Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IoT hacking and rickrolling my high school district

whitehoodhacker.net

Post reply on HN
Print view View original

221–230 of 399 posts

Re: IoT hacking and rickrolling my high school district

#221

Post by bfirsh »

WrtCdEvrydy wrote: post #214
bfirsh wrote: post #212

Earlier quoted context omitted.

Oh, yeah. That's a very good point. That's probably why it stopped working. I always thought the network admins pulled the plug assuming they'd been hacked.

That's a common issue with distributed systems. Something has to be "the leader" and you need a system for choosing a new one once the old one is offline for a certain amount of time. Add in a sprinkling of how to figure out if you have more than one leader active at a time.

Would it have needed leader election though? It's a stateless system. It might have been enough to ignore spoofed ARP replies, or to not attack machines of its own kind.

Re: IoT hacking and rickrolling my high school district

#222

Post by Stratoscope »

pfraze wrote: post #213
bfirsh wrote: post #103

Reminds of me my school leaving prank. I rewrote the whole internet on my school's computers. Google's logo became "Leavers '08", Facebook became "Hatebook" and was red, YouTube only played videos of cats, amongst other things. These were the days when nothing had SSL, so you could just intercept and rewrite traffic! My only requirement was: do no actual damage It was implemented as a Debian live CD that you could dr…

Used to be that Windows allowed programs to hook into each others’ event busses. (It might still, I’m not sure.) This might be why a few of my Highschool’s computers would interpret every 5th right click in minesweeper as a left click

Yup, you can still do that. AutoHotkey is a wonderful tool for this. You can intercept input events globally, and transform them or send completely different events to the target app.

For example, I use AutoHotkey to implement my JKLmouse program, which turns certain keyboard events into mouse movement for precise control. It's similar to the MouseKeys that comes with Windows, but made for laptop keyboards without numeric keypads.

And yes, you could definitely do that Minesweeper hack in AutoHotkey! :-)

https://www.autohotkey.com/

Re: IoT hacking and rickrolling my high school district

#223

Post by nutwit »

ubermonkey wrote: post #170

Three things are remarkable about this, and make it a happy story. First, that the pranksters were so egregiously responsible in the way they went about it. They avoided disrupting any actual educational activities; it was meant to be harmless fun, not vandalism. No harm came to anything here. Second, that they documented their findings to the administration as part of the action, including recommendations for improv…

The school district itself was relatively chill, however the individual deans freaked out. Because the penetration report was sent to the tech team and not the deans, the deans were intent on finding out exactly who did the hack to find something to report to their bosses (and according to them concern about the grade book system being exposed?? Not sure how you’re supposed to rick roll a grade book but if anyone has an idea i’d love to know). As the earliest poster of footage of this event, I actually got tracked down (despite the fact that the only information they had to go off of was my youtube channel which had no references to my actual name whatsoever) and interrogated about what I knew of the event by the dean. The penetration report had been sent a while prior to this (which I knew about, as being a sibling of the original blog poster can have many benefits) which made the entire thing so much funnier. I was thankful that masks were a requirement for in person students at the time, as my mouth was literally twitching the entire time during the interrogation.

Re: IoT hacking and rickrolling my high school district

#224

Post by Quessked73 »

Stratoscope wrote: post #222
pfraze wrote: post #213

Earlier quoted context omitted.

Used to be that Windows allowed programs to hook into each others’ event busses. (It might still, I’m not sure.) This might be why a few of my Highschool’s computers would interpret every 5th right click in minesweeper as a left click

Yup, you can still do that. AutoHotkey is a wonderful tool for this. You can intercept input events globally, and transform them or send completely different events to the target app. For example, I use AutoHotkey to implement my JKLmouse program, which turns certain keyboard events into mouse movement for precise control. It's similar to the MouseKeys that comes with Windows, but made for laptop keyboards without nu…

Would you mind sharing that script? I have been looking for something simmiliar, but didn't find anything that worked well and did not have the time yet to give it a try myself. I would really appreciate it.

Re: IoT hacking and rickrolling my high school district

#225

Post by AnIdiotOnTheNet »

munificent wrote: post #155
nielsbot wrote: post #17

Earlier quoted context omitted.

Probably helps that "We prepared complete documentation of everything we did, including recommendations to remediate the vulnerabilities we discovered. We went a comprehensive 26-page penetration test report to the D214 tech team and worked with them to help secure their network."

In many cases, a 26-page report documenting the incompetency of a team would not be taken kindly.

I find it annoying that people immediately assume incompetence and not inadequate staffing or conflicting priorities. I worked at a school district for a few years and we were woefully understaffed for what we had to cover. In situations like that you do what you have to so teachers can teach, move on to the next emergency, and hope like hell some self-important little shit doesn't burn everything to the ground.

Re: IoT hacking and rickrolling my high school district

#226

Post by snerbles »

jimt1234 wrote: post #206

Working in IT/tech for school district is the worst. My experience from many years ago - around 2002, I think: 1. First day on the job, email to boss: "Hey, the computer lab at Springfield High has a ton of known security flaws that are begging to be exploited." 2. Reply, 1 week later: "Sorry, we don't have any money for that. Just keep everything up-and-running." 3. 3 weeks later the computer lab at Springfield High…

> All the computers displayed a popup window

When I engaged in `net send` shenanigans at the local community college, at least the IT staff was smart enough to know where to scramble a runner whenever those dialog boxes popped up across campus.

"ALL YOUR BASE ARE BELONG TO US" was quite the meme then, but apparently they thought it was some form of cyber-terrorism.

Re: IoT hacking and rickrolling my high school district

#227

Post by Stratoscope »

Quessked73 wrote: post #224
Stratoscope wrote: post #222

Earlier quoted context omitted.

Yup, you can still do that. AutoHotkey is a wonderful tool for this. You can intercept input events globally, and transform them or send completely different events to the target app. For example, I use AutoHotkey to implement my JKLmouse program, which turns certain keyboard events into mouse movement for precise control. It's similar to the MouseKeys that comes with Windows, but made for laptop keyboards without nu…

Would you mind sharing that script? I have been looking for something simmiliar, but didn't find anything that worked well and did not have the time yet to give it a try myself. I would really appreciate it.

Sure. I didn't want to engage in self-promotion, but since you asked, here's the website and source code. There is an installer, but it's kind of old. I suggest installing AutoHotkey itself, then download the JKLmouse.ahk and JKLmouse.ico files from GitHub, and put a shortcut to the .ahk in your Startup folder.

https://www.jklmouse.com/

https://github.com/geary/jklmouse/tree/master/AutoHotkey/Sou...

One thing to note is that I wrote this to use on my ThinkPads, which have physical mouse buttons. On a laptop where the touchpad itself is the mouse button, it may be difficult to avoid nudging the mouse position when you click.

I've been thinking about adding support for using other keys as "mouse buttons", but haven't done anything about it yet.

Re: IoT hacking and rickrolling my high school district

#228

Post by dvtrn »

flatiron wrote: post #13
dvtrn wrote: post #9

Earlier quoted context omitted.

I got in trouble once in high school just for discovering and then using `net send` to send a message to my friend that said "Hi from lab 3". Computer lab access revoked for 6 weeks. Jokes on them, now I send socket messages to my friend that says "Hi from Chicago" and there's nothing they can do about it. My friend however keeps begging me to use this thing called 'email' because he claims he doesn't see the socket…

everyone in my school net send bombed everyone all the time. Im not sure how they didn't figure out how to just turn it off. but i remember you had to do it from a library computer, because it said who it sent it from. so you had to do a little drive by walking net send as you walked out of the library to not get caught

That was exactly how we used to do it, from where we used to do it, haha. Are you my friend? Rodrigo? How's the weather in Miami? How 'bout those 'Canes?

Re: IoT hacking and rickrolling my high school district

#229

Post by Waterluvian »

Angostura wrote: post #188
Waterluvian wrote: post #56

Earlier quoted context omitted.

Yep. What they did was wrong. And by doing so they threw themselves at the mercy of the entity they hacked. The refreshing part is that the entity did the morally right thing and showed mercy.

> What they did was wrong. It was certainly against the rules. I'm not so sure it was wrong.

If I broke into your home tonight to play a prank on you and then handed you a white paper about how to better secure it, how would you feel?
Post reply on HN