Live data from Hacker News

IoT hacking and rickrolling my high school district

whitehoodhacker.net

381–390 of 399 posts

Re: IoT hacking and rickrolling my high school district

#381

I feel so dumb when I read kids doing these things. Back in High School all I knew was how I could run arbitrary executable files by renaming them to calc.exe. We also did the classic "take a screenshot of the desktop, set it as the wallpaper, then remove all icons and the start menu" thing.

back in middle school we would just use proxys to play online games on the library that were regularly blocked

Re: IoT hacking and rickrolling my high school district

#382
post #298

Earlier quoted context omitted.

O mannn I was suspended from HS, and banned for 2 years from touching school computers for net send shenanigans as I wasn't smart enough to cloak the originating workstation. My message to every single computer in our HS: "Hey what's up!" my friend added to this: "Your network (H:/) drive is being deleted." School administrators and teachers did not find this funny.

> and banned for 2 years from touching school computers for net send shenanigans Ha, yeah I got banned for using net send as an IM app with friends too. There were a couple of us in my school who were skilled, enthusiastic programmers - it is kinda stupid that the punishment they decided on was to prevent us from being educated :-/

A computer teacher once threatened to kick me out of class for reading the help file, obviously because they were annoyed I knew more than they did.

*HELP. on a BBC Master

Re: IoT hacking and rickrolling my high school district

#383

Earlier quoted context omitted.

I haven’t thought of net send in years. Circa 2000 I worked at Cisco and added some javascript to my profile in the corporate directory that sent me a net send message with the hostname of the computer that viewed my profile. At that time the hostname usually included the employees username, so I had a nice heads up that somebody was looking me up. I should have left it at that, but Ingot cheeky and also did a net se…

Curious how you escaped a (browser?) With JS to do "native" net send? Assume it was some activeX?

I don’t remember the details, but based on my skill level I know it wasn’t anything novel. At the time I was learning my first programming language, Perl. IIRC I had a Perl daemon running on my computer that accepted an http request, did a reverse dns on the origin and sent the hostname in a net send message. Some of my coworkers used Sun workstations. I could get notifications from them but obviously couldn’t send them a net send message in response.

Re: IoT hacking and rickrolling my high school district

#384

Earlier quoted context omitted.

The students were extremely lucky. The advice given to me in high school (I was working on tech projects after school for several teachers and groups) was to not even try or explore poking around the IT networks it no matter how good my intentions were. All it takes is one grumpy school administrator to feel undermined or to misunderstand your report and you could be expelled. When you're in a position like a student…

He had already graduated, so expulsion wasn't an option.

He had already graduated when he wrote his blog post and told them, he was still a student when he performed the hacking.

I realize this is conjecture but I'm giving an example. Speaking from experience receiving "security reports" from users and students, often times they fail to understand the full picture of IT. As a student with no buy-in from the stakeholders, the risk isn't worth it.

For example, let's say this IoT network was managed by a vendor who, while having sloppy configuration practices, also had network monitoring looking for APT/anomalies (such as new connections in off-hours or unusual connection rates or bandwidth usage.)

While the student thinks they're being sneaky and hacking the system at night, opening ssh connections to a hundred devices from his laptop, there are now reports and alarms going off on a monitoring system. Some basic timestamps and VPN access logs would be enough to point to the student. So this student thinks they're creating an anonymous harmless prank, but the IT department is already investigating a malicious actor on their network. How do you think this would end?

Re: IoT hacking and rickrolling my high school district

#385

Earlier quoted context omitted.

> All the computers displayed a popup window When I engaged in `net send` shenanigans at the local community college, at least the IT staff was smart enough to know where to scramble a runner whenever those dialog boxes popped up across campus. "ALL YOUR BASE ARE BELONG TO US" was quite the meme then, but apparently they thought it was some form of cyber-terrorism.

O mannn I was suspended from HS, and banned for 2 years from touching school computers for net send shenanigans as I wasn't smart enough to cloak the originating workstation. My message to every single computer in our HS: "Hey what's up!" my friend added to this: "Your network (H:/) drive is being deleted." School administrators and teachers did not find this funny.

At a place I used to work, there was a lady who would prank folks. She was not very technical.

Those folks came to me with a request for some sort of Net Send revenge.

I wrote a VB script which ran in a loop, which randomly 8-10 times a day would get a new message from the BOFH excuse generator and net send it.

Ahh, youth.

Re: IoT hacking and rickrolling my high school district

#386
Much less exciting, but when I was in high school I discovered an unsecured messaging service that could be accessed via a Web interface. This included the ability to send messages to any user logged in to any machine. And also the ability to broadcast messages to all machines in the school. I was never bold enough to test this feature but word got around after I showed a few friends and eventually someone decided to broadcast a rather crude message about our principal. One thing this student didn't realize is that all messages are logged and the sender was easily found and disciplined.

It could have been a lot of fun if schools in the early 2000s were as well-connected as they seem to be now. We were still working with overhead projectors at the time.

Re: IoT hacking and rickrolling my high school district

#387

Earlier quoted context omitted.

I 'worked' for my own high school's IT dept, a few hours a week, as a student. It was an amazing experience working with those guys. I learned so many things, from how to punch, terminate, and run cables to how to set up a Ghost image and deploy it en masse across the district. One day one of the old macs was showing the frowny face in a in-session classroom. Boss sent me down there with specific instructions: "pull…

I believe the term for this is ‘percussive maintenance’

American components, Russian components, all made in Taiwan!

Re: IoT hacking and rickrolling my high school district

#388
post #243

> With that said, what we did was very illegal, and other administrations may have pressed charges. We are grateful that the D214 administration was so understanding. Note well that the victim of a crime does not get any say in whether or not a prosecutor prosecutes a crime. "Pressing charges" is a myth. The prosecutor decides. Period.

The probability of a prosecutor filing charges decreases significantly if the victim does not want a case to go forward, and even more if they actively do not want to cooperate with the court case.

Re: IoT hacking and rickrolling my high school district

#389

We figured out that our computer class had a few computers infected by the Ambulance virus[0]. So of course we intentionally infected all the computers with it =) On the other hand me and a few of my friends were the only computer literate people in the school and were tasked with removing it in the end. But still, it was fun seeing a whole class of computers have an ambulance run at the bottom of the screen with the…

Earlier versions of Intel Management Engine used ARC core. It is somewhat funny to see Intel licensing third-party CPU IP core to use in their CPUs of all the things…

Re: IoT hacking and rickrolling my high school district

#390

Earlier quoted context omitted.

I haven’t thought of net send in years. Circa 2000 I worked at Cisco and added some javascript to my profile in the corporate directory that sent me a net send message with the hostname of the computer that viewed my profile. At that time the hostname usually included the employees username, so I had a nice heads up that somebody was looking me up. I should have left it at that, but Ingot cheeky and also did a net se…

Curious how you escaped a (browser?) With JS to do "native" net send? Assume it was some activeX?

IE supported vbscript, though I don't know how far back that goes. You can certainly run arbitrary commands from jscript or vbscript using an hta app (or wscript)
Post reply on HN