Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IoT hacking and rickrolling my high school district

whitehoodhacker.net

Post reply on HN
Print view View original

131–140 of 399 posts

Re: IoT hacking and rickrolling my high school district

#131

Post by paxys »

rkk3 wrote: post #128
paxys wrote: post #125

Earlier quoted context omitted.

I don't understand this response. Having been on the wrong end of it you should be advocating harder than anyone to teach kids the complexities of cybersecurity law and ensure they can make the right decisions rather than throw away their future over a stupid prank. There is no "validation" happening here, the OP is just stating reality. Random high schoolers' rebellions aren't going to result in Congress overturning…

> ensure they can make the right decisions rather than throw away their future over a stupid prank. Is it a good system if a "stupid prank" can "throw away your future" ?

No it is not a good system. But nothing I said is invalid because of that.

Re: IoT hacking and rickrolling my high school district

#132

Post by aerostable_slug »

dakna wrote: post #84
jdkee wrote: post #64

Earlier quoted context omitted.

This post is 100% spot on. While the local school district may treat it as a prank, in the U.S. the federal authorities may not. To see how seriously the government takes this act, look at the penalties section of the relevant U.S. code. https://www.law.cornell.edu/uscode/text/18/1030

And yet, there is overwhelming demand for what the government calls "cyber security". As a developer it is easy to get good at your craft by practicing and learning, how in the world is a security specialist able to practice without asking for permission or already having a job? A home lab setup? A college degree and formal education? I'm curious how people actually evaluate this career choice.

Capture The Flag challenges. You don't need much more than a terminal.

Re: IoT hacking and rickrolling my high school district

#133

Post by klyrs »

aspenmayer wrote: post #102
CobrastanJorji wrote: post #86

Earlier quoted context omitted.

I remember back in high school we had this computer lab that was all locked down. Didn't allow opening the CD-ROM drives, only allowed certain educational websites, etc. I put a little remote access app on my share drive as a way to open my own CD drive, mostly just to see if I could do it. The school's computer guy came and found me and was like "hey, a file pinged as malware, what's up with that" and we had a fun d…

Your school didn’t have paperclips?

Can't get 'em through the metal detector. Gotta grind down a toothbrush on concrete these days...

Re: IoT hacking and rickrolling my high school district

#134

Post by skeaker »

rkk3 wrote: post #128
paxys wrote: post #125

Earlier quoted context omitted.

I don't understand this response. Having been on the wrong end of it you should be advocating harder than anyone to teach kids the complexities of cybersecurity law and ensure they can make the right decisions rather than throw away their future over a stupid prank. There is no "validation" happening here, the OP is just stating reality. Random high schoolers' rebellions aren't going to result in Congress overturning…

> ensure they can make the right decisions rather than throw away their future over a stupid prank. Is it a good system if a "stupid prank" can "throw away your future" ?

No, but that doesn't mean you should deliberately play into it.

Re: IoT hacking and rickrolling my high school district

#135

Post by outworlder »

mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

> because it sends the signal to other young aspiring cybersecurity professionals that this is OK,

There are multiple disclaimers in the text, almost every other paragraph.

Re: IoT hacking and rickrolling my high school district

#136

Post by orwin »

IshKebab wrote: post #30
bluedino wrote: post #4

Earlier quoted context omitted.

I'm glad to see a kid using bash and not something like gulp PowerShell

You're glad to see them using the ancient clusterfuck that is Bash, and not a modern relatively sane shell that is indisputably the most seminal shell in the last 30 years?

Nah, i actually used powershell before bash because i did a lot of android hacking stuff before learning to code. I worked with Powershell 3, powershell 4 and powershell 5. Powershell 3 was the most painfull thing to work with. No state accross session, the default were shit so i had to reconfigure more often than not. Slow, painfull, buggy... Around the same ime i learned how to bash pretty well in two days, use rsync, use ssh, use sed and awk... Powershell 3 was shit compared to this.

Then i used powershell4, i guess it was better but honestly i don't think i've used it very much. Powershell5 might be better than bash for 90% of the dev population though.

Re: IoT hacking and rickrolling my high school district

#137

Post by WarOnPrivacy »

Faaak wrote: post #76
mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

I agree, that feels wrong to me... When I was younger (~15) I also did some "fun" (aka stupid) stuff with the school computer network and in the end they got me and I received a "formal warning" (it was in France). In the end I'm glad for it because that scared me off and I never tried again on stuff that I don't own. But putting a kid in jail/having a criminal record seems way to excessive to me. Kids are dumb. And…

> But putting a kid in jail/having a criminal record seems way to excessive to me.

It absolutely is. Society is clearly harmed by laws like the CFAA.

LEO do like overly broad laws though. There's nothing better to ruin the lives of people that cops don't like.

Re: IoT hacking and rickrolling my high school district

#139

Post by drusepth »

jovial_cavalier wrote: post #97
earksiinni wrote: post #82

Serious question. What, if any, instruction do kids these days receive regarding what's allowed on computer systems? I remember in high school poking around a network drive until I found an executable with the name "SEND" in the name. I had a sense that it would send some kind of message somewhere, but I honestly didn't know where or to how many people. I was quite surprised when all the screens in our computer lab f…

I graduated high school in 2015. I remember similarly poking around a network drive until I found a file in plaintext which contained everyone's student ID and whether or not they had a nut allergy (protected by HIPAA), for the bus system. I didn't think much of it, but some other students caught wind. Before I knew it, the superintendent threatened to have the police involved and press legal action for "hacking conf…

Similar story: the dean of my "high school" [1] asked me to create our school website. Another student apparently poked around on a network drive and found an SQL dump of all the students' network username/passwords. I brought this file to the dean, told them it was available on a shared drive (so they could remove it), and asked if they'd like me to use it -- since I already had it -- to enable all the students to log in to the school website with their existing network usernames/passwords. They said that was a great idea and gave me the OK.

A week later, police escorted me from my dorm and both I and the other student were eventually expelled and threatened with harsh legal action, which never came.

[1] The "high school" was an early-entrance-to-college program where we started college at 16, lived on campus, took the normal freshman/sophomore college courses, and eventually received a high school diploma and an Associate of Science when we graduated at 18. The website was for the school I attended, but the SQL dump included all of the university students as well. The school has since shut down.

Re: IoT hacking and rickrolling my high school district

#140

Post by ActorNightly »

mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

Id actually wonder if criminal history matters when you have skills like this that are very much in demand.

If this went to court, the charges of malicious intent would likely not stick, so jailtime could likely be avoided in leu of fine/community service.

Competent tech companies will not give a shit about criminal record of this nature.

Expulsion from school is pretty much irrelevant, especially for CS careers. You can get a GED, find any college with CS program that will take your money, spend a year having fun, apply for an internship at a tech company, do a good job to be offered a return, talk to HR to go directly into entry level role, and you are set (have personally seen 2 cases of this happening with an intern).

The most functionally harmful thing would be monetary cost, which is still inconsequential considering the salary this guy would make.

Post reply on HN