5 ms·

The perpetrators should be punished by being made to give a presentation on how they automated the process, what poor security practices allowed them to pull it

by nkrisc 8y ago

The perpetrators should be punished by being made to give a presentation on how they automated the process, what poor security practices allowed them to pull it off, and recommendations for preventing a similar incident in the future.

tickthokk 8y ago
I was suspended in high school for "hacking"; this was in 2000. I added two (crudely named) folders to an old DOS style typing teaching software. My presentation would have just been "I pressed F10, and typed in bad words", but it would have been preferable to a three day suspension, haha. I hope this is the outcome!
- Waterluvian 8y ago
  Ahh those were the days. I once sent a WinPopup message to every computer in the school board. So thousands probably. As an idiot I used my account and immediately got suspended.
  - deleted 8y ago
    [deleted]
  - MikeCoats 8y ago
    Yup, I did the same. A contractor replaced all our Classic Macs with Windows 9x boxes and never taught any of the staff how to secure them. We were using winpopup to send messages to each other, when I worked out how to send them to the entire subnet (or domain - I forget). Three months later I was hauled in front of the Deputy Rector to explain how I managed to 'write my name' on the admin office server. It turned out that they never turned on the monitor connected to the print server until the printer stopped working and they jumped to blaming me. It took some really fast thinking to wriggle out of that one - I was warned 'he'd be watching me' from then on though.
    - dmix 8y ago
      So you wrote your name on a Winpopup that you sent out to the entire subnet? That's just asking to be punished lol
      - MikeCoats 8y ago
        Yeah, but not quite. When you sent the message it used your network I’d as for the ‘from’ field. I was even that dorky that the message I used to prove it worked was “Hello, World!”. Try explaining geek memes to high school teachers in the late 90’s.
    - tyingq 8y ago
      The stories seem to be going backwards in time, so I'll chain my 80's version of this. I wrote a fake login prompt on our VAX that looked exactly like the normal login prompt on the VT100 terminals. It would record the userid and password in a log file, give the "wrong password" message, then exit/logout so the real prompt was there for their second try. I'd launch that on a few terminals on my way out of the lab. Never did anything notable with it, but didn't get caught either. I believe this sort of thing is the primary reason for needing to ctl-alt-del to login to windows. Though I'll bet most people wouldn't think much of a (fake) login screen just being there ready to go...they'd probably try to login anyway.
  - lozaning 8y ago
    Thankfully the time i took down the high school's network using a looping bat file that opened looping NetSend commands to the entire domain the teacher of the CCNA class I was in thought it was hilarious and more of a shame on him than a shame on me.
  - fphhotchips 8y ago
    I used NET SEND to do something similar, a little later on. In my previous experiments, this caused a message to appear on all laptops on the local network, so when it didn't, I started sending... less than savory messages. Screaming into the void, as it were. Unfortunately, the messages were appearing... on the domain controller. I think I got a detention and a couple weeks ban from using the computers. Fair enough.
- leetrout 8y ago
  Ha I was “hacking” and “changing my grades” because I brought a laptop to school in 2002.
- labster 8y ago
  How would a presentation be preferable to a 3-day holiday from prison^W school? At least at home I could read my textbooks in peace. I got a five day suspension for showing a teacher I could log in before accounts were authorized while they were watching. Loaded the school's official website in a browser. Best week of high school.
  - sverige 8y ago
    My high school solved that by making all suspensions "in school" suspensions. You were sequestered in a classroom with the other miscreants. You were not allowed to talk to anyone but the ISS teacher, who was a mean wrestling coach. You were assigned double or triple homework, which had to be completed before you were allowed out of ISS, and you automatically received Fs on all that homework. Those things removed all motivation for 'vacation.' No one wanted to get suspended.
    - labster 8y ago
      Oh wow, that sounds educational, or rather its opposite. Sounds trivial to hack though. You have no incentive to actually do the homework other than the time, so just drag it out to the maximum time. I'm sure the coach would love to stay watching one kid to 2AM. I guess it's just being older that you realize school is a fake world anyway, and expulsion is not a real punishment except to the school's budget. The community college path is cheaper and better anyway.
      - sverige 8y ago
        No, if the homework didn't get done, the coach went home at his usual time and the next day the kid had to come back to ISS instead of going back to regular classes. Expulsion was a real punishment back then. It may be less so nowadays, I'm not sure, but when I was in high school, without a diploma it was very difficult to get any kind of job beyond something menial, and nearly impossible to get into any kind of higher education, including community college. Then again, two generations earlier than mine, you could support a family on an 8th-grade education -- although an 8th-grade education a hundred years ago involved more than a high school diploma these days.
- Datenstrom 8y ago
  Around the same time I was one of the first kids to have a laptop in my highschool and was actually just doing homework on it in studyhall. The proctor was aghast and thought I was going to infect all the school computers with viruses. I tried explaining that I was not even on the school network and she tried to tell me that they could spread through the power supply.
  - drspacemonkey 8y ago
    Similar things happened to me. My main takeaway was that these supposed authority figures were so certain about this stuff, and they obviously had zero clue. Made me distrust authority in general for years, which led to several problems.
trhway 8y ago
And that presentation should be given in Russian.
- sctb 8y ago
  Would you mind posting thoughtful and informative comments instead of snarky one-liners? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
kemitche 8y ago
Suppose I walk into the neighborhood 7-11, and steal the money from the cash drawer when the cashier glances away. I'm only caught once the tapes are reviewed and they find my license plate. Should my punishment be to give a presentation to the cashier that they should be watching everyone at all times? Obviously the answer is no. Sometimes, catching someone breaking rules/laws after the fact is sufficient - 100% prevention of a crime before it happens shouldn't be the only way crimes are avoided. Did the school make some poor choices with their cybersecurity? Sure. But an open/unlocked door does not give permission to steal or break the law, whether that door is digital or physical.
- leothecool 8y ago
  Is it a mock 7-11 for educational purposes?
- nkrisc 8y ago
  Are you suggesting these kids are criminals and committed a crime? Because I don't really see the connection between theft and what this article is about. It sounds like this can be turned into a learning opportunity. Learning seems appropriate for a school setting as opposed to vengeful retribution. If, as you suggested, you commit theft, engagement with the criminal justice system seems appropriate, but maybe not if you rigged a school election.
  - kemitche 8y ago
    I'm suggesting the students be punished in the same way as if they had cheated on a paper ballot election. Nothing more, nothing less. I don't think it's a stretch to think that HS students should know better than to cheat - whether that's on a test, or a school-wide election.
    - nkrisc 8y ago
      That's a fair point of view. However I think school should focus less on punishment and more on learning wherever possible. I'm suggesting that instead of punishment this could be opportunity for all to learn.
stcredzero 8y ago
punished by being made to give a presentation on how they automated the process, what poor security practices allowed them to pull it off, and recommendations for preventing a similar incident in the future So punish them by sending them to DefCon?

by nkrisc 8y ago

tickthokk 8y ago

I was suspended in high school for "hacking"; this was in 2000. I added two (crudely named) folders to an old DOS style typing teaching software. My presentation would have just been "I pressed F10, and typed in bad words", but it would have been preferable to a three day suspension, haha. I hope this is the outcome!

Waterluvian 8y ago
Ahh those were the days. I once sent a WinPopup message to every computer in the school board. So thousands probably. As an idiot I used my account and immediately got suspended.
- deleted 8y ago
  [deleted]
- MikeCoats 8y ago
  Yup, I did the same. A contractor replaced all our Classic Macs with Windows 9x boxes and never taught any of the staff how to secure them. We were using winpopup to send messages to each other, when I worked out how to send them to the entire subnet (or domain - I forget). Three months later I was hauled in front of the Deputy Rector to explain how I managed to 'write my name' on the admin office server. It turned out that they never turned on the monitor connected to the print server until the printer stopped working and they jumped to blaming me. It took some really fast thinking to wriggle out of that one - I was warned 'he'd be watching me' from then on though.
  - dmix 8y ago
    So you wrote your name on a Winpopup that you sent out to the entire subnet? That's just asking to be punished lol
    - MikeCoats 8y ago
      Yeah, but not quite. When you sent the message it used your network I’d as for the ‘from’ field. I was even that dorky that the message I used to prove it worked was “Hello, World!”. Try explaining geek memes to high school teachers in the late 90’s.
  - tyingq 8y ago
    The stories seem to be going backwards in time, so I'll chain my 80's version of this. I wrote a fake login prompt on our VAX that looked exactly like the normal login prompt on the VT100 terminals. It would record the userid and password in a log file, give the "wrong password" message, then exit/logout so the real prompt was there for their second try. I'd launch that on a few terminals on my way out of the lab. Never did anything notable with it, but didn't get caught either. I believe this sort of thing is the primary reason for needing to ctl-alt-del to login to windows. Though I'll bet most people wouldn't think much of a (fake) login screen just being there ready to go...they'd probably try to login anyway.
- lozaning 8y ago
  Thankfully the time i took down the high school's network using a looping bat file that opened looping NetSend commands to the entire domain the teacher of the CCNA class I was in thought it was hilarious and more of a shame on him than a shame on me.
- fphhotchips 8y ago
  I used NET SEND to do something similar, a little later on. In my previous experiments, this caused a message to appear on all laptops on the local network, so when it didn't, I started sending... less than savory messages. Screaming into the void, as it were. Unfortunately, the messages were appearing... on the domain controller. I think I got a detention and a couple weeks ban from using the computers. Fair enough.
leetrout 8y ago
Ha I was “hacking” and “changing my grades” because I brought a laptop to school in 2002.
labster 8y ago
How would a presentation be preferable to a 3-day holiday from prison^W school? At least at home I could read my textbooks in peace. I got a five day suspension for showing a teacher I could log in before accounts were authorized while they were watching. Loaded the school's official website in a browser. Best week of high school.
- sverige 8y ago
  My high school solved that by making all suspensions "in school" suspensions. You were sequestered in a classroom with the other miscreants. You were not allowed to talk to anyone but the ISS teacher, who was a mean wrestling coach. You were assigned double or triple homework, which had to be completed before you were allowed out of ISS, and you automatically received Fs on all that homework. Those things removed all motivation for 'vacation.' No one wanted to get suspended.
  - labster 8y ago
    Oh wow, that sounds educational, or rather its opposite. Sounds trivial to hack though. You have no incentive to actually do the homework other than the time, so just drag it out to the maximum time. I'm sure the coach would love to stay watching one kid to 2AM. I guess it's just being older that you realize school is a fake world anyway, and expulsion is not a real punishment except to the school's budget. The community college path is cheaper and better anyway.
    - sverige 8y ago
      No, if the homework didn't get done, the coach went home at his usual time and the next day the kid had to come back to ISS instead of going back to regular classes. Expulsion was a real punishment back then. It may be less so nowadays, I'm not sure, but when I was in high school, without a diploma it was very difficult to get any kind of job beyond something menial, and nearly impossible to get into any kind of higher education, including community college. Then again, two generations earlier than mine, you could support a family on an 8th-grade education -- although an 8th-grade education a hundred years ago involved more than a high school diploma these days.
Datenstrom 8y ago
Around the same time I was one of the first kids to have a laptop in my highschool and was actually just doing homework on it in studyhall. The proctor was aghast and thought I was going to infect all the school computers with viruses. I tried explaining that I was not even on the school network and she tried to tell me that they could spread through the power supply.
- drspacemonkey 8y ago
  Similar things happened to me. My main takeaway was that these supposed authority figures were so certain about this stuff, and they obviously had zero clue. Made me distrust authority in general for years, which led to several problems.

trhway 8y ago

And that presentation should be given in Russian.

sctb 8y ago
Would you mind posting thoughtful and informative comments instead of snarky one-liners? https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

kemitche 8y ago

Suppose I walk into the neighborhood 7-11, and steal the money from the cash drawer when the cashier glances away. I'm only caught once the tapes are reviewed and they find my license plate. Should my punishment be to give a presentation to the cashier that they should be watching everyone at all times? Obviously the answer is no. Sometimes, catching someone breaking rules/laws after the fact is sufficient - 100% prevention of a crime before it happens shouldn't be the only way crimes are avoided. Did the school make some poor choices with their cybersecurity? Sure. But an open/unlocked door does not give permission to steal or break the law, whether that door is digital or physical.

leothecool 8y ago
Is it a mock 7-11 for educational purposes?
nkrisc 8y ago
Are you suggesting these kids are criminals and committed a crime? Because I don't really see the connection between theft and what this article is about. It sounds like this can be turned into a learning opportunity. Learning seems appropriate for a school setting as opposed to vengeful retribution. If, as you suggested, you commit theft, engagement with the criminal justice system seems appropriate, but maybe not if you rigged a school election.
- kemitche 8y ago
  I'm suggesting the students be punished in the same way as if they had cheated on a paper ballot election. Nothing more, nothing less. I don't think it's a stretch to think that HS students should know better than to cheat - whether that's on a test, or a school-wide election.
  - nkrisc 8y ago
    That's a fair point of view. However I think school should focus less on punishment and more on learning wherever possible. I'm suggesting that instead of punishment this could be opportunity for all to learn.

stcredzero 8y ago

punished by being made to give a presentation on how they automated the process, what poor security practices allowed them to pull it off, and recommendations for preventing a similar incident in the future So punish them by sending them to DefCon?