They Hacked Their School District When They Were 12 • Hacker News Board

Re: They Hacked Their School District When They Were 12

#41

Post by fauxpersona » Sat, Nov 10, 2018, 3:17 PM UTC

Similar story here, but very different outcome. Messed around a bit in junior high, but in senior high our school had their home-built web-based intranet. Several security issues (at least half of OWASP 10 basically), so escalated that to full access of db with cracked account passwords. Windows AD network and I don't remember the details but it involved a service account with a weak password, Remote Desktoping into some admin server and getting a local copy of a database with NTLM hashed passwords, cracking those for all users. I didn't actually do anything much apart from just exploring the security aspects. Didn't probe in private messages between teachers (definitely in their internal message boards though!), try to look at the grading database, etc. Eventually got caught because one of my two friends who were in on this had got caught having the wrong window open at school and they got on to us.

That was nerve-wrecking.

There was a whole internal crisis around it - it was not a huge school, private IT and media school with less than 1000 students at the time. They had logs that made me have to admit and I effectively got cut off the AD. Game over.

However, I still had a private 0day for the intranet so I could see what they were writing about what to do with the situation. It seems like the consensus was to turn us in to the police - just like with the boys in the article. But then our head of school posted an MP3 file on an internal closed message-board arguing for how this was not a way to to this and instead we got "detention"; I had to build a web app and database for connecting students to companies for internships. Which was pretty fun.

Some time after graduation and military service, the head of school calls me out of the blue and wonders what I am up to now. Apparently he had moved on from the school and was now working with one of the most famous web entrepreneurs in our country with a small startup in the town where I went to high school.

So that's how I got my first full-time job, where I learned a lot.

Morality aside, which approach was more constructive here?

Re: They Hacked Their School District When They Were 12

#42

Post by auganov » Sat, Nov 10, 2018, 3:18 PM UTC

So they mined crypto, installed backdoors, accessed camera footage... and the story is generally positive and defensive of them[0]. This clearly goes beyond "just a prank" and depending on the severity ranges from very irresponsible to anti-social and malicious.

[0] for the record I don't mean it shouldn't be, it just sounds bad enough, so imagine how bad a non-charitable take would be

Re: They Hacked Their School District When They Were 12

#43

Post by xfitm3 » Sat, Nov 10, 2018, 3:19 PM UTC

peterwwillis wrote: post #4

I'm almost surprised that school administrators are still pulling the same shit they did 19 years ago. I have basically the same story. I dropped out and got a GED after I was framed by a malicious network admin and expelled, the record of which followed me to each subsequent school. I still managed to work my way into having a career, luckily. But the effects on my family and my development as a kid were significant…

I have a similar story but I wasn’t expelled. I was locked in a room and yelled at for a couple hours. Ultimately, I was banned from the library. I loved reading.

The computer teacher setup a special curriculum for me that covered discrete electronics and I attended this in lieu of another class.

He was a former x-ray technician and taught me all about resistors, diodes, capacitors, inductors, you name it. He created binders with these components taped to work sheets with technical information.

The school was ran by a moronic fear mongering admin, but there were at least a few good people who saw I was different. I probably wouldn’t be here today if it wasn’t for that teacher.

Re: They Hacked Their School District When They Were 12

#44

Post by crankylinuxuser » Sat, Nov 10, 2018, 3:19 PM UTC

Someone1234 wrote: post #36

leesalminen wrote: post #27

Earlier quoted context omitted.

Wow, expelled?!? After a similar inicident in middle school, my only punishment was that I had to start a computer club at the school and run it with the IT guy that got pwned. Although I detested the punishment at the time, it turned out to be a lot of fun. I got to build PCs on the school’s dime.

It is worth considering that we've gone through several moral panics about "hacking," particularly in the late 1980s and early 1990s. That's why computer crime laws are so disproportionate (e.g. spray paint a physical sign get a $100 fine, vandalize a digital sign get five-ten years in prison). They were written when a bunch of ignorant lawmakers were freaking out about hackers turn off electricity or wiping out the…

Yep.

I've been shouted down at our work book club while reading Mitnicks memoir. I said that a good amount of early hacking was "e-trespass" and "e-vandalism". The non-e versions of those crimes are low grade misdemeanors.

Yet, it was a bunch of shitty laws that somehow elevate them to manslaughter and 2nd degree murder equalivalent.

Re: They Hacked Their School District When They Were 12

#45

Post by [deleted] » Sat, Nov 10, 2018, 3:23 PM UTC

thomasfedb wrote: post #25

peterwwillis wrote: post #4

I'm almost surprised that school administrators are still pulling the same shit they did 19 years ago. I have basically the same story. I dropped out and got a GED after I was framed by a malicious network admin and expelled, the record of which followed me to each subsequent school. I still managed to work my way into having a career, luckily. But the effects on my family and my development as a kid were significant…

A friend and I managed to gain superuser access to my school's systems (including remote screen access to every teacher's laptop) when I was in secondary school. After a little playing around we handed the duty technician a post-it note with the superuser password on it and told them we would explain how we found it if they wanted. I was summoned to the office of the head of IT, congratulated, asked to explain how we…

[deleted]

Re: They Hacked Their School District When They Were 12

#46

Post by wizzard » Sat, Nov 10, 2018, 3:29 PM UTC

krsdcbl wrote: post #20

Is it just me or does the story inexplicably blow up the boys tech proficiencies and then almost casually mentions that all they did was log in to school computers with credentials from a post-it on the machine itself in a public space? How are they at fault if said credentials grants them access to unprotected sensitive records and an obviously badly exposed administration system?

Another breathless article about l33t hacking where the method is just stumbling across passwords.

It’s like a bank leaving its doors and vault open, and whoever walks in and grabs the money being lauded for his bank robbing prowess.

Also, they are very much at fault for knowingly using someone else’s credentials. It doesn’t matter how easily they obtained them.

Re: They Hacked Their School District When They Were 12

#47

Post by ballenf » Sat, Nov 10, 2018, 3:30 PM UTC

auganov wrote: post #42

So they mined crypto, installed backdoors, accessed camera footage... and the story is generally positive and defensive of them[0]. This clearly goes beyond "just a prank" and depending on the severity ranges from very irresponsible to anti-social and malicious. [0] for the record I don't mean it shouldn't be, it just sounds bad enough, so imagine how bad a non-charitable take would be

By 'backdoors' are you referring to the TeamViewer client they installed on a student computer in the back of a science classroom? If so, suddenly my grandma is now a leet hacker.

Re: They Hacked Their School District When They Were 12

#48

Post by a_c » Sat, Nov 10, 2018, 3:43 PM UTC

asaph wrote: post #32

pdkl95 wrote: post #19

One day (1994) during AP CompSci, my friend was looking for ways to bypass the cheap Mac System 7 lockdown software ("Mac Control" by BDW Software). He found the fill that changed during password changes, and was astonished to find it was the same length as the password. (N character password -> N byte file) Me: That sounds trivial to break; have you tried XOR? Friend: I'll try that now. [Tries ONE value] It's just X…

> Me: That sounds trivial to break; have you tried XOR? > Friend: I'll try that now. [Tries ONE value] It's just XORing each character of the password with 0xC9! Really? You kids just guessed it on the first try? I'm skeptical.

On hindsight, his friend might XOR a known password's hash with the clear text to uncover OxC9. But coming up the idea on the spot is pretty smart as well

Re: They Hacked Their School District When They Were 12

#49

Post by auganov » Sat, Nov 10, 2018, 3:46 PM UTC

ballenf wrote: post #47

auganov wrote: post #42

So they mined crypto, installed backdoors, accessed camera footage... and the story is generally positive and defensive of them[0]. This clearly goes beyond "just a prank" and depending on the severity ranges from very irresponsible to anti-social and malicious. [0] for the record I don't mean it shouldn't be, it just sounds bad enough, so imagine how bad a non-charitable take would be

By 'backdoors' are you referring to the TeamViewer client they installed on a student computer in the back of a science classroom? If so, suddenly my grandma is now a leet hacker.

Remote Access Trojan is more fitting I guess?

Also note the article is pretty explicit that this compromised computer gave them access to the entire network. And "servers" is in plural when it talks about crytpo-mining. Likely this is how they controlled the mining operation.

Re: They Hacked Their School District When They Were 12

#50

Post by jtbayly » Sat, Nov 10, 2018, 3:52 PM UTC

My freshman year of high school we had similar access. Mostly used it for auto-installing Doom on all the library computers at once every time the poor admin went through each computer and manually deleted it.

One friend wrote a fake login program that would immediately quit and run the real login program so we could collect credentials.

Another friend got in real trouble though, supposedly for either trying to or actually changing grades. I knew we could get in trouble. But I also never would have considered doing anything other than pranks.

Of course, even pranks can be dangerous. One of my friends found an open mail server (not that there were any shortage of those at the time) and sent some prank emails that could have gotten him in real trouble.