Nine-year-old kids are launching DDoS attacks against schools

>The initiative being rolled out by the NCA to over 2,000 primary and secondary schools in the UK, ahead of going live at further schools and colleges across the country, will see students who search for terms associated with cybercrime greeted with an access denied "block page."

Because telling adolescents that they aren't allowed to learn about something has an astounding success rate.

On the other hand, the schools should be thankful that some 9 year old children are exploiting their system rather than some state actor or the like. The 9 year old is unlikely to really do much damage, whereas the experienced hacker could do much worse.

In reality, the school systems are likely just really old/awful and need to be updated with some basic protections before something bad does happen. The school children should be encouraged to perform responsible disclosure and to request permission before testing something.

>But it's not just a warning for those who search for "stresser" and "booter" services which provide an easy way to launch a DDoS attack against a school's network.

I love articles that warn about the dangers of doing something while also providing a helpful starting point for those just now realizing that this was an option.

Ah yes, put all the blame the curious 9 year old, and none on the professionals paid to design and run the software...

I get that this is technically against the letter of the law, but I think the NCA's stance that this will lead to a life of crime is a gross overreaction. Investing more in the software would probably a better use of resources anyway.

ETA: Also, invest more in the kids! Likely, they're interested in programming and they have no way to learn about it except by becoming script kiddies. Don't tell them "NO!", offer CS classes or some such. I think I was lucky my high school offered AP computer science in this regard.

> discovered that the number of Distributed Denial of Service (DDoS) attacks launched against school networks and websites has more doubled from 2019 to 2020.

"More than doubled" could be from 1 in 2019 to 3 in 2020. The "study" that it links to [0] doesn't mentionhow many there were in 2019 or 2020. I'm really curious how many there actually were to roll this out nationwide in primary and secondary schools?

[0] https://www.nationalcrimeagency.gov.uk/news/rise-in-school-c...

> One theory is that youngsters can fall into denial-of-service attacks by firstly playing online games, and then falling into installing mods, hacks, and even remote access trojans to get the upperhand on their gaming rivals.

I don't think online games and mods are the gateway drug to a life of crime.

One of my kids would organize DOS of particular teachers. The teacher had to use a Mac/PC to control the classroom projector. Everyone had "fing" on their phones or tablets. Some fraction of the class would use "fing" to ping the teacher's laptop, shutting down use of the projector. This was at least 7 years ago.

I'll also note that there was one kid who always knew the firewall's password, within a few days of it changing. Never did figure out how that kid knew it so rapidly.

Reminds me of a reddit post where someone emailed a zip bomb to his teacher as a prank, took some system down, got charged with hacking and is now banned from accessing government computers in Canada.

It's similar to vandalism. To keep kids from messing around other places we lock the gate etc. These software systems are not locked.

Expect curious kids to try lots of things and push the limits. They do it all the time. In the overwhelming number of kids it does not lead to a life of crime.

My takeaway: Time to lock the gates.

The case studies make minor hacking sound like a job application.

After hacking the school IT systems Sam came to the attention of the police. As part of their engagement with the police, it was decided that Sam would benefit from education on the law through the Cyber Choices programme. They really engaged with the programme so they were offered work experience with a cybersecurity organisation. Whilst there they learnt how their skills could be put to good use and the type of damage their behaviour could have caused. At the end, Sam was offered a paid contract for 4 hours a week during the school term and up to 8 hours a week in school holidays.

https://nationalcrimeagency.gov.uk/what-we-do/crime-threats/...

Technology evolved, and we faced a change: Now it's easy to commit a crime through the internet!

We teach kids "you should not steal" but not "you should not launch DDoS." I think the latter should be equally educated.

When I was 9 years old I discovered bulletin board systems, and The Cuckoos Egg. Dare I say, the headline made me shake my head and smile…

Is it just me that found it interesting that they chose the image of a black kid for a DDOS/cyber crime story?

It would have been nicer if they had shown a bunch of kids of all races.

Note: I'm not black myself, just found that curious.

Hacking in some form (essentially being a script kiddie) isn't that difficult for a kid, especially if there is something to gain - bragging rights at least.

We got internet when I was 9. By the time I was 11 in the early 2000s, I was a full-blown script kiddie, scouring astalavista.box.sk for tools and scripts to hack anything that I could. I'd also hang on IRC. I thought hacking was the coolest thing ever, and took any opportunity to access anything forbidden or leave a silly signature anywhere. I didn't discriminate. It didn't matter that I had zero connection with any of these websites and services I 'hacked', I thought I was so cool.

Most of the stuff I did was simply following the instructions / tutorials, mostly Google dorking for strings in php files and using documented exploits. I never succeeded in any sort of targeted attack, and I lived in such a shithole that nothing important was online at the time, anyway. All of this was extremely low impact.

The only thing even remotely impressive about any of this was that I initially had very poor control of English. I was using a primitive, non-phraseological dictionary all the time, and somehow understood enough to actually apply some of the tutorials I read. People don't give kids enough credit for their determination and persistence, and kids have so much of free time to learn whatever they set their mind to.

Perhaps we should thank the script kiddies for irrefutably demonstrating that current networking and computing practices (and systems) are a house of cards.

Perhaps we should abandon some of the operations, engineering, and design practices that created said house of cards.

It's also rather amazing that there is apparently no warranty for clearly defective software, computing, or networking products and services, and that customers have no remedy when they are harmed by those defects.

From 1983 popular media, "War Games":

David Lightman, a bright but unmotivated Seattle high school student and hacker, uses his IMSAI 8080 computer to access the school district's computer system and change his grades. He does the same for his friend and classmate Jennifer Mack.

https://en.wikipedia.org/wiki/WarGames

I am firmly rooting for the kids here.

Good old remembering the days of LOIC.

It seems like those entities that are supposed to be protecting our security, are investing more of their resources into finding ways to monitor people in hopes of detecting that they're trying to do bad things. Working on helping to actually harden our network infrastructure takes a back seat.

We finally have a remote learning equivalent of pulling the fire alarm to get out of class

Clickbait title. I hoped for an actual story of a nine-year-old kid who pulled this off.

When i setup my kid to do DDOS -- first things first, you need good fiber.

Like the teachers' union.

the embarrassment here is that the education system can't mitigate against an attack so basic a 9yo can launch it, this isn't some targeted l7 flood from a huge botnet

So with other word, schools cyber security is garbage?

A bit unrelated but I’m so tired of fake intellectual stuff like this. Once you recognize it you see it everywhere. A bunch of “intellectuals” who don’t really do anything more than collect a bunch of stories like this — not because they are intellectually interesting or because they are a part of some larger scholarly effort but simply because they are silly/contrarian. If the point of the work can be summed up in a meme headline then it’s just noise. That’s 99% of what passes through here and the rest of the internet.

What it means to be a scholar is to engage in those things that are not supported at all by hardware acceleration in the brain but yield fruit at the end of the day. This is what separates scholars from everyone else, the scholars are so excited by the idea and the vision at the end of that boring tunnel that they can withstand the tedium. But the rest of us like to giggle at 9 year olds ddosing a school. Wow, how did they even do that? Amazing!

It’s so embarrassing to see someone who’s whole model of the world is basically built out surprising/clickbait headlines cobbled together… which is almost invariably a kind of teenage angst dystopian version of the world.