly would happen when I ran that command, but she didn't buy it. Fortunately, nothing ended up happening after that.
I've wondered to this day what exactly they could have done to me if they decided to press whatever legal authority they might have had to its fullest extent. I was never told "don't go to Z:\" or "don't run any program other than those on this list." Even after I was found out, I wasn't ever explicitly told that my actions constituted unauthorized access.
It was a different, perhaps more innocent (or ignorant) time back then. How much have things changed now?
I didn't think much of it, but some other students caught wind. Before I knew it, the superintendent threatened to have the police involved and press legal action for "hacking confidential student data."
It's CYA all the way, usually at the expense of the person in the chain least equipped to cover their ass (the student).
I'm guessing that they never told you "don't browse this network drive"?
Seriously, I found a state website that appeared to be exposing NPI about certain people in an API response. So much NPI nicely formatted in a JSON response. I closed the page and never touched it again. You know the state will declare me a dangerous and sophisticated hacker because I pressed F12 to open the developer tools, that's much easier than admiring they made a mistake.
Personal pet peeve:
Your high school is not a covered entity and is not acting as a business associate of a covered entity. HIPAA does not apply. They are free to keep a plaintext file with your name, nut allergies, COVID vaccination status, and anything else they want to put in there - without HIPAA entering into the discussion.
FERPA could apply, but I don't know much about that.
A week later, police escorted me from my dorm and both I and the other student were eventually expelled and threatened with harsh legal action, which never came.
[1] The "high school" was an early-entrance-to-college program where we started college at 16, lived on campus, took the normal freshman/sophomore college courses, and eventually received a high school diploma and an Associate of Science when we graduated at 18. The website was for the school I attended, but the SQL dump included all of the university students as well. The school has since shut down.
That said, I did know a kid that had charges pressed against him when I was in school so things weren’t necessarily innocent back then either. He was admittedly an idiot and borderline malicious though.
* SEND happened
* Minor kerfluffle ensued among various functionaries
* Big Boss worried that something Big was going on
* IT admin was questioned and had no answers
* Simmer for a few days, Big Boss repeating questions and IT admin being flummoxed
* Eventually adequate logs are found and correlated that place you as the likely responsible party
* IT admin is lathered up about a big nothing because Big Boss keeps asking and their competence is in question
* IT admin unleashes the pent up frustration of a few days of stupidity and job security uncertainty on you, and is not satisfied that all this drama was initiated by boredom and not malice
* IT admin reports to Big Boss, who basically brushes it off because they have moved on to other things -- and at the end of the day knows they run an organization filled with kids, some of whom are more curious than others
* Issue disappearsWasn't a regular MS user, but we were in a computer training lab at a company for "computer day" field trip. Was bored during instructions, so naturally I logged in, found "net send", and sent a few crank messages to classmates using * as destination. Everyone, including the instructor, got a good laugh.
Approached later in day by corporate IT. Apparently the lab had poor routing rules, no firewalls, and sat on the main Corp network. My messages were received on 25,000 terminals.
Thankfully, they recognized this as (a) harmless, and (b) their own lax failure. No adverse outcome.
There's a few comments about the risks along with a little surprise/at least applause for the administration choosing not to waste the courts/various other parts of the justice system with this prank. I completely agree -- I don't know if I'm terribly surprised they chose that route (whether or not they were truly upset in the first place). I applaud the students for executing this so carefully/well and if my kids pulled something like this off with this level of care -- well, they'd at least be getting a dinner out of their choosing -- probably a trip to a nearby theme park.
I suspect the kids involved were also certain that their approach, attention paid to keep from disrupting class and (thankfully thorough) testing that helped avoid a harmless prank turning into expensive litigation/really pissed off parents. But I'll bet there was a lot of fear around that, anyway! Had something gone awry -- and that's always where the risk is -- I'm guessing the outcome would have been more severe for these kids.
They really played the social engineering/covering their hind-quarters side of this prank very well. A large amount of effort was put toward making sure class was not interrupted[1], things worked and were tested and they provided detailed information to the administration on how to secure their systems -- that last piece allowing them to say "Without our minimally invasive prank and report you'd have never known these issues existed. We're not that special; a more malicious student could have discovered these flaws, opted for a porn broadcast and made it difficult/impossible to find them to punish." They probably understand their own school's administration and took an educated guess as to how they might handle something like that, too. At least for the scope of anything I did, I knew I wouldn't hear from the Vice Principal or Principal -- I'd solved various computer problems for them by then that the worst I'd get would be "that was cool, but please don't do that again."
I didn't get in trouble because the pranks worked similarly -- I tested/avoided disruption (most of the time), did no permanent damage and anything was resolved by a reboot (DOS and no fixed disk) and our harm was necessarily limited since there are only so many computers you can covertly pop a floppy disk in -- there was no network. The biggest factor, though, was that our programming teacher sometimes got involved, himself. He was the head of the math department, not your traditional "computer geek" and I was doing things that he wasn't teaching, so he encouraged it. The guy was amazing (passed away in the mid-00s).
So, kids, if you do try this at home, make sure it all works, provably, very very well and don't do anything that will give them other reasons to throw the book at you. And if your administration has more than the typical "Zero Tolerance[2]" stance on things, it's just a bad idea regardless.
I'm sure there were a few among the ranks that became furious but cooler heads prevailed. The report at the end was a nice touch.
[0] Mostly contained in the computer lab, which was non-networked, but when we discovered the three-letter-acronym TSR (DOS's Terminate and Stay Ready) and realized it was rare that another student would reboot an already booted machine (it took forever counting to the 512KB or so RAM installed). Incredibly, I graduated in the late 90s -- my Senior year, the lab that taught (Turbo, then Borland) Pascal was 15 years behind what most people had at home... these diskless all-in-one bastards wouldn't break.
[1] I'm sure it took the kids a little longer to get to their classes after that all happened -- that's a minor, completely expected, situation here and at least a small reward for the efforts involved.
[2] The school ten miles north of us was in a rural district and had a parking lot full of trucks with hunting rifles attached sitting in the parking lot every day (well after all of the schools installed additional locks and added security theater to make parents feel better post-Columbine)...that wasn't forbidden at least as far back as the early 00s and I wouldn't be surprised if a blind eye is mostly turned, today in some parts of that district.
Great work, Minh.
One can only hope.
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
Try the new cross-platform PowerShell https://aka.ms/pscore6it's like those awesome ubuntu login motd's, I look forward to them every time I log in, just in case the ad changes.
er ...
The internet has been pretty successful and many popular protocols (http, smtp, etc) are exactly "passing strings from program to program"
If you pump some serialised binary into a browser it will still render wrong.
Who is "we". I've worked exclusively on a windows stack so used powershell on the job. But at home, I use bash. I don't want something like powershell in nix and don't use powershell on nix even though it's been available on nix for many years now.
> Passing strings from program to program is a pain
You can argue it's the basis of computer science and also pretty efficient.
> passing around .NET objects instead is a great step forward, as can be seen by the several attempts at similar shells passing around JSON objects.
Passing around objects can be slow, inefficient, wasteful, etc though it can be convenient.
If you are on a windows stack then go with powershell. If not, then go with bash. Nobody should be on a windows stack but sadly, much of the business world has been captured by microsoft.
As for the passing of strings: it might seem like a pain, but as soon as you start working with non-program I/O it's not like you'll have much of a choice. Keep in mind that it is the lowest form of communication and you can build on top of that. Same with I/O in general: nothing prevents you from using shared memory or a device instead.
It don't think they expect that people would rewrite their old scripts. That is actually silly to consider. Even with console vs terminal, they are concerned of backward compatibility and leaving it as is:
> Windows Console will continue to ship within Windows for decades to come in order to ensure backward compatibility with the many millions of existing/legacy command-line scripts, apps, and tools
https://devblogs.microsoft.com/commandline/windows-terminal-...
Then i used powershell4, i guess it was better but honestly i don't think i've used it very much. Powershell5 might be better than bash for 90% of the dev population though.
They got me on propagating computer games through the network using shared drives the teachers were supposed to use for homework.
We had BNC network cables in those days and the entire building shared a single T1 line for several hundred computers.
The world has changed.
> a person who committed the offense before his eighteenth birthday, but is over twenty-one on the date formal charges are filed, may be prosecuted as an adult.... This is true even where the government could have charged the juvenile prior to his twenty-first birthday, but did not.
However, the statute of limitations for CFAA violations is 2 years [1 p. 2] so this might not apply. If somehow they can still go after him at 21, this post could play a part in evidence for performing the hack (I truly hope not).
0: https://www.justice.gov/sites/default/files/criminal-ccips/l...
1: https://www.goodwinlaw.com/-/media/files/publications/10_01-...
I agree with you that explicit permission is important, but it is also something that young people are frequently and explicitly denied. I don't think the solution is condoning that sort of 'extracurricular', but I think we should recognize the problem is probably starting with the adults in the situation.
But to many school administrators consent of teachers is meaningless. Those assets aren't owned by the teachers but by the district, even if they are the apparent authority figures and stewards in the eyes of the students.
The advice given to me in high school (I was working on tech projects after school for several teachers and groups) was to not even try or explore poking around the IT networks it no matter how good my intentions were. All it takes is one grumpy school administrator to feel undermined or to misunderstand your report and you could be expelled.
When you're in a position like a student, you're still working your way up and building credibility. No need to risk it all for an IT group that doesn't want your security advice and didn't ask for your help.
"Know where your boundaries are and who your stakeholders are, don't do anything that will make your stakeholders look bad." It's a life advice given to me by my high school teacher that served me well in my professional life.
And you just volunteer to be thrown under the bus as that "hacker."
Anonymous, maybe. As a student, under 18 - you're "immune" from many things - but it can be a stain.
I realize this is conjecture but I'm giving an example. Speaking from experience receiving "security reports" from users and students, often times they fail to understand the full picture of IT. As a student with no buy-in from the stakeholders, the risk isn't worth it.
For example, let's say this IoT network was managed by a vendor who, while having sloppy configuration practices, also had network monitoring looking for APT/anomalies (such as new connections in off-hours or unusual connection rates or bandwidth usage.)
While the student thinks they're being sneaky and hacking the system at night, opening ssh connections to a hundred devices from his laptop, there are now reports and alarms going off on a monitoring system. Some basic timestamps and VPN access logs would be enough to point to the student. So this student thinks they're creating an anonymous harmless prank, but the IT department is already investigating a malicious actor on their network. How do you think this would end?
It was certainly against the rules. I'm not so sure it was wrong.
False equivalence.
So perhaps you’re right that it is a false equivalence.
https://statisticalatlas.com/school-district/Illinois/Townsh...
They're lucky a prosecutor didn't prosecute them for criminal activity. The school would not have any say about whether or not this happens.
Schools are members of the local government "club". Prosecutors don't generally burn political capital giving the bird to other members of the club like that without a good reason.
First installed some open source FPS on all computers. They got found and removed, and we all got moved to guest accounts.
I then found something called DreampackPL. Just pop in the CD, boot on it, replace the pinball game with their executable, reboot. And voilà, access to everything. Just remember to put the pinball back afterwards.
That’s when the BIOS got password protected.
My next step? Opening the machines up to move a jumper. Do everything all over again, but this time on a hidden windows account.
The IT admin was a student’s parent. Just spent years making the poor guy run in circles before the school administration finally gave up.
Since freshman year, I had complete access to the IPTV system. I only messed around with it a few times and had plans for a senior prank, but it moved to the back of my mind and eventually went forgotten.
Not sure why they don't go into more detail about how exactly "complete access" was obtained, since that is obviously the hardest part of hacking any system. Not trying to downplay the achievement here, just think that this would have deserved a bit more detail.
"From the results, we found various devices exposed on the district network. These included printers, IP phones... and even security cameras without any password authentication!"
On the other hand me and a few of my friends were the only computer literate people in the school and were tasked with removing it in the end.
But still, it was fun seeing a whole class of computers have an ambulance run at the bottom of the screen with the poor beeper emulating the siren.
[0] https://en.wikipedia.org/wiki/Ambulance_(computer_virus)
I found more severe vulnerabilities including being able to lift home addresses of students by querying an unprotected endpoint. Didn’t get in trouble for this one, and reported it promptly to the IT administrator.
This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any responsible disclosure process.
Anyone in the field will tell you that this is an absolute disaster of a post because it sends the signal to other young aspiring cybersecurity professionals that this is OK, and the school will laugh it off, and you'll be seen as an adorable Matthew Broderick type Wargames character. I can't overemphasize how far this is from the truth in 2021.
Absolutely do not access systems you are not allowed to. If you do want to do penetration testing, you need permission from the systems owner and a clearly defined scope. And when you do find issues, you don't exploit them, you responsibly disclose them within a clearly defined framework.
If you want to end up with a criminal record that will profoundly effect the rest of your life, including your career prospects and ability to travel internationally, then by all means, do what this guy did.
I wish it wasn't so. It never used to be. But this is how it is now. Overzealous prosecutors have been given a huge amount of power, and all you need is one embarrassed systems administrator, school board or management team to trigger a disastrous outcome in stories like this.
When I was younger (~15) I also did some "fun" (aka stupid) stuff with the school computer network and in the end they got me and I received a "formal warning" (it was in France).
In the end I'm glad for it because that scared me off and I never tried again on stuff that I don't own.
But putting a kid in jail/having a criminal record seems way to excessive to me. Kids are dumb. And by punishing them that hard they won't become a better person. hell, they won't be able to have a job !
It absolutely is. Society is clearly harmed by laws like the CFAA.
LEO do like overly broad laws though. There's nothing better to ruin the lives of people that cops don't like.
One of my friends who I did this to went crazy with it and used it to mess with his teachers computers. Ended up in huge trouble, cops knocking on his door, and I believe probation. This was the year after I graduated.
On the one hand, I kind of feel responsible for showing him, on the other hand, it's his fault he had to go off and be an idiot with something I just thought was fun.
I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting.
I wonder if it was possible for the hacker to ask a lawyer to represent them anonymously and make a contract, something like the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money...
If you read TFA, that is effectively what happened. Even with the guarantee, only one of them revealed themselves.
Criminal charges are generally filed by the prosecutor. They'll generally follow the wishes of the victim, but are not required to (think, e.g., domestic violence cases). There is absolutely zero the school can do to guarantee that you won't be charged if the prosecutor does catch wind of the incident and decides to make an example of you.
“Your faith in the legal system is appalling.”
Maybe a bit overzealous with the reaction here. OK, sure, the OP could have been even more serious about this but literally the first labeled section is "DISCLAIMER" and says:
> With that said, what we did was very illegal, and other administrations may have pressed charges. We are grateful that the D214 administration was so understanding.
Fortunately, I got on well with the math teacher who had charge of it, and he'd let me take it home over the weekends. Those were the days...
At the school my child attends, I am confident he would have ended up with a pat on the back if the circumstances were similar. I can't speak for the district -- I'd be willing to bet that'd be very risky. At the school I had once attended, I'd expect the entire district would behave similarly. I'm sure there were people within the district administration that wanted to throw the book at the kids involved.
Here's the thing for those people: the last thing a school district wants is to become national news for punishing a bunch of kids who the evening news can make out to look like "Geniuses". Since nothing failed in their plan -- that's crazy important -- there would be very few ways to frame the story that makes the administration look like anything but bullies, and many will frame them as "petty bullies". I have a friend I went to High School with who is now a High School principal. He's still "that guy I went to High School with." I have no doubt he would have given the kids an award privately, if not publicly.
It's sad that some public school districts are using discipline approaches you'd expect to see in prisons, rather than a school, and I'm sure in certain places in the country, that might be a necessity. Context matters, too -- were these kids who were constantly pulling pranks like this, had been talked to in the past/impacted things in the past, etc, I'd expect a harsh response: "Yes, we get it, you're smart, stop breaking things already, read the horrors of the 1986 CFAA because that's coming if it happens again." I'm guessing these were otherwise good students.
Not everything warrants felony charges for kids.
Or maybe it will shame other IT departments into not having a stick up their butt. Especially if there is already a culture of overlooking minor criminal activity in the name of harmless pranks.
I am delighted that these admins had the character to resist the perverse incentives of the system.
Looks like they paid out millions in bounty in 2020:
https://www.zdnet.com/article/hackerones-2020-top-10-public-bug-bounty-programs/Companies can mark items as duplicates without fixing the underlying bug for an indefinite period of time. So the 3 vulnerabilities I found all got marked as duplicates without any compensation or even acknowledgement of my time writing up the issues. Felt like a complete waste of time.
If you're great, you can probably find novel stuff better than I was able to, but if you're that great you likely already have plenty of employment opportunities.
Part of the issue is people like you who advocate for respecting "the system" and essentially scaring kids into not doing anything. Except that simply re-enforces the draconian laws that are currently in place. If more kids rebelled and this was a regular occurrence it would help to desensitize society to digital pranks instead of always treating these kids like terrorists.
Unless you kill someone I generally don’t believe in life long criminal records. They only serve to drive people into further criminality.
I imagine for a robbery you could get 5 years in prison, 5 years with it on your record and then automatically get it expunged.
Back to the topic at hand , what if the IT hack stopped people from getting paid on time. How many suffered emotional distress ? Evictions can literally cause suicide.
Maybe someone can’t afford medication, skip it and have a stroke.
The entire criminal justice system is broken. So you did something stupid at 20, at 46 you still can’t find a job due to your record.
People want simple easy solutions. Things are much more complicated. If you release a dozen felons 5 years early and 2 go on to commit horrific crimes it’s easy to ignore the good the other 10 did
Welcome to the War On Redemption. Primary participants are the harmful people who create these systems and the people who remain silent while countless lives are ruined for no good result.
Even if I agree that it's a dumb practice, you're proposing a world where employers are free to refuse your hire if you (eg.) were fired from a job 26 years ago, but not because you were convicted of a crime.
There are processes for changing the laws without sending kids to jail, having to treat kids like terrorists, or potentially making the law even harsher because it isn't effective enough to dissuade lawbreaking. If the laws feel draconian, perhaps following those processes might be a better approach to change the system without as many sacrifices.
And none of them work, or will ever work in this oligarchy. The rich own the congress, and the senate, and they benefit greatly from these things. America hasn't been a functioning republic in at least 50 years.
The comment didn't say "respect the system", it said to deal in the realpolitik and don't try to effect legislative change by ruining your life as a high school student.
Is it a good system if a "stupid prank" can "throw away your future" ?
Yes, students get in trouble all the time, but most of the consequences for their stupidity are slaps on the hand. Lunch in a classroom, a parent-teacher conference, after school detention, in-school suspension, getting grounded - none of these things carry civil or criminal charges that are a matter of record. What should be a harmless prank can turn into a life altering civil and criminal charges. With high school kids, things quickly go from, "I hacked the school network to do a Rick Roll; they laughed and sent me on my way," all the way to, "I gave my friend the exploit to do something similar; I didn't know he was going to change everyone's grades to 69%."
Further, I would not want to teach in a district where students doing digital pranks is the norm. I volunteer at a high school. Unchecked digital pranks would quickly turn into a constant stream of disruptions. Everyone would think that their prank is better than the last.
Why do we tolerate pranks? You shouldn't be able to interfere with someone else and say 'just a prank bro'. Leave other people's things alone. Don't create work for other people. Don't bother people just trying to do their jobs. Don't impose your sense of humour on others. These all seem like basics to me?
If you think someone's funny? Great. Just don't bother other people with it. Do it with your own stuff, not other people's.
To use the murder example again: many people who commit manslaughter have all kinds of various intentions. The one murder is concerned with is whether or not they specifically had the intent to kill the person. "Establishing intent" in this scenario is specifically regarding that one intent. Not any intent.
Pranks can be an outlet for creativity and learning that might not otherwise happen.
The post concludes with:
> This has been one of the most remarkable experiences I ever had in high school and I thank everyone who helped support me. That's all and thanks for reading!
I'm certain this kid learned so much working through the execution of this prank, and without being criminalized by the district, he's better off for it. Likewise, the IT department is better off with a more secure system, and staff and students experienced shared moments of unexpected joy.
Call me naive, but I'd say this kid made his small slice of the world a bit better, if only for a fleeting moment.
Great.
But do it with your own things then. Don't bother anyone else or touch anyone else's things.
And no worker should ever have to do any work (such as reset a computer system) because of your prank. Workers have enough work to do and enough hassles in their lives.
You're really oversimplifying here. Something tells me this highschooler doesn't personally own the breadth of commercial equipment that he hacked for this prank.
> And no worker should ever have to do any work (such as reset a computer system) because of your prank. Workers have enough work to do and enough hassles in their lives.
Okay, let's all be worker robots :)
So they shouldn't have done it.
> Okay, let's all be worker robots :)
It's not about what you want to do. It's about what some low-paid worker who has to clean up after you thinks. Or some other student inconvenienced by your prank thinks.
If you're impacting on someone else's life then you're in the wrong!
What if these people don't want your sense of humour imposed on them?
I think it's ethically wrong.
As the author points out early on in this article, most school districts would not have tolerated a prank like this. In fact this is the only example I know about a prank this big that got the response of toleration the author documented in the article.
> You shouldn't be able to interfere with someone else and say 'just a prank bro'.
The students made a report of what they did and presented it to the administration.
I guess to be generous I could reinterpret your concern to be, "Do students in every school district in the U.S. get to avoid criminal prosecution under the draconian CFAA by constructing a complex hack tailored to avoid interrupting regular school business, then writing up a report and giving a powerpoint presentation to an apparently enlightened and tech-savvy administration to help them strengthen their network defenses?" In that case, point taken.
So what?
Can I push you down in the street and then hand you a report explaining how I was able to push you down and that makes it all ok?
(Maybe we just have different experiences and thus different definitions of the word.)
This is a super basic example, but it serves to illustrate my point. It's not just a prank bro, even when it is.
I think you misread the GP. He's not defending the system, just describing it, and how the OP was lucky that the people in charge were unusual and open-minded. He's warning others that the risk/reward implied by the OP's experience is misleading.
I suspect that most commenters on this site applaud the kids adventurousness and style. A great hack! But we are uniquely aware of how rare it is that anyone with authority, school administrators or law enforcement, would show any leniency or self-restraint in these cases. On balance, the instinct seems to go for the jugular, dehumanize the kid as a criminal hacker, and ruin his life. No-one is saying that's good, or reasonable. It's just how it is.
There are multiple disclaimers in the text, almost every other paragraph.
If this went to court, the charges of malicious intent would likely not stick, so jailtime could likely be avoided in leu of fine/community service.
Competent tech companies will not give a shit about criminal record of this nature.
Expulsion from school is pretty much irrelevant, especially for CS careers. You can get a GED, find any college with CS program that will take your money, spend a year having fun, apply for an internship at a tech company, do a good job to be offered a return, talk to HR to go directly into entry level role, and you are set (have personally seen 2 cases of this happening with an intern).
The most functionally harmful thing would be monetary cost, which is still inconsequential considering the salary this guy would make.
No, he is just smart. He did it anonymously. He knows how to cover his a$$.
> it sends the signal to other young aspiring cybersecurity professionals that this is OK
The post literally has a whole section dedicated to explaining that this is not OK, but whatever.
You're warning a teenager against making a brilliant, harmless, funny and responsible prank so that they won't get their whole life fucked up forever. Think a little about what kind of political system necessitates that kind of ridiculous warning. What sort of nation does this kind of thing to its kids? If we strike the United States from the list, what sort of countries are left?
You guys really need to get your so-called justice system sorted out. Sorry to make such a blunt point, but this is depressing as hell.
CFAA and the DMCA are some of the worst, most authoritarian laws ever created, and they exist to do nothing other ensure a system where being rich enough to afford lawyers means you don't have to do anything else.
Use default passwords like an idiot and someone uses their autofill? They're the criminal, not you.
Let people just change the account number in the address bar and switch accounts with zero authorization or authentication? They're the criminal, not you. (Bank of America literally did this.)
Have open access for students to download papers and one of them uses it to download all of them? They're the criminal, not you. (RIP Aaron Swartz)
I support jury nullification for the CFAA and DMCA and so should everyone reading this.
The sheer amount of testing and verifying no major impact to academic testing took place probably helped, and cleaning up after themselves and documenting their finding and reporting it to IT was a cherry on the top.
I like that the administration even requested that the team brief the district IT on the "attack".
It could have been a lot of fun if schools in the early 2000s were as well-connected as they seem to be now. We were still working with overhead projectors at the time.
Anyway, it was fun to learn about the "obscure ARC architecture" used by the IoT devices in question. Unpacked to "Argonaut RISC Core", that made me curious enough to look it up since I hadn't heard of it. And sure enough, it was related to Argonaut as in "the UK game developers founded by Jez San" [1]. That's a really interesting development! :)
[1] https://en.wikipedia.org/wiki/Synopsys#ARC_International
Each summer they "improved" security and in less then a week we again had all of the important passwords. Even the one of the top sysadmin - which really was the one he told some students when he was trunk (everyone thought he was joking).
We didn't prank, but instead installed Duke Nukem on the Netware login drive or enabled internet access when the teachers weren't around or didn't want to give us access.
I showed some other students who were so freaked out that I had "hacked Google" that I got the attention of the librarian, who promptly banned me from the library computers for the rest of the year, even after I refreshed the page to show them it wasn't "real". Oof.
Also if you're going to commit a crime and brag about it, don't say "hey well they would point the finger at me anyway and I'm not going to name my partners." You've just told them there are coconspirators, and you don't have a right not to incriminate others.
Got called into an office -- a gifted program administration, not the regular school office. I think one of the teachers there caught wind of my cool little trick, and asked me to take it down right then and there. I was terrified, as I wasn't really someone to get into any sort of trouble. I was able to take it down through their machine's windows explorer's FTP access.
Now I realize that this teacher probably saved me from a lot of trouble. I wish these sort of stories were the norm -- where educators welcome the natural curiosity instead of throwing the law at kids who dare to think outside the box.
We'd of course run out of stuff to do and start messing around with our newly honed skills. Learning about net send wasn't too bad, we just sent dumb messages to each other. But learning vbscript combined with net send... you could DoS the other machines with a for loop.
One morning I was playing around with the net send script, but accidentally plugged into the schoolwide LAN instead of our local network... every computer in the building got locked down with some idiotic message my 17 year old brain had come up with. IT took a educated guess and came down to our class and I fessed up, thankfully they let me off with a stern talking to and promises to never do it again.
It was supposed to be that a club could log into them, make, and submit a graphic to display on the TVs, but the school would have to review them before they would be displayed.
However, I would later find out, a software update had messed up the roles system and so that club username/password which was in a public document actually had the ability to post things immediately on the TVs, without review. I found this out when I made a Math Club poster, hit the button, and it was immediately live without a check.
I just reported it and it was fixed the next day. My instructor said that could have been really really bad considering some more unscrupulous college kids who would have (not naming names) probably gotten a kick out of throwing pr0n on them...
I wanted to make sure OP knows that “white hood” can mean something _very_ different, and “white hoodie hacker” might provide that distance.
Note well that the victim of a crime does not get any say in whether or not a prosecutor prosecutes a crime. "Pressing charges" is a myth.
The prosecutor decides. Period.
This is the only acceptable response.
I would print pages and pages of "I AM THE MASS PAPER WASTER!!!" to random printers in other buildings. I'm genuinely curious if it actually worked.
If you want to understand the IoT better, I can recommend this article: https://girlsplaining.substack.com/p/internet-of-things-and-...
Little did he know the kernel was old and had a privilege escalation vulnerability. I ended up leaving a note about it on the back of my final exam.
Unfortunately they decided to replace it with windows now, but my little brother is doing a great job keeping the people managing that new system on their toes ;)
of course, this was in the days when pad-pad was a thing out in the real world, so false logins on vt100/vt220 terminals was all too easy to fake.
I am still thankful that they decided to set that up (we even had physical machine access) - such a better solution than just letting us go wild on the local network.
How were you able to get Chrome RDP access setup without admin privileges? I assume this is automatically blocked via group policy.
Now that you have Chrome RDP setup, how were you able to access these machines from outside the network from home?
"since I could come in-person with my team for security competitions" I'm really intrigued now. What were these security competitions about and were they part of a class you were in?
IF you do something like this at least consider that someone else is going to be cleaning your mess up.
School kids are the worst users you can ask for. Unlike a normal business where they'd be punished or removed for something like this the kids will deliberately try to destroy the school network.
But surprised that a tech-enthusiast and eager learner might have put this much thought into this prank and it's potential consequences, not so much.
Teenagers/young adults tend to have different stressors and other things to occupy their time than the average adult in the workforce, meaning the author likely gave this prank a fair amount of their free time, and that dedication showed through in the amount of planning done.
Additionally it's likely, given they mentioned once or twice in the article they planned on posting a blog about the prank, that they might be hoping to use this on their resume or as a talking point in their career. If they're hoping to go into security or comp sci, this would be a decent feather in their cap and the amount of time spent is easily justified.
Finding a vulnerability in the grade tracking system is much different than in IPTV: the first can have real-life implications, the latter only gives the attacker bragging rights. Only students would benefit from hacking IPTV (for funsies), but patching it requires funds nonetheless, and then further effort from staff when the default user/pass doesn't work. And then we complain about the hidden costs of low-trust societies.
If the guy had written to the admins about it, they probably would've replied "yeah we know about it, please don't do it".
"But I want to because I can and you're too lazy and incompetent to fix it."
"Okay then here's 50 bucks, please fix it for us, we don't have time for this nonsense."
"F off", and then proceeds to rick roll because that can get him to HN front page.