Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

They Hacked Their School District When They Were 12

edweek.org

Post reply on HN
Print view View original

31–40 of 55 posts

Re: They Hacked Their School District When They Were 12

#31

Post by philamonster »

Speaking to the ineptitude of the district, you have to understand that a lot of districts are horribly understaffed and/or mismanaged. "Best practices" from an IT perspective is often an unknown or misinterpreted/ignored to band-aid disparate systems RIGHT NOW because someone forgot to renew a license or so-and-so at DO got this great deal on some (most-likely) Pearson product from a frat-brother/neighbor/family member. There is no room for growth professionally and not much in the way of training/certification that doesn't require the employee learning on their own time and dime.

Soul-crushing lack of accountability is a factor as well. Outside of physically assaulting someone or stealing a bunch of shit it is almost unheard of for someone to be terminated for either incompetence or negligence unless it's so optically bad for the district or administration as a whole that they have no choice.

Then you have to take into account the skillsets that you're left with when capable people leave. In my experience, those that can swim best often jump ship first and with them take knowledge that was either carelessly preserved or is totally unattainable by the staff that remains. Positions are sometimes never back-filled leaving less capable staff to pick up slack and the cycle continues, things get overlooked and stagnate and smart, bored kids own your ass.

Re: They Hacked Their School District When They Were 12

#32

Post by asaph »

pdkl95 wrote: post #19

One day (1994) during AP CompSci, my friend was looking for ways to bypass the cheap Mac System 7 lockdown software ("Mac Control" by BDW Software). He found the fill that changed during password changes, and was astonished to find it was the same length as the password. (N character password -> N byte file) Me: That sounds trivial to break; have you tried XOR? Friend: I'll try that now. [Tries ONE value] It's just X…

> Me: That sounds trivial to break; have you tried XOR?

> Friend: I'll try that now. [Tries ONE value] It's just XORing each character of the password with 0xC9!

Really? You kids just guessed it on the first try? I'm skeptical.

Re: They Hacked Their School District When They Were 12

#33

Post by efdee »

katzgrau wrote: post #28
peterwwillis wrote: post #4

I'm almost surprised that school administrators are still pulling the same shit they did 19 years ago. I have basically the same story. I dropped out and got a GED after I was framed by a malicious network admin and expelled, the record of which followed me to each subsequent school. I still managed to work my way into having a career, luckily. But the effects on my family and my development as a kid were significant…

It seems school district security practices are pretty atrocious universally. In my junior year of high school me and a buddy realized that all passwords for our district were 6 digit numbers. We didn't have to be mad geniuses to realize how easy that would be to crack. And sure enough there was a webmail login form on the district's front page that apparently didn't involve a nonce or security token. So we whipped u…

You think your Visual Basic GUI could be used to track a killer's IP address? Because if so, that shatters my entire reality.

Re: They Hacked Their School District When They Were 12

#34

Post by philamonster »

volfied wrote: post #29

I wonder if the security guard or the librarian who left the post-it notes on their machines are reprimanded in any way. Or the librarian who left the student list excel file unlocked on the machine, that contains sensitive information. While what the kids did is simple to us, it is magic to these other people who can't even fathom the security implications of such a system. And that's the scary part. The technology…

Probably not. There's hardly ever a push to get staff members trained in ways like this for a myriad of reasons, some of which are sound. The irony being, the next week an admin could be phished or have their account compromised in the same manner. There just seems to be this acceptance that, much like the view of the current public education system, it's not worth the investment to improve.

Re: They Hacked Their School District When They Were 12

#36

Post by Someone1234 »

leesalminen wrote: post #27
peterwwillis wrote: post #4

I'm almost surprised that school administrators are still pulling the same shit they did 19 years ago. I have basically the same story. I dropped out and got a GED after I was framed by a malicious network admin and expelled, the record of which followed me to each subsequent school. I still managed to work my way into having a career, luckily. But the effects on my family and my development as a kid were significant…

Wow, expelled?!? After a similar inicident in middle school, my only punishment was that I had to start a computer club at the school and run it with the IT guy that got pwned. Although I detested the punishment at the time, it turned out to be a lot of fun. I got to build PCs on the school’s dime.

It is worth considering that we've gone through several moral panics about "hacking," particularly in the late 1980s and early 1990s.

That's why computer crime laws are so disproportionate (e.g. spray paint a physical sign get a $100 fine, vandalize a digital sign get five-ten years in prison). They were written when a bunch of ignorant lawmakers were freaking out about hackers turn off electricity or wiping out the stock market.

Re: They Hacked Their School District When They Were 12

#37

Post by kalleboo »

mynameishere wrote: post #35

This article and all the comments here are really making these kids out to be heroic geniuses. Maybe, just maybe, they knew they were breaking some pretty serious rules. Because, you know, while not exactly geniuses, they weren't idiots either.

That's what kids do though. They break rules, test boundaries. You give them enough of slap on the wrist to teach them to never do that again. Not expel them and ruin their future. Especially if it's true what the article says that one of the kids had a behavioral disorder!

Re: They Hacked Their School District When They Were 12

#38

Post by Broken_Hippo »

peterwwillis wrote: post #4

I'm almost surprised that school administrators are still pulling the same shit they did 19 years ago. I have basically the same story. I dropped out and got a GED after I was framed by a malicious network admin and expelled, the record of which followed me to each subsequent school. I still managed to work my way into having a career, luckily. But the effects on my family and my development as a kid were significant…

"To answer the article's question, they should partner with other school districts to offer advanced cybersecurity programs to gifted students"

Funding laws could disallow this. For example, in Indiana, two schools cannot jointly hire a teacher. They can both hire the teacher part-time if they'd like, but the teacher wouldn't get full-time benefits. (My father worked as a business manager in different school systems in Indiana).

The entire reason for this is funding laws. I think this is a consequence of funding schools through property taxes, but I'm not sure. I'd really like some of this to be changed so there is more flexibility and less difference between area schools, but that isn't how these are designed.

Re: They Hacked Their School District When They Were 12

#39

Post by pdkl95 »

asaph wrote: post #32
pdkl95 wrote: post #19

One day (1994) during AP CompSci, my friend was looking for ways to bypass the cheap Mac System 7 lockdown software ("Mac Control" by BDW Software). He found the fill that changed during password changes, and was astonished to find it was the same length as the password. (N character password -> N byte file) Me: That sounds trivial to break; have you tried XOR? Friend: I'll try that now. [Tries ONE value] It's just X…

> Me: That sounds trivial to break; have you tried XOR? > Friend: I'll try that now. [Tries ONE value] It's just XORing each character of the password with 0xC9! Really? You kids just guessed it on the first try? I'm skeptical.

Is is that hard to believe that two different trekkies (my friend, and possibly the author of the software) might have picked the same "random" constant that just happened to be the title of a TNG episode? It was very surprising at the time, but plausible given that people give VERY non-uniform-random values when asked to pick a random number.

Meh, believe it or not, it's what happened. The real lessons are that XOR isn't a very secure hash function, and a lot of high school level "security" has often been little more than a cheap facade.

Re: They Hacked Their School District When They Were 12

#40

Post by sandworm101 »

thomasfedb wrote: post #25
peterwwillis wrote: post #4

I'm almost surprised that school administrators are still pulling the same shit they did 19 years ago. I have basically the same story. I dropped out and got a GED after I was framed by a malicious network admin and expelled, the record of which followed me to each subsequent school. I still managed to work my way into having a career, luckily. But the effects on my family and my development as a kid were significant…

A friend and I managed to gain superuser access to my school's systems (including remote screen access to every teacher's laptop) when I was in secondary school. After a little playing around we handed the duty technician a post-it note with the superuser password on it and told them we would explain how we found it if they wanted. I was summoned to the office of the head of IT, congratulated, asked to explain how we…

Because your school ran its own IT. In today's north america schools this is contracted out, or at least covered by a multi-school or district team who never talk to actual children. Any kid finding a flaw is a threat to that contract or system. Administrators dont want to look foolish, or admit liability for a flawed system, so they go after the kid (Modern privacy laws make them fearful of admitting anything.) Remember too that there is a culture in NA of adults seeing teenagers as a threat. They are suspect the moment they get to school. Any deviation from a norm only confirms that perception.
Post reply on HN