Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IoT hacking and rickrolling my high school district

whitehoodhacker.net

Post reply on HN
Print view View original

41–50 of 399 posts

Re: IoT hacking and rickrolling my high school district

#41

Post by treesknees »

IshKebab wrote: post #26
nielsbot wrote: post #17

Earlier quoted context omitted.

Probably helps that "We prepared complete documentation of everything we did, including recommendations to remediate the vulnerabilities we discovered. We went a comprehensive 26-page penetration test report to the D214 tech team and worked with them to help secure their network."

That hasn't helped in the past. Frankly I think they were naive to reveal themselves no matter what the authorities said. It hasn't gone nearly as well for other people.

The students were extremely lucky.

The advice given to me in high school (I was working on tech projects after school for several teachers and groups) was to not even try or explore poking around the IT networks it no matter how good my intentions were. All it takes is one grumpy school administrator to feel undermined or to misunderstand your report and you could be expelled.

When you're in a position like a student, you're still working your way up and building credibility. No need to risk it all for an IT group that doesn't want your security advice and didn't ask for your help.

Re: IoT hacking and rickrolling my high school district

#42

Post by 63 »

IshKebab wrote: post #26
nielsbot wrote: post #17

Earlier quoted context omitted.

Probably helps that "We prepared complete documentation of everything we did, including recommendations to remediate the vulnerabilities we discovered. We went a comprehensive 26-page penetration test report to the D214 tech team and worked with them to help secure their network."

That hasn't helped in the past. Frankly I think they were naive to reveal themselves no matter what the authorities said. It hasn't gone nearly as well for other people.

He addresses this pretty well in the post imo. His co-conspiritors remained unnamed while he alone revealed himself because he wanted to publish this post and it's highly likely he would've been blamed anyway.

Re: IoT hacking and rickrolling my high school district

#45

Post by sodality2 »

I told my district that I could change my race at-will via a hidden form on the profile page. I changed it to "Purple". Got a call back from some IT guy telling me I accessed their computer without authorization, and that if it happened again, they'd press charges. I asked to be put through to the IT administrator, and he laughed and told me don't worry about it... Sometimes, they can handle it well. Very glad they did for you as well :)

Re: IoT hacking and rickrolling my high school district

#46

Post by mrexroad »

_wldu wrote: post #8
belval wrote: post #2

The fact that the administration didn't choose to sue them to oblivion is refreshing. I hope we'll see a trend in the future of educator being smart enough to admit that they made a mistake and to encourage the students to develop their talent. One can only hope.

Being a minor probably helps. There are so many laws today. It's too risky to do this. It's not like it was 25 years ago.

25 years ago wasn’t any better… I recall several in my circle getting suspended for harmless things. The lesson: don’t explore, don’t be curious, and don’t try to fix anything related to the school and computers. Sigh.

Re: IoT hacking and rickrolling my high school district

#47

Post by dont__panic »

IshKebab wrote: post #26
nielsbot wrote: post #17

Earlier quoted context omitted.

Probably helps that "We prepared complete documentation of everything we did, including recommendations to remediate the vulnerabilities we discovered. We went a comprehensive 26-page penetration test report to the D214 tech team and worked with them to help secure their network."

That hasn't helped in the past. Frankly I think they were naive to reveal themselves no matter what the authorities said. It hasn't gone nearly as well for other people.

The poster/hacker actually addresses this -- he doesn't reveal himself until after graduation, keeps his fellow hackers secret still, and mentions that he was most likely the prime suspect in the district anyway. Seems like a fair tradeoff if he wanted to make this blog post, though school districts could be nasty and litigious, I guess.

Re: IoT hacking and rickrolling my high school district

#48

Post by the-dude »

arenaninja wrote: post #35
flatiron wrote: post #11

Earlier quoted context omitted.

I was suspended for a week for creating a network share in my typing class and dividing the work among my friends and we copied and pasted into a single document on the share. This was on Windows NT though so a LONG time ago. It's also I guess "cheating". But they got us on "computer hacking"

Also in my typing class circa 2004 the teacher was about to kick me out because he thought I was on a chat room during his class. I was actually viewing page source on an HTML document

You were hacking a website

Re: IoT hacking and rickrolling my high school district

#49

Post by adventured »

treesknees wrote: post #41
IshKebab wrote: post #26

Earlier quoted context omitted.

That hasn't helped in the past. Frankly I think they were naive to reveal themselves no matter what the authorities said. It hasn't gone nearly as well for other people.

The students were extremely lucky. The advice given to me in high school (I was working on tech projects after school for several teachers and groups) was to not even try or explore poking around the IT networks it no matter how good my intentions were. All it takes is one grumpy school administrator to feel undermined or to misunderstand your report and you could be expelled. When you're in a position like a student…

It's always fascinating how dramatically different schools can be. When I was in high school, in the late 1990s, nobody would have cared so much about something along these lines. At worst it would have resulted in a three day suspension from school and lecture from the principle.

Re: IoT hacking and rickrolling my high school district

#50

Post by unethical_ban »

jdmichal wrote: post #31
securiTee wrote: post #14

Neat story, and this is clearly harmless. But isn't the most basic, fundamental, number one rule of security/pen testing to try to break into a system (no matter how weak) if and only if you've been given clearance beforehand? Why doesn't that hold here?

The author literally put in TWO disclaimers making that exact point...

I think the OP is asking "Why are we applauding them if they broke the rules?". The answer is "Sometimes, people break the rules".
Post reply on HN