4 ms·

> Is this just a case of ‘Nobody ever got fired for choosing Blackboard’? I would say it's more a case of "Nobody ever got fired" As a former high-school hack

> Is this just a case of ‘Nobody ever got fired for choosing Blackboard’? I would say it's more a case of "Nobody ever got fired" As a former high-school hacker, I routinely reported major holes to District IT. No one gave a damn. Only once I started poking around private financial data did they raise hell, and even then it was "Show us what you have, tell us how you did it, and we'll let you walk. Otherwise we'll get the police involved." Handed over my laptop, the IT guy managed to play some Rammstein accidentally but otherwise found nothing of note. I was banned from bringing, touching, or even being near a computer, my assigned seating was moved in all classes directly to the front, and that was that. Kept in touch with a few of the tech-interested Freshman I knew during my Senior year, nothing was ever patched, nothing changed over the ensuing years. The exact same exploits I informed them of were not touched. There is simply no culture of accountability.

dvtrn 7y ago
“Accountability for thee, not so much for me”
- deleted 7y ago
  [deleted]
- mieseratte 7y ago
  Having written this story out, my inner conspiracy-theorist wonders if they kept it quiet because they were worried I might've stumbled onto something they didn't want the world to know, perhaps some type of financial mismanagement. To contrast I was arrested and sent to county jail, charged as an adult on a "distrubing the peace" style charge, by the same school for telling an administrator, in-private, to fuck off in response to a punishment levied without being told what I had actually done. Schools, eh?
  - johnr2 7y ago
    > Schools, eh? The lesson that many in positions of authority are petty-minded fools is a valuable part of your education.
skinnymuch 7y ago
Were the private financial data you were able to poke around at also not patched up? Since that seems to be in their selfish interest to fix.
- mieseratte 7y ago
  As far as I'm aware they were mostly spreadsheets just sitting on the file-system. Given that all of the exploits were still available, including gaining local superuser accounts I would assume not. Who knows, maybe they were just running a honey-pot pretending and pretending to be outraged.
dchichkov 7y ago
These security vulnerabilities are there to educate the next generation. So they could experience the incredulity of finding out how fragile are the computer systems. Don't rob the next generation of experiences :)
moftz 7y ago
I got past the network drive quotas on accident in highschool and got my computer privileges taken away for a couple weeks. I still had computer classes that I needed to do work in but the admin didn't care. I already knew the local admin account password, all the same for every school computer, so I used that until he reinstated my AD account.
dvdkon 7y ago
Being a "high school hacker" myself, I'd like to offer a slightly less dreary perspective. Some time back, I found multiple critical vulnerabilities in the most used school database system in the Czech Republic. The whole software is a mishmash of native Windows apps in Delphi and Visual FoxPro and an ASP.NET web interface built in a combination of VB, C# and WebForms. The desktop apps access MS SQL Server directly and security seems to have been done by a very uninformed person (the functionality is only a little better). I first told my school's network admin, who contacted the developers, who fixed the issues relatively quickly. Everything went relatively smoothly for me, but I know this depends mainly on the individual people involved.
- rjzzleep 7y ago
  When I was in high school my teacher actually proudly introduced me to the makers of the software they were using. They immediately dismissed it as known limitation not a bug. It allowed us to run arbitrary applications/code in their Kiosk application. In university where they still had HPUX I asked the IT department if I could get printer credits in exchange for exploits I report and he immediately got angry saying I should be proud to report them. Needless to say I ended up not reporting anything and just keeping them to myself. Thinking back I guess reporting it somewhere(maybe not in school) could have gotten me more opportunities, but who knows. I kinda wish there was some sort of mechanism to push people to make something out of their talents instead of suffocating them.
- mieseratte 7y ago
  I wasn't trying to be dreary so much as point out that entire school districts simply don't care about security one bit, even after being pwned. There's no incentive for one to give a damn, and we can't rely on good IT to be present in any given organization.
mslip 7y ago
Appreciate you sharing your perspective. I remember a friend of mine in middle/high school would load games onto the schools networked drives. It seems IT played the games too because they never did anything about it.
- mieseratte 7y ago
  One of my buddies did that, hid a half-dozen copies of Counter-Strike. IT took a few down, more would pop up. Senior year they got some software that would allow a teacher to monitor all classroom computer screens thus precluding our being able to play anymore. So the same buddy of mine behind the Counter-Strike copies made a wallpaper that was a screenshot of all kinds of infosec tools, WireShark, MetaSploit, etc. They didn't like that one either.
  - mslip 7y ago
    That’s amazing. Reminds of a personal finance class I took where we played a stock trading simulation based on prices from the actual market. One of my friends edited the HTML on the games page to make it look like he made millions. Teacher almost bought that one.
kclay 7y ago
I remember in college they had some data cap on our dorm internet. Just getting a Windows update could block you out for a while or completely. Well I got tired of it and for some reason looked up how to change my Mac address. I'm not sure how I figured it out but I realized that changing my Mac address would regain me access.. What I didn't know is that I would pick a random address that would knock off one of the higher ups net. Let me tell you, they did not like that one bit. I came back one day to my room mate saying that they raided my room trying to get into my pc. I ended up walking into the Dean's office of student Life and ended up explaining how I got back online. The head of IT didn't believe me saying you couldn't change your IP by changing your Mac address let alone that changing your Mac address was even possible. I didn't even bother trying to prove it. Mind you they also printed out like 200 pages of IRC logs.. I kept that open all day while in class so who knows what it captured. In the end I got the Kevin Mitnick treatment and they prevented me from using my dorm net as well as any campus PC. I just got a long cat 5 cable and ran it into the other room. What was odd was they were ok with letting me do my work study which gave me access to the school website. I guess they rather let me do that then fool around with other stuff. Fun times.

dvtrn 7y ago

“Accountability for thee, not so much for me”

deleted 7y ago
[deleted]
mieseratte 7y ago
Having written this story out, my inner conspiracy-theorist wonders if they kept it quiet because they were worried I might've stumbled onto something they didn't want the world to know, perhaps some type of financial mismanagement. To contrast I was arrested and sent to county jail, charged as an adult on a "distrubing the peace" style charge, by the same school for telling an administrator, in-private, to fuck off in response to a punishment levied without being told what I had actually done. Schools, eh?
- johnr2 7y ago
  > Schools, eh? The lesson that many in positions of authority are petty-minded fools is a valuable part of your education.

skinnymuch 7y ago

Were the private financial data you were able to poke around at also not patched up? Since that seems to be in their selfish interest to fix.

mieseratte 7y ago
As far as I'm aware they were mostly spreadsheets just sitting on the file-system. Given that all of the exploits were still available, including gaining local superuser accounts I would assume not. Who knows, maybe they were just running a honey-pot pretending and pretending to be outraged.

dchichkov 7y ago

These security vulnerabilities are there to educate the next generation. So they could experience the incredulity of finding out how fragile are the computer systems. Don't rob the next generation of experiences :)

moftz 7y ago

I got past the network drive quotas on accident in highschool and got my computer privileges taken away for a couple weeks. I still had computer classes that I needed to do work in but the admin didn't care. I already knew the local admin account password, all the same for every school computer, so I used that until he reinstated my AD account.

dvdkon 7y ago

Being a "high school hacker" myself, I'd like to offer a slightly less dreary perspective. Some time back, I found multiple critical vulnerabilities in the most used school database system in the Czech Republic. The whole software is a mishmash of native Windows apps in Delphi and Visual FoxPro and an ASP.NET web interface built in a combination of VB, C# and WebForms. The desktop apps access MS SQL Server directly and security seems to have been done by a very uninformed person (the functionality is only a little better). I first told my school's network admin, who contacted the developers, who fixed the issues relatively quickly. Everything went relatively smoothly for me, but I know this depends mainly on the individual people involved.

rjzzleep 7y ago
When I was in high school my teacher actually proudly introduced me to the makers of the software they were using. They immediately dismissed it as known limitation not a bug. It allowed us to run arbitrary applications/code in their Kiosk application. In university where they still had HPUX I asked the IT department if I could get printer credits in exchange for exploits I report and he immediately got angry saying I should be proud to report them. Needless to say I ended up not reporting anything and just keeping them to myself. Thinking back I guess reporting it somewhere(maybe not in school) could have gotten me more opportunities, but who knows. I kinda wish there was some sort of mechanism to push people to make something out of their talents instead of suffocating them.
mieseratte 7y ago
I wasn't trying to be dreary so much as point out that entire school districts simply don't care about security one bit, even after being pwned. There's no incentive for one to give a damn, and we can't rely on good IT to be present in any given organization.

mslip 7y ago

Appreciate you sharing your perspective. I remember a friend of mine in middle/high school would load games onto the schools networked drives. It seems IT played the games too because they never did anything about it.

mieseratte 7y ago
One of my buddies did that, hid a half-dozen copies of Counter-Strike. IT took a few down, more would pop up. Senior year they got some software that would allow a teacher to monitor all classroom computer screens thus precluding our being able to play anymore. So the same buddy of mine behind the Counter-Strike copies made a wallpaper that was a screenshot of all kinds of infosec tools, WireShark, MetaSploit, etc. They didn't like that one either.
- mslip 7y ago
  That’s amazing. Reminds of a personal finance class I took where we played a stock trading simulation based on prices from the actual market. One of my friends edited the HTML on the games page to make it look like he made millions. Teacher almost bought that one.

kclay 7y ago

I remember in college they had some data cap on our dorm internet. Just getting a Windows update could block you out for a while or completely. Well I got tired of it and for some reason looked up how to change my Mac address. I'm not sure how I figured it out but I realized that changing my Mac address would regain me access.. What I didn't know is that I would pick a random address that would knock off one of the higher ups net. Let me tell you, they did not like that one bit. I came back one day to my room mate saying that they raided my room trying to get into my pc. I ended up walking into the Dean's office of student Life and ended up explaining how I got back online. The head of IT didn't believe me saying you couldn't change your IP by changing your Mac address let alone that changing your Mac address was even possible. I didn't even bother trying to prove it. Mind you they also printed out like 200 pages of IRC logs.. I kept that open all day while in class so who knows what it captured. In the end I got the Kevin Mitnick treatment and they prevented me from using my dorm net as well as any campus PC. I just got a long cat 5 cable and ran it into the other room. What was odd was they were ok with letting me do my work study which gave me access to the school website. I guess they rather let me do that then fool around with other stuff. Fun times.