5 ms·

Blackboard. Ha ha ha. Blackboard. When I was in school, there was a vulnerability where you could reach courses that you didn't belong to, simply by changing

Blackboard. Ha ha ha. Blackboard. When I was in school, there was a vulnerability where you could reach courses that you didn't belong to, simply by changing the id in the URL. A couple of students got punished (banned from school computers for months) for exploiting this (to leave a message on said courses). As of a year later, the vulnerability was still not fixed (although the messaging infrastructure was disabled).

na85 7y ago
Heh. When I was in school (maybe dating myself here), there was a blanket prohibition on accessing "DOS Screens" because the total morons that ran the school's IT department couldn't lock it down and someone sent a bunch of popup messages to the entire campus using net send.
- wlesieutre 7y ago
  A friend of mine got hassled in the high school computer lab for being in cpanel for his personal website. Apparently it looked scary. Security on the old Macs was hilarious though - the student user accounts had a limited set of applications they were allowed to launch, but it was only enforced via Finder checking when you double clicked it. There were so many other ways to launch things. Custom buttons in AppleWorks toolbars, AppleScript, dragging it into Safari and then opening it from the downloads manager, and setting the creator code to match any application you had permission for were convenient options. Don't have access to run Script Editor? That's ok, type applescript: into Safari's URL bar and it'll pop right up.
- standyro 7y ago
  lol... I got suspended when I was in High School in 2005 for doing this...
- zentiggr 7y ago
  I was a bad fit for my high school's Computer shop curriculum. Sophmore year I was supposed to learn COBOL. I also learned Fortran-77, the Prime mainframe's JCL, found and learned the assembly language for the Prime 750, accidentally accessed all the HDD partitions (for eight local schools and six police departments) and got suspended for using 30000% more CPU time than all other users combined, while exploring. My family made a fuss when they wanted to expel me and I switched over to Electronics. Had a grand time.
- flatiron 7y ago
  this was on nt3.5 (or maybe nt4) but we had some smb shares that were simply public with r/w. i created a folder that i hid deep in there and in my typing class me and my friends would do 1/5 the assignment and merge them all together on this share. one time someone made a mistake and obviously we all had the same mistake and we were suspended for "hacking" even though we showed them it was just a friggin directory. they also gave us all F's for the typing class, my gpa thanked them for that.... after that i think either the CDC or l0phtcrack or one of those groups posted a way you can get to the user/groups window with admin privledges. i did that on one of the library computers which was logged in with the library account and deleted the admin group. what a shit storm that was. i was never caught for that one thank goodness. i was a terrible script kiddie!
- allendoerfer 7y ago
  At my school we had "net send shutdown" fights, which escalated, so you had to write defensive .bat scripts aborting the shutdown in a loop on your own PC.
- BubRoss 7y ago
  Once a dialup ISP threatened to ban me for 'hacking' them because I logged in through telnet with my username and password.
- Accacin 7y ago
  Heh. That reminds me, at college we figured out that you could send a remote shutdown command, and all you needed was a computer name. Also you could set the timeout to '0' so that they'd have no chance to save their work. We often shared our computer lab with others, so whenever they came into the room we'd shut the computer down and watch them get confused, move to another PC and we'd shut that down too.
- stordoff 7y ago
  net send is what tipped my school off to a group of students having deeper access to the network than they should. Turns out 'net send * "Hiya Man!"' is not very subtle. Before that, people were only sending to individual users, but apparently someone didn't think through the consequences of sending to * - it took about 2-3 minutes for the IT manager to show up. Weirdly, it was still possible _after_ that - a friend of mine experimented with using a tool to change the sender address (his IT teacher knew, but just told him "If you're going to do this, don't get caught"), so getting a "Message from GOD" wasn't uncommon. They apparently missed that another group had already created their own domain admin account, and didn't notice that until some weeks after the net send incident (I think it lead to them paying closer attention for anything unusual happening). I do think they brought it on themselves to some extent - having a domain admin password of "school" (easily shoulder-surfed), later "<name of school with an o replaced with a 0>7" (ophcrack made short work of that one, using cached credentials), and a VNC password of "vnc" (server installed on every machine in the school), is asking for trouble. Fortunately they weren't malicious, just curious (the most "damage" they did was changing a single pixel in the desktop background of all users to see if it was possible) - they even slipped a note under the IT Admin's door with the current domain admin password on it, but apparently they either didn't see it or didn't act on it. Given they had write access to every user's network drive, it could have been far worse. It ended up being a lesson in OPSEC as well - getting logged on a rogue domain admin account using a device called "<family name> USB" is a bit of a red flag. I think the punishment was pretty fair though (despite some initial ranting from senior leadership about suspensions and getting the police involved - cooler heads from the deputy leadership and IT technicians prevailed) - helping the IT technicians out for a week, which amounted to cataloguing hardware (chasing down services tags), and re-wiring a couple of the computer rooms.
- giomasce 7y ago
  When I was in school (computers were running Win 95, I believe), I discovered a lot of nice software like NetSeven and BackOrifice, and I infected the school computers with it. Then I would play tricks to my school mates by displaying a lot of modal dialogs, or something. I never did anything nasty and that sort of programs did not autoreplicate or infect other media, but in hindsight it was quite irresponsible, especially because I did not manage to deinfect the computers when leaving the school. Fortunately nobody ever seemed to find out.
esmi 7y ago
> where you could reach courses that you did not belong to... students got punished Were they only viewing material? Students viewing (and perhaps learning from) extra material should be commended! :)

na85 7y ago

Heh. When I was in school (maybe dating myself here), there was a blanket prohibition on accessing "DOS Screens" because the total morons that ran the school's IT department couldn't lock it down and someone sent a bunch of popup messages to the entire campus using net send.

wlesieutre 7y ago
A friend of mine got hassled in the high school computer lab for being in cpanel for his personal website. Apparently it looked scary. Security on the old Macs was hilarious though - the student user accounts had a limited set of applications they were allowed to launch, but it was only enforced via Finder checking when you double clicked it. There were so many other ways to launch things. Custom buttons in AppleWorks toolbars, AppleScript, dragging it into Safari and then opening it from the downloads manager, and setting the creator code to match any application you had permission for were convenient options. Don't have access to run Script Editor? That's ok, type applescript: into Safari's URL bar and it'll pop right up.
standyro 7y ago
lol... I got suspended when I was in High School in 2005 for doing this...
zentiggr 7y ago
I was a bad fit for my high school's Computer shop curriculum. Sophmore year I was supposed to learn COBOL. I also learned Fortran-77, the Prime mainframe's JCL, found and learned the assembly language for the Prime 750, accidentally accessed all the HDD partitions (for eight local schools and six police departments) and got suspended for using 30000% more CPU time than all other users combined, while exploring. My family made a fuss when they wanted to expel me and I switched over to Electronics. Had a grand time.
flatiron 7y ago
this was on nt3.5 (or maybe nt4) but we had some smb shares that were simply public with r/w. i created a folder that i hid deep in there and in my typing class me and my friends would do 1/5 the assignment and merge them all together on this share. one time someone made a mistake and obviously we all had the same mistake and we were suspended for "hacking" even though we showed them it was just a friggin directory. they also gave us all F's for the typing class, my gpa thanked them for that.... after that i think either the CDC or l0phtcrack or one of those groups posted a way you can get to the user/groups window with admin privledges. i did that on one of the library computers which was logged in with the library account and deleted the admin group. what a shit storm that was. i was never caught for that one thank goodness. i was a terrible script kiddie!
allendoerfer 7y ago
At my school we had "net send shutdown" fights, which escalated, so you had to write defensive .bat scripts aborting the shutdown in a loop on your own PC.
BubRoss 7y ago
Once a dialup ISP threatened to ban me for 'hacking' them because I logged in through telnet with my username and password.
Accacin 7y ago
Heh. That reminds me, at college we figured out that you could send a remote shutdown command, and all you needed was a computer name. Also you could set the timeout to '0' so that they'd have no chance to save their work. We often shared our computer lab with others, so whenever they came into the room we'd shut the computer down and watch them get confused, move to another PC and we'd shut that down too.
stordoff 7y ago
net send is what tipped my school off to a group of students having deeper access to the network than they should. Turns out 'net send * "Hiya Man!"' is not very subtle. Before that, people were only sending to individual users, but apparently someone didn't think through the consequences of sending to * - it took about 2-3 minutes for the IT manager to show up. Weirdly, it was still possible _after_ that - a friend of mine experimented with using a tool to change the sender address (his IT teacher knew, but just told him "If you're going to do this, don't get caught"), so getting a "Message from GOD" wasn't uncommon. They apparently missed that another group had already created their own domain admin account, and didn't notice that until some weeks after the net send incident (I think it lead to them paying closer attention for anything unusual happening). I do think they brought it on themselves to some extent - having a domain admin password of "school" (easily shoulder-surfed), later "<name of school with an o replaced with a 0>7" (ophcrack made short work of that one, using cached credentials), and a VNC password of "vnc" (server installed on every machine in the school), is asking for trouble. Fortunately they weren't malicious, just curious (the most "damage" they did was changing a single pixel in the desktop background of all users to see if it was possible) - they even slipped a note under the IT Admin's door with the current domain admin password on it, but apparently they either didn't see it or didn't act on it. Given they had write access to every user's network drive, it could have been far worse. It ended up being a lesson in OPSEC as well - getting logged on a rogue domain admin account using a device called "<family name> USB" is a bit of a red flag. I think the punishment was pretty fair though (despite some initial ranting from senior leadership about suspensions and getting the police involved - cooler heads from the deputy leadership and IT technicians prevailed) - helping the IT technicians out for a week, which amounted to cataloguing hardware (chasing down services tags), and re-wiring a couple of the computer rooms.
giomasce 7y ago
When I was in school (computers were running Win 95, I believe), I discovered a lot of nice software like NetSeven and BackOrifice, and I infected the school computers with it. Then I would play tricks to my school mates by displaying a lot of modal dialogs, or something. I never did anything nasty and that sort of programs did not autoreplicate or infect other media, but in hindsight it was quite irresponsible, especially because I did not manage to deinfect the computers when leaving the school. Fortunately nobody ever seemed to find out.

esmi 7y ago

> where you could reach courses that you did not belong to... students got punished Were they only viewing material? Students viewing (and perhaps learning from) extra material should be commended! :)