7 ms·

I was expelled from university for pulling off the exact same exploit with the "workstation only" feature in Novell. In my case, they put a computer in every do

I was expelled from university for pulling off the exact same exploit with the "workstation only" feature in Novell. In my case, they put a computer in every dorm room, and every single one of them had a domain-wide administrator account cached in its SAM file. It was inevitable that a student would find it. It's been almost 15 years now but I believe the password was rac3c4r or something trivial like that. I ran Ophcrack overnight and in the morning I had admin access to every machine on campus. I also had the bright idea to try this on library computers and email kiosks around campus used by thousands of students. Rather than booting into Ophcrack I'd just log in with the admin account and run pwdump from a USB stick to collect password hashes. I figured out how to enumerate Windows machines over the network using NetBIOS and ran the pwdump utility remotely using psexec, so that I could hit every computer in the library at once, or every computer in a computer lab, etc. I ended up cracking credentials for most students and faculty on the entire campus. I was really young at the time and thought this was some real cool James Bond shit. I never once used it for evil: never read anyone's email, never viewed anyone's private files, never poked around the academic file shares for test solutions, never tried to steal credit card numbers or social security numbers from the finance office's file share. It was purely a hack for the thrill of breaking down barriers and outsmarting the security. But MONTHS later after I had long since grown tired of tinkering with this stuff, a couple of uniformed police officers pulled me out of Calculus class and took me downtown. They tossed my dorm room and confiscated my computer and my phone and every piece of digital storage I owned. The school threw the book at me, I guess because they were so embarrassed by their incompetence on display from being beaten by a 16 year old. (Posting on my alt account for obvious reasons.)

minikites 7y ago
>I never once used it for evil: never read anyone's email, never viewed anyone's private files, never poked around the academic file shares for test solutions, never tried to steal credit card numbers or social security numbers from the finance office's file share. I don't understand this justification. The system owners can't know that to be true and have to proceed as if the systems are compromised. Would you still feel safe if a burglar broke into your house and left a note saying they didn't take anything?
- JauntyHatAngle 7y ago
  Isn't this more like duplicating everyones house key? He never actually went into the houses.
  - inakarmacoma 7y ago
    Only if you can know he didn't actually go in. Even now, do you believe he never liked at a single private file?
    - lordlic 7y ago
      What possible reason would I have to lie about it? You think I'm worried about investigators raiding my VPN service so they can track down and charge a grown-ass man in juvenile court for something that happened 15 years ago? You think I'm worried about my reputation on this throwaway account with a grand total of five previous comments? What's the point in believing that this whole escapade happened at all if you're going to randomly doubt a particular element of it? I was a kid, I was stupid, but I wasn't an asshole. I didn't go peeking and violating people's privacy because that would have been a dick move. Just like tons of people on Hacker News today have access to personal data on SaaS systems we maintain and don't go peeking. Just like tons of people are perfectly capable of picking their neighbor's locks but don't walk into their house for no reason. It's not even tempting. I don't care what's in my neighbor's house, and I don't care what's in random other students' homework documents or email or whatever. The only interesting part was breaking the security.
    - deleted 7y ago
      [deleted]
  - waway 7y ago
    Except he went in the Admin's house: > I'd just log in with the admin account and run pwdump
    - lordlic 7y ago
      Just to be clear, in case this matters, it wasn't an account belonging to an administrator, it was a default superuser account called (if I remember right) "TECH" in all caps, and didn't have any files or anything in it. It's not like it was a person and I was poking around their private stuff.
whalesalad 7y ago
Yes! The SAM! It’s all coming back to me now.
zippergz 7y ago
Do you know how they ended up finding out about it and catching you?
- lordlic 7y ago
  Yeah. My technical tracks were covered. It was the roommate of one of my friends. He overheard me talking about it and ratted me out.
  - daedalus6174 7y ago
    What a punk
    - Aeolun 7y ago
      That is an understatement. I wonder what kind of backstabber he grew up to be :/
      - philpem 7y ago
        Probably a politician.
      - CraneWorm 7y ago
        The concerned kind. Refusing to keep their mouth shut when others exploit the system. This is a problem, here GP is a hero, a hacker, a free spirit. But there is no point in romanticizing such behavior. If you find a vulnerability in a system, you disclose it to the people that should know about it. You can do that anonymously, or you can alert people in a subtle way. What you don't do is sit on it and brag to people what a clever person you are.
        Aeolun 7y ago
        What the OP did is (in this case) irrelevant to what the asshole did. There were multiple ways he could have gone about dealing with the situation that did not involve fucking someone over, but he chose to do that instead. I just cannot attribute something like that to altruism.
ikurei 7y ago
Can't help but wonder, didn't you think about reporting this, anonimously at least? If you figured this out, it wasn't all that unlikely that a less scrupulous hacker could have. (Not judging, both because I don't like to and because you were a kid.)
tikiman163 7y ago
Sigh, I grow tired of pointing this out, but if they were able to figure out someone was doing this, and even who it was, then you weren't a l33t hacker. You used common tools and used a known exploit that people were watching. You broke rules for personal enjoyment and weren't even good enough to not get caught. You didn't beat them, they beat you. It doesn't matter if you went unnoticed for several months, the fact is standard monitoring and logs were your down fall. Nobody ever thinks of the log files and network monitoring tools as being part of security. Not being prevented from accessing the system is not the same thing as successfully hacking a system unless you aren't caught either.
- CodexArcanum 7y ago
  He points out below that he was caught because another student overheard him discussing it and ratted on him. I feel like a real hacker wouldn't make a bunch of untested assumptions about situations they have no context for.
  - KnMn 7y ago
    Real Hacker™
- tastroder 7y ago
  > You broke rules for personal enjoyment and weren't even good enough to not get caught. Otherwise known as being young and in their formative years. Plenty of HN had similar experiences and luckily even 15 years ago this harsh view on teenage stupidity was in the minority. He also doesn't seem claim to be a l33t whatever. > Not being prevented from accessing the system is not the same thing as successfully hacking a system unless you aren't caught either. > You didn't beat them, they beat you. They beat themselves, which was understandable back in the day but that's a popular narrative to this day. If a school kid with random scripts or untargeted ransomware gets into a system I put far more blame on the process that prevented them from being patched than said kid.

minikites 7y ago

>I never once used it for evil: never read anyone's email, never viewed anyone's private files, never poked around the academic file shares for test solutions, never tried to steal credit card numbers or social security numbers from the finance office's file share. I don't understand this justification. The system owners can't know that to be true and have to proceed as if the systems are compromised. Would you still feel safe if a burglar broke into your house and left a note saying they didn't take anything?

JauntyHatAngle 7y ago
Isn't this more like duplicating everyones house key? He never actually went into the houses.
- inakarmacoma 7y ago
  Only if you can know he didn't actually go in. Even now, do you believe he never liked at a single private file?
  - lordlic 7y ago
    What possible reason would I have to lie about it? You think I'm worried about investigators raiding my VPN service so they can track down and charge a grown-ass man in juvenile court for something that happened 15 years ago? You think I'm worried about my reputation on this throwaway account with a grand total of five previous comments? What's the point in believing that this whole escapade happened at all if you're going to randomly doubt a particular element of it? I was a kid, I was stupid, but I wasn't an asshole. I didn't go peeking and violating people's privacy because that would have been a dick move. Just like tons of people on Hacker News today have access to personal data on SaaS systems we maintain and don't go peeking. Just like tons of people are perfectly capable of picking their neighbor's locks but don't walk into their house for no reason. It's not even tempting. I don't care what's in my neighbor's house, and I don't care what's in random other students' homework documents or email or whatever. The only interesting part was breaking the security.
  - deleted 7y ago
    [deleted]
- waway 7y ago
  Except he went in the Admin's house: > I'd just log in with the admin account and run pwdump
  - lordlic 7y ago
    Just to be clear, in case this matters, it wasn't an account belonging to an administrator, it was a default superuser account called (if I remember right) "TECH" in all caps, and didn't have any files or anything in it. It's not like it was a person and I was poking around their private stuff.

whalesalad 7y ago

Yes! The SAM! It’s all coming back to me now.

zippergz 7y ago

Do you know how they ended up finding out about it and catching you?

lordlic 7y ago
Yeah. My technical tracks were covered. It was the roommate of one of my friends. He overheard me talking about it and ratted me out.
- daedalus6174 7y ago
  What a punk
  - Aeolun 7y ago
    That is an understatement. I wonder what kind of backstabber he grew up to be :/
    - philpem 7y ago
      Probably a politician.
    - CraneWorm 7y ago
      The concerned kind. Refusing to keep their mouth shut when others exploit the system. This is a problem, here GP is a hero, a hacker, a free spirit. But there is no point in romanticizing such behavior. If you find a vulnerability in a system, you disclose it to the people that should know about it. You can do that anonymously, or you can alert people in a subtle way. What you don't do is sit on it and brag to people what a clever person you are.
      - Aeolun 7y ago
        What the OP did is (in this case) irrelevant to what the asshole did. There were multiple ways he could have gone about dealing with the situation that did not involve fucking someone over, but he chose to do that instead. I just cannot attribute something like that to altruism.

ikurei 7y ago

Can't help but wonder, didn't you think about reporting this, anonimously at least? If you figured this out, it wasn't all that unlikely that a less scrupulous hacker could have. (Not judging, both because I don't like to and because you were a kid.)

tikiman163 7y ago

Sigh, I grow tired of pointing this out, but if they were able to figure out someone was doing this, and even who it was, then you weren't a l33t hacker. You used common tools and used a known exploit that people were watching. You broke rules for personal enjoyment and weren't even good enough to not get caught. You didn't beat them, they beat you. It doesn't matter if you went unnoticed for several months, the fact is standard monitoring and logs were your down fall. Nobody ever thinks of the log files and network monitoring tools as being part of security. Not being prevented from accessing the system is not the same thing as successfully hacking a system unless you aren't caught either.

CodexArcanum 7y ago
He points out below that he was caught because another student overheard him discussing it and ratted on him. I feel like a real hacker wouldn't make a bunch of untested assumptions about situations they have no context for.
- KnMn 7y ago
  Real Hacker™
tastroder 7y ago
> You broke rules for personal enjoyment and weren't even good enough to not get caught. Otherwise known as being young and in their formative years. Plenty of HN had similar experiences and luckily even 15 years ago this harsh view on teenage stupidity was in the minority. He also doesn't seem claim to be a l33t whatever. > Not being prevented from accessing the system is not the same thing as successfully hacking a system unless you aren't caught either. > You didn't beat them, they beat you. They beat themselves, which was understandable back in the day but that's a popular narrative to this day. If a school kid with random scripts or untargeted ransomware gets into a system I put far more blame on the process that prevented them from being patched than said kid.