When You Accidentally Break Your School Network in 1995

I showed my classmates winpopup for a boring computer class, but then later we had a test, and they were using it to cheat.

So I broadcast a message (with spoofed username) pretending to be there IT director, telling them to cut it out. It always helps to have an extra secret :p

I recall the same type of network and exactly the same situation here in Australia, with a student locking everyone out. From memory, despite appearances the password system was essentially an honour system, involving one computer being the "master terminal" (try keeping kids away from that keyboard) and even then there being ways around it. I think the offending student got a stern talking to and a day off school. We taught ourselves quite a bit on that network, and the teacher in charge of it was quite happy to admit that his knowledge could take us only so far, before self-learning had to take over.

Once upon a time I was suspended from high school for having pen-testing tools on a flash drive in my locker.

I was interested in network security and asking to my teacher about the best way to learn this information and whether 'these' tools would give me an understanding, I told her I brought them in to ask questions about and next thing I knew they broke into my locker, read the drive and I was pulled out of class and in the principals office for "possessing" these tools.

I still remember him saying "it's like you brought a gun to school, just because you didn't use it doesn't make it ok. The only reason we haven't expelled you is because we can't prove you used them on the school network."

I understand now they reacted this way out of fear but it was a pretty terrible way of handling a curious kid and ruined both my trust in teachers and interest in learning any kind of network security.

When I was 11 years old or so, I did not yet have a computer of my own but I had taken an interest in computers and wanted to learn more about them than just playing games. First and foremost I wanted to command computers to do my bidding. To create my own games and so on. So I read a couple of books and magazines and wrote a bunch on paper.

My father had a computer that he would let me borrow at times. One time my father brought with him home a copy of the installer for a program called POV-Ray, an open source raytracer and together we used it to describe a couple of simple scenes and render them. Aside from that my interactions with real computers at the time remained limited to playing games, using MS Paint and a little bit of supervised web browsing. However my interest in learning about computers remained and my father encouraged this. He would bring with him print-outs from the internet about various things relating to computers. One time he had printed out a few pages from the website of the Chaos Computer Club.

Those guys, the CCC, what they were able to do was amazing to me. They seemed like gods, well not quite gods but some sort of wizards or something.

The movie The Matrix had also captivated me when I saw it. It remains one of my all time favorite movies to this day.

At the age of 12 I got a computer of my own. It had a red rescue floppy, the contents of which I belived to be the entire installer for the Windows XP operating system. My father told me that the installer would weigh in at a lot more than the 1.44 MB that was able to fit on a floppy. I did not believe him. He was right of course, as I would come to understand a few years later -- the rescue floppy was booting the computer from a hidden partition and then the recovery stuff that was stored on that partition would take over and continue from there. Nonetheless, I had a blast and aside from a few misconseptions like the one mentioned, I learned a lot from having my own computer. Being able to restore Windows XP back to the factory state turned out to be very useful in the process of learning as I would regularily mess up my install in various ways that would lock me out of the computer or even make Windows unable to boot, but each time I would pop in the recovery disk and within 30 minutes to an hour or so I think the recovery program would have made the computer good as new. I lost a lot of data that way of course but little of it was of value to me anyway. The process of trying things and discovering and learning was much more important than my data. So on my computer I could experiment and if something broke there was no consequence. This would shape my attitude against computers. The lack of consequence however, not so.

Fast forward to 2006, I was in high school. I finally learned to program thanks to TI-BASIC on the graphing calculators and a book about PHP, after previously while in midleschool having given up on programming when the C++ Hello World program I copied from a book didn't seem to work. (I had compiled it successfully but I had failed to understand that I would have to run it from a command prompt in order to see the output, so what happened was that when I double-clicked the executable, a command prompt opened itself, and as soon as the program finished it closed itself, leaving me to think that the black box that flashed on my screen meant that the program didn't work.)

With the understanding I had gained from programming I figured maybe I would be able to create my own cracks for games and other pieces of software. After a bit of searching I came across a site called woodman.com, which had a bunch of tutorials on reverse engineering. I read them with great joy and after having followed guides and practiced on various crackme's, I downloaded a shareware program that had a serial protection on it and was able to crack it all on my own.

Well, well, well. I am able to write software, I am able to crack other people's software. Now I think it's time that I look into network security. I bet there is some security issue with the school computers and I bet that the school will be happy when I tell them about it.

Yes and no. There was a security issue, but the school did not enjoy me finding it nor what I did once I had found it.

The first thing I did was I downloaded a collection of rainbow tables.

Next I tried to boot one of the school computers with a boot-CD so that I could copy the LM hashes file if it existed on the computer.

The school computers had a BIOS password and were configured not to boot from the CD-ROM drive.

So I gave up on that and focused my attention on other things.

Later one day when I booted one of the school computers, the boot process looked a bit different from what it used to (don't remember how, but probably it attempted network boot or something) and I figured that maybe I should try to enter the BIOS menu on this computer. The computer allowed access without a BIOS password. (The school IT administrator had disabled the BIOS password temporarily and had forgotten to re-enable it afterwards.) I shut down the computer again and the next day I brought a boot-CD.

I booted from the boot-CD, found the file with the LM hashes and copied it to a USB stick. Brought it home and put my computer to work at using the rainbow tables I had downloaded.

After some time (several hours, perhaps several days) the password cracking program had found a match for the password of the local Administrator user.

At school I then tried to log in as Administrator on one of the computers using the password that the password cracker had found and it worked. Holy shit!

Instead of telling the school about this, I decided that I should investigate what more I could do. Bad idea. If I had stopped at this point, perhaps the school would have been thankful indeed, who knows.

So after a bit of pondering, I decided that I should install a keylogger on a bunch of the machines. I found something called FakeGina.dll online and was going to replace MSGina.dll with it. This triggered the antivirus software on the school computer which gave me a bit of panic. I logged off and didn't do anything out of the ordinary for a while, expecting that the school IT admin would have gotten a notification and that he was going to question me about it and that it wouldn't look good.

(Continues in a child comment.)

And even if it was, there were ways to get anonymous execution through the task manager, or the infamous help-dialog login bypass.