Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IoT hacking and rickrolling my high school district

whitehoodhacker.net

Post reply on HN
Print view View original

91–100 of 399 posts

Re: IoT hacking and rickrolling my high school district

#91

Post by dec0dedab0de »

mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

Anyone in the field will tell you that this is an absolute disaster of a post because it sends the signal to other young aspiring cybersecurity professionals that this is OK, and the school will laugh it off, and you'll be seen as an adorable Matthew Broderick type Wargames character. I can't overemphasize how far this is from the truth in 2021.

Or maybe it will shame other IT departments into not having a stick up their butt. Especially if there is already a culture of overlooking minor criminal activity in the name of harmless pranks.

Re: IoT hacking and rickrolling my high school district

#92

Post by whimsicalism »

bellyfullofbac wrote: post #80
mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

Ah, 2021, such sad times, where we squash our creativities in fear of the police, where you'd think twice before doing something like one of the MIT hacks http://hacks.mit.edu ... I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting. I wonder if it was p…

> I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting.

If you read TFA, that is effectively what happened. Even with the guarantee, only one of them revealed themselves.

Re: IoT hacking and rickrolling my high school district

#94

Post by generalizations »

duped wrote: post #66
dont__panic wrote: post #47

Earlier quoted context omitted.

The poster/hacker actually addresses this -- he doesn't reveal himself until after graduation, keeps his fellow hackers secret still, and mentions that he was most likely the prime suspect in the district anyway. Seems like a fair tradeoff if he wanted to make this blog post, though school districts could be nasty and litigious, I guess.

It's still a terrible idea to admit to committing a crime under your real name before the statute of limitations has run out

Is there even a statute of limitations for this kind of thing? Seems way better to just never admit to it at all.

Re: IoT hacking and rickrolling my high school district

#95

Post by colinmhayes »

treesknees wrote: post #41
IshKebab wrote: post #26

Earlier quoted context omitted.

That hasn't helped in the past. Frankly I think they were naive to reveal themselves no matter what the authorities said. It hasn't gone nearly as well for other people.

The students were extremely lucky. The advice given to me in high school (I was working on tech projects after school for several teachers and groups) was to not even try or explore poking around the IT networks it no matter how good my intentions were. All it takes is one grumpy school administrator to feel undermined or to misunderstand your report and you could be expelled. When you're in a position like a student…

He had already graduated, so expulsion wasn't an option.

Re: IoT hacking and rickrolling my high school district

#97

Post by jovial_cavalier »

earksiinni wrote: post #82

Serious question. What, if any, instruction do kids these days receive regarding what's allowed on computer systems? I remember in high school poking around a network drive until I found an executable with the name "SEND" in the name. I had a sense that it would send some kind of message somewhere, but I honestly didn't know where or to how many people. I was quite surprised when all the screens in our computer lab f…

I graduated high school in 2015. I remember similarly poking around a network drive until I found a file in plaintext which contained everyone's student ID and whether or not they had a nut allergy (protected by HIPAA), for the bus system.

I didn't think much of it, but some other students caught wind. Before I knew it, the superintendent threatened to have the police involved and press legal action for "hacking confidential student data."

It's CYA all the way, usually at the expense of the person in the chain least equipped to cover their ass (the student).

Re: IoT hacking and rickrolling my high school district

#98

Post by jjoonathan »

mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

Gross but true. The administration has every incentive and opportunity to spin this into a self-serving story about taking down evil sinister hackers -- and maybe scapegoat a few unrelated problems while they are at it.

I am delighted that these admins had the character to resist the perverse incentives of the system.

Re: IoT hacking and rickrolling my high school district

#99

Post by EvanAnderson »

paxys wrote: post #87
duped wrote: post #79

Do prosecutors need consent from victims to file charges in cases like this? Also if you're going to commit a crime and brag about it, don't say "hey well they would point the finger at me anyway and I'm not going to name my partners." You've just told them there are coconspirators, and you don't have a right not to incriminate others.

They don't legally need it, but such cases are pretty much dead in court without the victim's cooperation so the prosecution will almost always drop it.

The Aaron Swartz prosecution continued, even after MIT and JSTOR said they didn't want to press charges, because of a zealous prosecutor.

Re: IoT hacking and rickrolling my high school district

#100

Post by earksiinni »

jovial_cavalier wrote: post #97
earksiinni wrote: post #82

Serious question. What, if any, instruction do kids these days receive regarding what's allowed on computer systems? I remember in high school poking around a network drive until I found an executable with the name "SEND" in the name. I had a sense that it would send some kind of message somewhere, but I honestly didn't know where or to how many people. I was quite surprised when all the screens in our computer lab f…

I graduated high school in 2015. I remember similarly poking around a network drive until I found a file in plaintext which contained everyone's student ID and whether or not they had a nut allergy (protected by HIPAA), for the bus system. I didn't think much of it, but some other students caught wind. Before I knew it, the superintendent threatened to have the police involved and press legal action for "hacking conf…

Wow. That's terrifying. And you didn't even run anything!

I'm guessing that they never told you "don't browse this network drive"?

Post reply on HN