Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IoT hacking and rickrolling my high school district

whitehoodhacker.net

Post reply on HN
Print view View original

111–120 of 399 posts

Re: IoT hacking and rickrolling my high school district

#111

Post by nucleardog »

bellyfullofbac wrote: post #80
mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

Ah, 2021, such sad times, where we squash our creativities in fear of the police, where you'd think twice before doing something like one of the MIT hacks http://hacks.mit.edu ... I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting. I wonder if it was p…

> I wonder if it was possible for the hacker to ask a lawyer to represent them anonymously and make a contract, something like the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money...

Criminal charges are generally filed by the prosecutor. They'll generally follow the wishes of the victim, but are not required to (think, e.g., domestic violence cases). There is absolutely zero the school can do to guarantee that you won't be charged if the prosecutor does catch wind of the incident and decides to make an example of you.

Re: IoT hacking and rickrolling my high school district

#112

Post by hparadiz »

mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

Posts like yours validate the insane over criminalization of what essentially amounts to a prank. I had literally the exact same experience in high school. Got expelled and had to get a GED. They could have easily pressed charges.

Part of the issue is people like you who advocate for respecting "the system" and essentially scaring kids into not doing anything. Except that simply re-enforces the draconian laws that are currently in place. If more kids rebelled and this was a regular occurrence it would help to desensitize society to digital pranks instead of always treating these kids like terrorists.

Re: IoT hacking and rickrolling my high school district

#113

Post by azinman2 »

Reminds me lightly of when I was in high school, email was fairly new -- especially at a school. My friend at a fancy private school had a Linux machine to access, and she really wanted to know what someone else had said about her. I managed to script kiddy my way in leveraging her existing shell login, got root, and read the email. What I didn't realize was that my .history file contained everything I had done. Eventually the sysadmin wrote me an email saying he knew what was going on and wanted to meet up, stating 'he wouldn't cuff me' and that he was 'a chill dude'. I was obviously scared, deleted everything, and tried to pretend nothing ever had happened.

Luckily no one got in trouble (meaning me or my friend). Not so sure this would happen in 2021.

Re: IoT hacking and rickrolling my high school district

#114

Post by 35fbe7d3d5b9 »

jovial_cavalier wrote: post #97
earksiinni wrote: post #82

Serious question. What, if any, instruction do kids these days receive regarding what's allowed on computer systems? I remember in high school poking around a network drive until I found an executable with the name "SEND" in the name. I had a sense that it would send some kind of message somewhere, but I honestly didn't know where or to how many people. I was quite surprised when all the screens in our computer lab f…

I graduated high school in 2015. I remember similarly poking around a network drive until I found a file in plaintext which contained everyone's student ID and whether or not they had a nut allergy (protected by HIPAA), for the bus system. I didn't think much of it, but some other students caught wind. Before I knew it, the superintendent threatened to have the police involved and press legal action for "hacking conf…

> whether or not they had a nut allergy (protected by HIPAA)

Personal pet peeve:

Your high school is not a covered entity and is not acting as a business associate of a covered entity. HIPAA does not apply. They are free to keep a plaintext file with your name, nut allergies, COVID vaccination status, and anything else they want to put in there - without HIPAA entering into the discussion.

FERPA could apply, but I don't know much about that.

Re: IoT hacking and rickrolling my high school district

#115

Post by mdip »

Mizza wrote: post #88
mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

I know somebody - I think they post here, hi! - who ended up in "weekend jail" with a conviction for sharing a school's WiFi password without permission. I also once got reprimanded for writing a blog post not too dissimilar to this one at a less sympathetic school. I also remember the joy of hiding a server in the ceiling of our school so we could play UT2K3 on the library computers before that exploded similarly. A…

Every district is different, heck -- every school within a district can be different in extreme discipline like this. Frankly, the size of his district represented a lot of risk; those often have the policies with the least wiggle-room -- like "Weekend Jail for Sharing a WiFi password" (insane).

At the school my child attends, I am confident he would have ended up with a pat on the back if the circumstances were similar. I can't speak for the district -- I'd be willing to bet that'd be very risky. At the school I had once attended, I'd expect the entire district would behave similarly. I'm sure there were people within the district administration that wanted to throw the book at the kids involved.

Here's the thing for those people: the last thing a school district wants is to become national news for punishing a bunch of kids who the evening news can make out to look like "Geniuses". Since nothing failed in their plan -- that's crazy important -- there would be very few ways to frame the story that makes the administration look like anything but bullies, and many will frame them as "petty bullies". I have a friend I went to High School with who is now a High School principal. He's still "that guy I went to High School with." I have no doubt he would have given the kids an award privately, if not publicly.

It's sad that some public school districts are using discipline approaches you'd expect to see in prisons, rather than a school, and I'm sure in certain places in the country, that might be a necessity. Context matters, too -- were these kids who were constantly pulling pranks like this, had been talked to in the past/impacted things in the past, etc, I'd expect a harsh response: "Yes, we get it, you're smart, stop breaking things already, read the horrors of the 1986 CFAA because that's coming if it happens again." I'm guessing these were otherwise good students.

Re: IoT hacking and rickrolling my high school district

#116

Post by jfk13 »

CobrastanJorji wrote: post #86
mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

I remember back in high school we had this computer lab that was all locked down. Didn't allow opening the CD-ROM drives, only allowed certain educational websites, etc. I put a little remote access app on my share drive as a way to open my own CD drive, mostly just to see if I could do it. The school's computer guy came and found me and was like "hey, a file pinged as malware, what's up with that" and we had a fun d…

Ah, you young whippersnappers with your labs and networks and CDs... my high school just got one Commodore PET, that was "the school computer" in my day.

Fortunately, I got on well with the math teacher who had charge of it, and he'd let me take it home over the weekends. Those were the days...

Re: IoT hacking and rickrolling my high school district

#117

Post by tertius »

hparadiz wrote: post #112
mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

Posts like yours validate the insane over criminalization of what essentially amounts to a prank. I had literally the exact same experience in high school. Got expelled and had to get a GED. They could have easily pressed charges. Part of the issue is people like you who advocate for respecting "the system" and essentially scaring kids into not doing anything. Except that simply re-enforces the draconian laws that ar…

Probably better to try and reform the law instead of suggest children break the law and ruin their lives.

Re: IoT hacking and rickrolling my high school district

#118

Post by noodlesUK »

nucleardog wrote: post #111
bellyfullofbac wrote: post #80

Earlier quoted context omitted.

Ah, 2021, such sad times, where we squash our creativities in fear of the police, where you'd think twice before doing something like one of the MIT hacks http://hacks.mit.edu ... I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting. I wonder if it was p…

> I wonder if it was possible for the hacker to ask a lawyer to represent them anonymously and make a contract, something like the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money... Criminal charges are generally filed by the prosecutor. They'll generally follow the wishes of the victim, but are not required to (think, e.g., domestic violence cases).…

This is generally true, but the CFAA is obviously not violated by access which is authorised. In this case, you could simply draw up a pentest agreement and get them to say any such activity would be authorised.

Re: IoT hacking and rickrolling my high school district

#119

Post by duped »

paxys wrote: post #87
duped wrote: post #79

Do prosecutors need consent from victims to file charges in cases like this? Also if you're going to commit a crime and brag about it, don't say "hey well they would point the finger at me anyway and I'm not going to name my partners." You've just told them there are coconspirators, and you don't have a right not to incriminate others.

They don't legally need it, but such cases are pretty much dead in court without the victim's cooperation so the prosecution will almost always drop it.

What happens when the suspect publicly admits to doing it and providing detailed information on the motive and means

Re: IoT hacking and rickrolling my high school district

#120

Post by paxys »

whimsicalism wrote: post #92
bellyfullofbac wrote: post #80

Earlier quoted context omitted.

Ah, 2021, such sad times, where we squash our creativities in fear of the police, where you'd think twice before doing something like one of the MIT hacks http://hacks.mit.edu ... I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting. I wonder if it was p…

> I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting. If you read TFA, that is effectively what happened. Even with the guarantee, only one of them revealed themselves.

No point in pulling off a complicated prank without enjoying the notoriety gained from it.
Post reply on HN