Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IoT hacking and rickrolling my high school district

whitehoodhacker.net

Post reply on HN
Print view View original

151–160 of 399 posts

Re: IoT hacking and rickrolling my high school district

#151

Post by cwkoss »

tkinom wrote: post #110
mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

For anyone who like to hack legally and ethically, check out https://www.hackerone.com/ . If you're very good at hacking devices, software, networks, etc, companies will pay bounties for the vulnerabilities you find thru HackerOne. Looks like they paid out millions in bounty in 2020: https://www.zdnet.com/article/hackerones-2020-top-10-public-bug-bounty-programs/

Worth a try, but I didn't have a good experience with it.

Companies can mark items as duplicates without fixing the underlying bug for an indefinite period of time. So the 3 vulnerabilities I found all got marked as duplicates without any compensation or even acknowledgement of my time writing up the issues. Felt like a complete waste of time.

If you're great, you can probably find novel stuff better than I was able to, but if you're that great you likely already have plenty of employment opportunities.

Re: IoT hacking and rickrolling my high school district

#152

Post by lxe »

In 2001, in 7th grade at the beginning of my web dev "career", so to speak, I made a website that looked exactly like our school district's "snow day" school closure and delay page -- and I allowed anyone to edit the message. I told a few kids about this -- it was a pinnacle of my PHP prowess back then.

Got called into an office -- a gifted program administration, not the regular school office. I think one of the teachers there caught wind of my cool little trick, and asked me to take it down right then and there. I was terrified, as I wasn't really someone to get into any sort of trouble. I was able to take it down through their machine's windows explorer's FTP access.

Now I realize that this teacher probably saved me from a lot of trouble. I wish these sort of stories were the norm -- where educators welcome the natural curiosity instead of throwing the law at kids who dare to think outside the box.

Re: IoT hacking and rickrolling my high school district

#153

Post by petesergeant »

nucleardog wrote: post #111
bellyfullofbac wrote: post #80

Earlier quoted context omitted.

Ah, 2021, such sad times, where we squash our creativities in fear of the police, where you'd think twice before doing something like one of the MIT hacks http://hacks.mit.edu ... I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting. I wonder if it was p…

> I wonder if it was possible for the hacker to ask a lawyer to represent them anonymously and make a contract, something like the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money... Criminal charges are generally filed by the prosecutor. They'll generally follow the wishes of the victim, but are not required to (think, e.g., domestic violence cases).…

My understanding is that in America, prosecutors are often political appointees without much institutional oversight, as compared to being a reasonably dull civil service department who have to justify prosecutions as being in the public interest

Re: IoT hacking and rickrolling my high school district

#154

Post by restingrobot »

hparadiz wrote: post #112
mmaunder wrote: post #61

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record. This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any respo…

Posts like yours validate the insane over criminalization of what essentially amounts to a prank. I had literally the exact same experience in high school. Got expelled and had to get a GED. They could have easily pressed charges. Part of the issue is people like you who advocate for respecting "the system" and essentially scaring kids into not doing anything. Except that simply re-enforces the draconian laws that ar…

We need to have harsh penalties for this. People who don't understand the complex systems they were able to access, might introduce vulnerabilities that more malicious entities can exploit. An example of this would be a student at a university accessing internal network from a physical terminal in a building, (intranet), and accidentally disabling a firewall, (say to play a video from a remote location). In doing so, its no longer just a prank as they may have exposed the entire internal network to outside internet.

This is a super basic example, but it serves to illustrate my point. It's not just a prank bro, even when it is.

Re: IoT hacking and rickrolling my high school district

#155

Post by munificent »

nielsbot wrote: post #17
belval wrote: post #2

The fact that the administration didn't choose to sue them to oblivion is refreshing. I hope we'll see a trend in the future of educator being smart enough to admit that they made a mistake and to encourage the students to develop their talent. One can only hope.

Probably helps that "We prepared complete documentation of everything we did, including recommendations to remediate the vulnerabilities we discovered. We went a comprehensive 26-page penetration test report to the D214 tech team and worked with them to help secure their network."

In many cases, a 26-page report documenting the incompetency of a team would not be taken kindly.

Re: IoT hacking and rickrolling my high school district

#157

Post by lr4444lr »

999900000999 wrote: post #122
hparadiz wrote: post #112

Earlier quoted context omitted.

Posts like yours validate the insane over criminalization of what essentially amounts to a prank. I had literally the exact same experience in high school. Got expelled and had to get a GED. They could have easily pressed charges. Part of the issue is people like you who advocate for respecting "the system" and essentially scaring kids into not doing anything. Except that simply re-enforces the draconian laws that ar…

This is a very complicated problem. Unless you kill someone I generally don’t believe in life long criminal records. They only serve to drive people into further criminality. I imagine for a robbery you could get 5 years in prison, 5 years with it on your record and then automatically get it expunged. Back to the topic at hand , what if the IT hack stopped people from getting paid on time. How many suffered emotional…

I dunno. Assault that permanently injures someone, rape, kidnapping, and trafficking are lifelong scarring for the victims. I may not rank computer hacking or selling drugs as deserving of a permanent record, but there are lots of other violent crimes short of homicide that do.

Re: IoT hacking and rickrolling my high school district

#158

Post by Gunax »

999900000999 wrote: post #122
hparadiz wrote: post #112

Earlier quoted context omitted.

Posts like yours validate the insane over criminalization of what essentially amounts to a prank. I had literally the exact same experience in high school. Got expelled and had to get a GED. They could have easily pressed charges. Part of the issue is people like you who advocate for respecting "the system" and essentially scaring kids into not doing anything. Except that simply re-enforces the draconian laws that ar…

This is a very complicated problem. Unless you kill someone I generally don’t believe in life long criminal records. They only serve to drive people into further criminality. I imagine for a robbery you could get 5 years in prison, 5 years with it on your record and then automatically get it expunged. Back to the topic at hand , what if the IT hack stopped people from getting paid on time. How many suffered emotional…

I don't think it's the record's duty to keep you from being employed. That's the employer's decision.

Even if I agree that it's a dumb practice, you're proposing a world where employers are free to refuse your hire if you (eg.) were fired from a job 26 years ago, but not because you were convicted of a crime.

Re: IoT hacking and rickrolling my high school district

#159

Post by oneplane »

AnIdiotOnTheNet wrote: post #75
throwawayboise wrote: post #70

Earlier quoted context omitted.

> Passing strings from program to program is a pain The internet has been pretty successful and many popular protocols (http, smtp, etc) are exactly "passing strings from program to program"

Which is why all browsers render the same thing exactly the same way and there's no need at all to test more than one. Yep.

The presentation layer has nothing to do with he protocol layer...

If you pump some serialised binary into a browser it will still render wrong.

Re: IoT hacking and rickrolling my high school district

#160

Post by lr4444lr »

chrisseaton wrote: post #149
hparadiz wrote: post #112

Earlier quoted context omitted.

Posts like yours validate the insane over criminalization of what essentially amounts to a prank. I had literally the exact same experience in high school. Got expelled and had to get a GED. They could have easily pressed charges. Part of the issue is people like you who advocate for respecting "the system" and essentially scaring kids into not doing anything. Except that simply re-enforces the draconian laws that ar…

> a prank Why do we tolerate pranks? You shouldn't be able to interfere with someone else and say 'just a prank bro'. Leave other people's things alone. Don't create work for other people. Don't bother people just trying to do their jobs. Don't impose your sense of humour on others. These all seem like basics to me? If you think someone's funny? Great. Just don't bother other people with it. Do it with your own stuff…

Many criminal cases require establishing intent. Pranks may be harmful as you allude to, but the intent still matters.
Post reply on HN