Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IoT hacking and rickrolling my high school district

whitehoodhacker.net

Post reply on HN
Print view View original

171–180 of 399 posts

Re: IoT hacking and rickrolling my high school district

#171

Post by rhexs »

aerostable_slug wrote: post #132
dakna wrote: post #84

Earlier quoted context omitted.

And yet, there is overwhelming demand for what the government calls "cyber security". As a developer it is easy to get good at your craft by practicing and learning, how in the world is a security specialist able to practice without asking for permission or already having a job? A home lab setup? A college degree and formal education? I'm curious how people actually evaluate this career choice.

Capture The Flag challenges. You don't need much more than a terminal.

The leetcode of the security world! Thankfully not that bad...yet.

Re: IoT hacking and rickrolling my high school district

#172

Post by WhiteHoodHacker »

hnwd wrote: post #146

I'm interested to know how was he able to remote access to seemingly any machine in the network, from outside?

I had Chrome RDP access on a few machines setup earlier, since I could come in-person with my team for security competitions.

Re: IoT hacking and rickrolling my high school district

#173

Post by uudecoded »

dvtrn wrote: post #9
dmitrygr wrote: post #6

Many here, I am sure, got in trouble in high school for exposing security issues in school IT. So I imagine we're all very happy to see a sane response from school administration for once!

I got in trouble once in high school just for discovering and then using `net send` to send a message to my friend that said "Hi from lab 3". Computer lab access revoked for 6 weeks. Jokes on them, now I send socket messages to my friend that says "Hi from Chicago" and there's nothing they can do about it. My friend however keeps begging me to use this thing called 'email' because he claims he doesn't see the socket…

Sorry you got access revoked. I accidentally did a net send (via the GUI) to the whole district domain instead of my friend in AP CS that said "Time for break!" right before the snack break.

In my next class, the teacher was talking about "Time for break" virus going around... :/

This was after the district IT wanted to suspend me for setting up a Windows 2000 domain for the yearbook lab, so I kept my mouth shut.

Re: IoT hacking and rickrolling my high school district

#174

Post by kube-system »

ActorNightly wrote: post #140
mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

Id actually wonder if criminal history matters when you have skills like this that are very much in demand. If this went to court, the charges of malicious intent would likely not stick, so jailtime could likely be avoided in leu of fine/community service. Competent tech companies will not give a shit about criminal record of this nature. Expulsion from school is pretty much irrelevant, especially for CS careers. You…

It depends on how regulated the particular industry is. If you're building consumer web apps at a startup, it probably won't matter. If you want to be a government contractor, it's probably a nonstarter.

Re: IoT hacking and rickrolling my high school district

#175

Post by pascalxus »

mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

yeah, it's pretty messed up that there's such extremely heavy penalties for merely playing a youtube video on a few screens whereas looting and stealing go completely unpunished. what kind of message is that sending to our youth?

Re: IoT hacking and rickrolling my high school district

#176

Post by Buttons840 »

earksiinni wrote: post #100
jovial_cavalier wrote: post #97

Earlier quoted context omitted.

I graduated high school in 2015. I remember similarly poking around a network drive until I found a file in plaintext which contained everyone's student ID and whether or not they had a nut allergy (protected by HIPAA), for the bus system. I didn't think much of it, but some other students caught wind. Before I knew it, the superintendent threatened to have the police involved and press legal action for "hacking conf…

Wow. That's terrifying. And you didn't even run anything! I'm guessing that they never told you "don't browse this network drive"?

Never press F12 while browsing. Instant hacker.

Seriously, I found a state website that appeared to be exposing NPI about certain people in an API response. So much NPI nicely formatted in a JSON response. I closed the page and never touched it again. You know the state will declare me a dangerous and sophisticated hacker because I pressed F12 to open the developer tools, that's much easier than admiring they made a mistake.

Re: IoT hacking and rickrolling my high school district

#177

Post by guynamedloren »

chrisseaton wrote: post #169
guynamedloren wrote: post #168

Earlier quoted context omitted.

> Why do we tolerate pranks? Pranks can be an outlet for creativity and learning that might not otherwise happen. The post concludes with: > This has been one of the most remarkable experiences I ever had in high school and I thank everyone who helped support me. That's all and thanks for reading! I'm certain this kid learned so much working through the execution of this prank, and without being criminalized by the d…

> Pranks can be an outlet for creativity and learning that might not otherwise happen. Great. But do it with your own things then. Don't bother anyone else or touch anyone else's things. And no worker should ever have to do any work (such as reset a computer system) because of your prank. Workers have enough work to do and enough hassles in their lives.

> But do it with your own things then. Don't bother anyone else or touch anyone else's things.

You're really oversimplifying here. Something tells me this highschooler doesn't personally own the breadth of commercial equipment that he hacked for this prank.

> And no worker should ever have to do any work (such as reset a computer system) because of your prank. Workers have enough work to do and enough hassles in their lives.

Okay, let's all be worker robots :)

Re: IoT hacking and rickrolling my high school district

#178

Post by Accujack »

belval wrote: post #2

The fact that the administration didn't choose to sue them to oblivion is refreshing. I hope we'll see a trend in the future of educator being smart enough to admit that they made a mistake and to encourage the students to develop their talent. One can only hope.

I'm sure it helps a lot that they're in a high tax base area, and the quality of the educators hired probably reflects that.

https://statisticalatlas.com/school-district/Illinois/Townsh...

Re: IoT hacking and rickrolling my high school district

#179

Post by chrisseaton »

guynamedloren wrote: post #177
chrisseaton wrote: post #169

Earlier quoted context omitted.

> Pranks can be an outlet for creativity and learning that might not otherwise happen. Great. But do it with your own things then. Don't bother anyone else or touch anyone else's things. And no worker should ever have to do any work (such as reset a computer system) because of your prank. Workers have enough work to do and enough hassles in their lives.

> But do it with your own things then. Don't bother anyone else or touch anyone else's things. You're really oversimplifying here. Something tells me this highschooler doesn't personally own the breadth of commercial equipment that he hacked for this prank. > And no worker should ever have to do any work (such as reset a computer system) because of your prank. Workers have enough work to do and enough hassles in thei…

> Something tells me this highschooler doesn't personally own the breadth of commercial equipment that he hacked for this prank.

So they shouldn't have done it.

> Okay, let's all be worker robots :)

It's not about what you want to do. It's about what some low-paid worker who has to clean up after you thinks. Or some other student inconvenienced by your prank thinks.

If you're impacting on someone else's life then you're in the wrong!

Post reply on HN