They Hacked Their School District When They Were 12

So close to my own memories! Back in Sydney the mid 90s at perhaps 15 I reconfigured a modem to allow for dial-in then explored the regional network of the NSW education department remotely in the evenings. The machine was intended to serve code, which we set up for diskless network boot and distributed games like Quake for network deathmatch (we also wrote our own from scratch, eg. we had a nibbles.bas hacking competition where we modified multiplayer single keyboard versions to add features ... I recall flamethrowers, mines and lasers). We also used to play crobots. I stopped exploring the network after teachers started perplexingly asking questions if anyone was in the school computer room later in the evening. Similar to the subject of this story, it was really just curiosity, and I was also later offered a job with an ISP as a result of the control obtained, where I made my first RIP advert mistake, learned to tar to and from tape, and other such fun. Also managed to intern at Fuji-Xerox where the Unix admin department had me learn bash scripting, walked me through cabling and network topology management techniques and I got to self-educate through a broad range of Cisco online learning courses. Fun times. Years later used essentially that body of knowledge to design and operate substantial Linux clusters. I have worked in many continents in areas as diverse as embedded, clustering, mobile, digital video, finance, and now run a robotics company in China. At the time I recall I just hungered for knowledge and wanted nothing more than a teacher to point the way to new areas. One of the accidental teachers who popped up on my periphery was Julian Assange, whose strobe got me in to protocol analysis and much reading of RFCs which resulted in announcing ~1999 many discoveries of undisclosed remote OS detection techniques across protocols like ICMP, IGMP, and even ARP. I've since written a few internet standards drafts of my own. Key insight for kids in these spaces ... it's harder to create a system and defend it than to find holes in them. The parents are correct to encourage building versus breaking. Breaking is very important also, however, but should ideally be encouraged with a parallel focus on professional ethical development and perhaps anthropological/philosophical insights as a personal frame of reference in to the established national/educational/legal bureaucracies who may otherwise seek to spurn talented and unique individuals such as these.

At the ETS in Amsterdam the system was set up in such a way that you only got so many compute seconds per schoolyear. I spent nearly all my budget defeating the accounting system so I could have unlimited computer access. That and drafting classes were the few interesting things in that school, the remainder was very basic electro technical and electronics stuff.

If you're referring to the boys, they found a sticky note on a guard's laptop containing the login details.

For general cctv, many are installed to allow monitoring while away from the house. Nanny cams for example.

Installing cctv to an existing network will put it online automatically.

The most important issue to consider is these devices - routers, cameras, alarms, locks... come with default passwords. And almost no one changes them. So anyone who knows which port (Shodan search engine, port scanner) to look has a high chance of getting entry.

I first profiled the story of one of the two boys at https://k12cybersecure.com/blog/moths-to-a-flame/. AMA.

Is it just me or does the story inexplicably blow up the boys tech proficiencies and then almost casually mentions that all they did was log in to school computers with credentials from a post-it on the machine itself in a public space?

How are they at fault if said credentials grants them access to unprotected sensitive records and an obviously badly exposed administration system?