6 ms·

Uuuuh. Could you add more details to this story?

brink 10y ago
Long story short - used a rainbow table against the Windows XP SAM file to get the password that they used globally - including the login credentials for modifying the content in their CMS for their website. As a joke, we threw Rick Astley up on the main page. The next day, they brought the site down, scoured the logs for my IP address and pressed felony charges against me (Made possible by the CFAA). It's all good now though, after a lot of explaining the judge eventually dropped the case.
- ceejayoz 10y ago
  Sending someone a link that turns out to go to Rick Astley is rick-rolling. Cracking a password, accessing a CMS, and defacing a site is slightly more than just "rick-rolling my school". Yes, it probably should have resulted in a suspension, not a felony charge. No, it's not as benign as you implied.
  - roywiggins 10y ago
    I escalated access to my school district's webserver and accidentally took it down. For some reason I was trying to close the hole I had used; instead, I default denied all access. Whoops. I explained what happened to a teacher, he called in the IT group, my change was reverted and nothing was ever spoken about it again. I also hacked the online grade review site, which was trivially hackable (javascript password protection, wtf), told a teacher, nothing happened to fix it (or to damage me) and I dropped the issue. Both of those were done in attempt to be altruistic but technically both were completely illegal. Since no administrator ever found out, no cops were ever called and no prosecutorial discretion was in play, but I wouldn't want to bet I'd have been "let off", which is sort of terrifying.
  - rangibaby 10y ago
    > No, it's not as benign as you implied. Yes it is. He didn't hurt anyone or even mess with their files in a naughty way. I was so happy to get away from school and this kind of bullshit.
    - MBCook 10y ago
      He purposely went out of his way to crack a password for the purpose of gaining unauthorized access to a system that wasn't his. That's exactly the kind of thing the CFAA was created for. I agree with the GP that he was harmless, and doesn't deserve anything terribly serious as punishment. But what he did is a lot more than using simple HTML injection to add a rick roll to something.
      - zaroth 10y ago
        It sounds like what he did had exactly the same effect as "using simple HTML injection to add a rick roll to something". 'But he achieved it using leet hacker skills' should not be a factor in determining the nature of the charge or potential sentence. That's along the lines of making a big deal out of someone using a "Subversion" system to access and maintain code.
        MBCook 10y ago
        By "using simple HTML injection" I'm thinking of a form where they don't sanitize input so you could put a <video> tag in the 'name' field and suddenly the video would appear on the page. Getting access to the administrator account is pretty different.
        nitrogen 10y ago
        Not for a high school student. School networks tend to be very insecure, and the students tend to see them as just another resource in their education.
    - corobo 10y ago
      The IT dept has no idea if he messed with their files in a naughty way. They will have to spend x hours and y moneys on checking now. While finding the problem should never be punished if it's responsibly disclosed, exploiting it (publicly in this manner) should be.
  - taneq 10y ago
    While I admire the original hijinks, I think you have a point. There's a difference between showing someone a funny picture, and picking the lock to their house so you can leave a copy of it in their underwear drawer.
- Concealed10 10y ago
  Out of curiosity, could you expand on the story a bit? I've recently undergone a very similar experience. The administrators at my school alongside the IT Department freaked out and were considering legal action since they didn't really understand what had happened, however I was able to talk them down from it. The entire situation has kind of made me curious about other peoples experience.
- aaron695 10y ago
  You vandalised property and cost the school money. You obviously don't deserve prison time, but you didn't get it either. It shouldn't have gotten as far as it did though. But do you think the person/IT responsible for the website was not harmed? You get they are human and 'possibly' went under an amazing amount of stress? They may have been disciplined for what happened, either officially or off the books. There would have been a lot of hours work post mortem trying to fix the problem. This is money on a possibly tight IT budget. If the people who run the website care, which many do, this also is stressful. I'm not saying don't prank or even don't do this prank. Pranks come at a cost, but they also make the world a better place. But be self aware of your own actions. You hacked and got caught it really has nothing to do with the CFAA.
  - AnthonyMouse 10y ago
    > You obviously don't deserve prison time, but you didn't get it either. Because they decided not to press charges, not because the CFAA makes any sense. > But do you think the person/IT responsible for the website was not harmed? You get they are human and 'possibly' went under an amazing amount of stress? There is a difference between inconvenience and harm. The vast majority of the "harm" caused in cases like this is a result of ridiculous overreactions to anything that involves a computer. Imagine the analog version of this case. Some kid sitting in the main office sees the teacher enter the combination to the filing cabinet and then the kid unlocks it and sticks in a picture of Rick Astley. If that happened, would we still be hearing about a "post mortem" (as if serious level = human fatality) and the harm and stress the kid caused? Does a law allowing that kid to be prosecuted for a felony really make any sense?
    - jsmeaton 10y ago
      I was thinking the analog version may be someone breaking into your house and leaving a picture of Rick Astley on your kitchen bench. You come home, find out someone has been in your home, but not what they've done in there. You don't know that it was your neighbour playing a prank or if it was some criminal that's put up little IP cameras all around your house until you do some investigation. Until you come to some conclusion you could be very worried and/or paranoid. Granted, this is the extreme version of the analogy. Jail would be an over reaction for your neighbour, but you'd want that as an option for some creep breaking in, right? It sounds like in the parent posts case everything worked out more or less OK.

brink 10y ago

Long story short - used a rainbow table against the Windows XP SAM file to get the password that they used globally - including the login credentials for modifying the content in their CMS for their website. As a joke, we threw Rick Astley up on the main page. The next day, they brought the site down, scoured the logs for my IP address and pressed felony charges against me (Made possible by the CFAA). It's all good now though, after a lot of explaining the judge eventually dropped the case.

ceejayoz 10y ago
Sending someone a link that turns out to go to Rick Astley is rick-rolling. Cracking a password, accessing a CMS, and defacing a site is slightly more than just "rick-rolling my school". Yes, it probably should have resulted in a suspension, not a felony charge. No, it's not as benign as you implied.
- roywiggins 10y ago
  I escalated access to my school district's webserver and accidentally took it down. For some reason I was trying to close the hole I had used; instead, I default denied all access. Whoops. I explained what happened to a teacher, he called in the IT group, my change was reverted and nothing was ever spoken about it again. I also hacked the online grade review site, which was trivially hackable (javascript password protection, wtf), told a teacher, nothing happened to fix it (or to damage me) and I dropped the issue. Both of those were done in attempt to be altruistic but technically both were completely illegal. Since no administrator ever found out, no cops were ever called and no prosecutorial discretion was in play, but I wouldn't want to bet I'd have been "let off", which is sort of terrifying.
- rangibaby 10y ago
  > No, it's not as benign as you implied. Yes it is. He didn't hurt anyone or even mess with their files in a naughty way. I was so happy to get away from school and this kind of bullshit.
  - MBCook 10y ago
    He purposely went out of his way to crack a password for the purpose of gaining unauthorized access to a system that wasn't his. That's exactly the kind of thing the CFAA was created for. I agree with the GP that he was harmless, and doesn't deserve anything terribly serious as punishment. But what he did is a lot more than using simple HTML injection to add a rick roll to something.
    - zaroth 10y ago
      It sounds like what he did had exactly the same effect as "using simple HTML injection to add a rick roll to something". 'But he achieved it using leet hacker skills' should not be a factor in determining the nature of the charge or potential sentence. That's along the lines of making a big deal out of someone using a "Subversion" system to access and maintain code.
      - MBCook 10y ago
        By "using simple HTML injection" I'm thinking of a form where they don't sanitize input so you could put a <video> tag in the 'name' field and suddenly the video would appear on the page. Getting access to the administrator account is pretty different.
        nitrogen 10y ago
        Not for a high school student. School networks tend to be very insecure, and the students tend to see them as just another resource in their education.
  - corobo 10y ago
    The IT dept has no idea if he messed with their files in a naughty way. They will have to spend x hours and y moneys on checking now. While finding the problem should never be punished if it's responsibly disclosed, exploiting it (publicly in this manner) should be.
- taneq 10y ago
  While I admire the original hijinks, I think you have a point. There's a difference between showing someone a funny picture, and picking the lock to their house so you can leave a copy of it in their underwear drawer.
Concealed10 10y ago
Out of curiosity, could you expand on the story a bit? I've recently undergone a very similar experience. The administrators at my school alongside the IT Department freaked out and were considering legal action since they didn't really understand what had happened, however I was able to talk them down from it. The entire situation has kind of made me curious about other peoples experience.
aaron695 10y ago
You vandalised property and cost the school money. You obviously don't deserve prison time, but you didn't get it either. It shouldn't have gotten as far as it did though. But do you think the person/IT responsible for the website was not harmed? You get they are human and 'possibly' went under an amazing amount of stress? They may have been disciplined for what happened, either officially or off the books. There would have been a lot of hours work post mortem trying to fix the problem. This is money on a possibly tight IT budget. If the people who run the website care, which many do, this also is stressful. I'm not saying don't prank or even don't do this prank. Pranks come at a cost, but they also make the world a better place. But be self aware of your own actions. You hacked and got caught it really has nothing to do with the CFAA.
- AnthonyMouse 10y ago
  > You obviously don't deserve prison time, but you didn't get it either. Because they decided not to press charges, not because the CFAA makes any sense. > But do you think the person/IT responsible for the website was not harmed? You get they are human and 'possibly' went under an amazing amount of stress? There is a difference between inconvenience and harm. The vast majority of the "harm" caused in cases like this is a result of ridiculous overreactions to anything that involves a computer. Imagine the analog version of this case. Some kid sitting in the main office sees the teacher enter the combination to the filing cabinet and then the kid unlocks it and sticks in a picture of Rick Astley. If that happened, would we still be hearing about a "post mortem" (as if serious level = human fatality) and the harm and stress the kid caused? Does a law allowing that kid to be prosecuted for a felony really make any sense?
  - jsmeaton 10y ago
    I was thinking the analog version may be someone breaking into your house and leaving a picture of Rick Astley on your kitchen bench. You come home, find out someone has been in your home, but not what they've done in there. You don't know that it was your neighbour playing a prank or if it was some criminal that's put up little IP cameras all around your house until you do some investigation. Until you come to some conclusion you could be very worried and/or paranoid. Granted, this is the extreme version of the analogy. Jail would be an over reaction for your neighbour, but you'd want that as an option for some creep breaking in, right? It sounds like in the parent posts case everything worked out more or less OK.