9 ms·

The fact that the administration didn't choose to sue them to oblivion is refreshing. I hope we'll see a trend in the future of educator being smart enough to a

by belval 5y ago

The fact that the administration didn't choose to sue them to oblivion is refreshing. I hope we'll see a trend in the future of educator being smart enough to admit that they made a mistake and to encourage the students to develop their talent. One can only hope.

nielsbot 5y ago
Probably helps that "We prepared complete documentation of everything we did, including recommendations to remediate the vulnerabilities we discovered. We went a comprehensive 26-page penetration test report to the D214 tech team and worked with them to help secure their network."
- IshKebab 5y ago
  That hasn't helped in the past. Frankly I think they were naive to reveal themselves no matter what the authorities said. It hasn't gone nearly as well for other people.
  - treesknees 5y ago
    The students were extremely lucky. The advice given to me in high school (I was working on tech projects after school for several teachers and groups) was to not even try or explore poking around the IT networks it no matter how good my intentions were. All it takes is one grumpy school administrator to feel undermined or to misunderstand your report and you could be expelled. When you're in a position like a student, you're still working your way up and building credibility. No need to risk it all for an IT group that doesn't want your security advice and didn't ask for your help.
    - adventured 5y ago
      It's always fascinating how dramatically different schools can be. When I was in high school, in the late 1990s, nobody would have cared so much about something along these lines. At worst it would have resulted in a three day suspension from school and lecture from the principle.
    - PradeetPatel 5y ago
      Seconded, the same advice has also been given to me back in India. "Know where your boundaries are and who your stakeholders are, don't do anything that will make your stakeholders look bad." It's a life advice given to me by my high school teacher that served me well in my professional life.
      - deleted 5y ago
        [deleted]
    - rootsudo 5y ago
      Yep - I, like many of my friends and people who are naturally curious and work today in "Cybersecurity" had fun, poked around - but once you found little data troves - it reveals how inept alot of people can be. And you just volunteer to be thrown under the bus as that "hacker." Anonymous, maybe. As a student, under 18 - you're "immune" from many things - but it can be a stain.
    - dylan604 5y ago
      It doesn't stop at the student level. Find something at the corp level with an arrogant IT dept, and you'll find yourself in uncomforatable situations as well.
    - colinmhayes 5y ago
      He had already graduated, so expulsion wasn't an option.
      - ohazi 5y ago
        Expulsion is one of the friendlier outcomes. Federal prosecution and prison time are also very realistic options here. It's happened to other well-meaning kids on many occasions.
      - treesknees 5y ago
        He had already graduated when he wrote his blog post and told them, he was still a student when he performed the hacking. I realize this is conjecture but I'm giving an example. Speaking from experience receiving "security reports" from users and students, often times they fail to understand the full picture of IT. As a student with no buy-in from the stakeholders, the risk isn't worth it. For example, let's say this IoT network was managed by a vendor who, while having sloppy configuration practices, also had network monitoring looking for APT/anomalies (such as new connections in off-hours or unusual connection rates or bandwidth usage.) While the student thinks they're being sneaky and hacking the system at night, opening ssh connections to a hundred devices from his laptop, there are now reports and alarms going off on a monitoring system. Some basic timestamps and VPN access logs would be enough to point to the student. So this student thinks they're creating an anonymous harmless prank, but the IT department is already investigating a malicious actor on their network. How do you think this would end?
  - 63 5y ago
    He addresses this pretty well in the post imo. His co-conspiritors remained unnamed while he alone revealed himself because he wanted to publish this post and it's highly likely he would've been blamed anyway.
  - dont__panic 5y ago
    The poster/hacker actually addresses this -- he doesn't reveal himself until after graduation, keeps his fellow hackers secret still, and mentions that he was most likely the prime suspect in the district anyway. Seems like a fair tradeoff if he wanted to make this blog post, though school districts could be nasty and litigious, I guess.
    - duped 5y ago
      It's still a terrible idea to admit to committing a crime under your real name before the statute of limitations has run out
      - generalizations 5y ago
        Is there even a statute of limitations for this kind of thing? Seems way better to just never admit to it at all.
        greyface- 5y ago
        The CFAA has a statute of limitations of 2 years.
    - throwawayboise 5y ago
      Pretty sure there's nothing stopping the school district from retroactively recinding his graduation, or refusing to send transcripts to universities, or informing those universities of his transgressions, which would probably result in revoked admission.
- munificent 5y ago
  In many cases, a 26-page report documenting the incompetency of a team would not be taken kindly.
  - AnIdiotOnTheNet 5y ago
    I find it annoying that people immediately assume incompetence and not inadequate staffing or conflicting priorities. I worked at a school district for a few years and we were woefully understaffed for what we had to cover. In situations like that you do what you have to so teachers can teach, move on to the next emergency, and hope like hell some self-important little shit doesn't burn everything to the ground.
bluedino 5y ago
I'm glad to see a kid using bash and not something like gulp PowerShell
- codezero 5y ago
  Not to diminish your comment, but a thing I've found late my career is to abandon dogma when it comes to young folks learning. If they can learn with PowerShell, they're a lot better off than a lot of young folks! There is no one-true-way and as soon as you find it, another generation will show up with another-true-way :)
- blacktriangle 5y ago
  Credit where credit is due, we all WISH *nix had something like PowerShell. Passing strings from program to program is a pain, passing around .NET objects instead is a great step forward, as can be seen by the several attempts at similar shells passing around JSON objects.
  - jdmichal 5y ago
    PowerShell has been available on Linux via .NET Core since 2016 and version 6.0. Even my Windows box with PowerShell 5.1 likes to remind me of this fact every time I start it: Windows PowerShell Copyright (C) Microsoft Corporation. All rights reserved. Try the new cross-platform PowerShell https://aka.ms/pscore6
    - judge2020 5y ago
      On that note, i'm saddened Windows 11 doesn't ship with Powershell 7. Are there that many breaking changes in the switch from 5 -> 6 or 5 -> 7?
    - jerrysievert 5y ago
      yep, always good to get ads on your shell when you start it. it's like those awesome ubuntu login motd's, I look forward to them every time I log in, just in case the ad changes. er ...
  - 5y ago
edoceo 5y ago
Too right! Get this kid a job, not punishment.
_wldu 5y ago
Being a minor probably helps. There are so many laws today. It's too risky to do this. It's not like it was 25 years ago.
- bluedino 5y ago
  Yea , kids would get expelled in the old days for putting a screensaver password
- flatiron 5y ago
  I was suspended for a week for creating a network share in my typing class and dividing the work among my friends and we copied and pasted into a single document on the share. This was on Windows NT though so a LONG time ago. It's also I guess "cheating". But they got us on "computer hacking"
  - johnebgd 5y ago
    I used CACLS with an Office hack in NT / 9X to copy homework. Never got caught for that. They got me on propagating computer games through the network using shared drives the teachers were supposed to use for homework. We had BNC network cables in those days and the entire building shared a single T1 line for several hundred computers. The world has changed.
  - squareof 5y ago
    Same thing here. Teacher came into class with his multiple month investigation comparing all students work highlighting common errors. Found three different groups that were sharing work load. In school suspension for all of us, only like three kids left in class for the week.
  - arenaninja 5y ago
    Also in my typing class circa 2004 the teacher was about to kick me out because he thought I was on a chat room during his class. I was actually viewing page source on an HTML document
    - 5y ago
Waterluvian 5y ago
Yep. What they did was wrong. And by doing so they threw themselves at the mercy of the entity they hacked. The refreshing part is that the entity did the morally right thing and showed mercy.
- Angostura 5y ago
  > What they did was wrong. It was certainly against the rules. I'm not so sure it was wrong.
  - Waterluvian 5y ago
    If I broke into your home tonight to play a prank on you and then handed you a white paper about how to better secure it, how would you feel?
    - NaturalPhallacy 5y ago
      Breaking and entering vs. playing a harmless video at the end of the day in school. False equivalence.
      - Waterluvian 5y ago
        Unlawful access to a computer network is often a far more serious crime with stiffer penalties. So perhaps you’re right that it is a false equivalence.
        teddyh 5y ago
        Now you’re reverting to the “it’s against the rules” stance again.
    - GreenWatermelon 5y ago
      except in the case of my home all my doors were unlocked. I would definitely appreciate a paper about how to secure my home, especially if the intruder took great care not to cause any damage or disturbance.
Accujack 5y ago
I'm sure it helps a lot that they're in a high tax base area, and the quality of the educators hired probably reflects that. https://statisticalatlas.com/school-district/Illinois/Township-High-School-District-214/Overview https://statisticalatlas.com/school-district/Illinois/Townsh...
sneak 5y ago
"sue" suggests civil action and a decision by the wronged party. They're lucky a prosecutor didn't prosecute them for criminal activity. The school would not have any say about whether or not this happens.
- throwaway0a5e 5y ago
  >The school would not have any say about whether or not this happens. Schools are members of the local government "club". Prosecutors don't generally burn political capital giving the bird to other members of the club like that without a good reason.

by belval 5y ago

nielsbot 5y ago

Probably helps that "We prepared complete documentation of everything we did, including recommendations to remediate the vulnerabilities we discovered. We went a comprehensive 26-page penetration test report to the D214 tech team and worked with them to help secure their network."

IshKebab 5y ago
That hasn't helped in the past. Frankly I think they were naive to reveal themselves no matter what the authorities said. It hasn't gone nearly as well for other people.
- treesknees 5y ago
  The students were extremely lucky. The advice given to me in high school (I was working on tech projects after school for several teachers and groups) was to not even try or explore poking around the IT networks it no matter how good my intentions were. All it takes is one grumpy school administrator to feel undermined or to misunderstand your report and you could be expelled. When you're in a position like a student, you're still working your way up and building credibility. No need to risk it all for an IT group that doesn't want your security advice and didn't ask for your help.
  - adventured 5y ago
    It's always fascinating how dramatically different schools can be. When I was in high school, in the late 1990s, nobody would have cared so much about something along these lines. At worst it would have resulted in a three day suspension from school and lecture from the principle.
  - PradeetPatel 5y ago
    Seconded, the same advice has also been given to me back in India. "Know where your boundaries are and who your stakeholders are, don't do anything that will make your stakeholders look bad." It's a life advice given to me by my high school teacher that served me well in my professional life.
    - deleted 5y ago
      [deleted]
  - rootsudo 5y ago
    Yep - I, like many of my friends and people who are naturally curious and work today in "Cybersecurity" had fun, poked around - but once you found little data troves - it reveals how inept alot of people can be. And you just volunteer to be thrown under the bus as that "hacker." Anonymous, maybe. As a student, under 18 - you're "immune" from many things - but it can be a stain.
  - dylan604 5y ago
    It doesn't stop at the student level. Find something at the corp level with an arrogant IT dept, and you'll find yourself in uncomforatable situations as well.
  - colinmhayes 5y ago
    He had already graduated, so expulsion wasn't an option.
    - ohazi 5y ago
      Expulsion is one of the friendlier outcomes. Federal prosecution and prison time are also very realistic options here. It's happened to other well-meaning kids on many occasions.
    - treesknees 5y ago
      He had already graduated when he wrote his blog post and told them, he was still a student when he performed the hacking. I realize this is conjecture but I'm giving an example. Speaking from experience receiving "security reports" from users and students, often times they fail to understand the full picture of IT. As a student with no buy-in from the stakeholders, the risk isn't worth it. For example, let's say this IoT network was managed by a vendor who, while having sloppy configuration practices, also had network monitoring looking for APT/anomalies (such as new connections in off-hours or unusual connection rates or bandwidth usage.) While the student thinks they're being sneaky and hacking the system at night, opening ssh connections to a hundred devices from his laptop, there are now reports and alarms going off on a monitoring system. Some basic timestamps and VPN access logs would be enough to point to the student. So this student thinks they're creating an anonymous harmless prank, but the IT department is already investigating a malicious actor on their network. How do you think this would end?
- 63 5y ago
  He addresses this pretty well in the post imo. His co-conspiritors remained unnamed while he alone revealed himself because he wanted to publish this post and it's highly likely he would've been blamed anyway.
- dont__panic 5y ago
  The poster/hacker actually addresses this -- he doesn't reveal himself until after graduation, keeps his fellow hackers secret still, and mentions that he was most likely the prime suspect in the district anyway. Seems like a fair tradeoff if he wanted to make this blog post, though school districts could be nasty and litigious, I guess.
  - duped 5y ago
    It's still a terrible idea to admit to committing a crime under your real name before the statute of limitations has run out
    - generalizations 5y ago
      Is there even a statute of limitations for this kind of thing? Seems way better to just never admit to it at all.
      - greyface- 5y ago
        The CFAA has a statute of limitations of 2 years.
  - throwawayboise 5y ago
    Pretty sure there's nothing stopping the school district from retroactively recinding his graduation, or refusing to send transcripts to universities, or informing those universities of his transgressions, which would probably result in revoked admission.
munificent 5y ago
In many cases, a 26-page report documenting the incompetency of a team would not be taken kindly.
- AnIdiotOnTheNet 5y ago
  I find it annoying that people immediately assume incompetence and not inadequate staffing or conflicting priorities. I worked at a school district for a few years and we were woefully understaffed for what we had to cover. In situations like that you do what you have to so teachers can teach, move on to the next emergency, and hope like hell some self-important little shit doesn't burn everything to the ground.

bluedino 5y ago

I'm glad to see a kid using bash and not something like gulp PowerShell

codezero 5y ago
Not to diminish your comment, but a thing I've found late my career is to abandon dogma when it comes to young folks learning. If they can learn with PowerShell, they're a lot better off than a lot of young folks! There is no one-true-way and as soon as you find it, another generation will show up with another-true-way :)
blacktriangle 5y ago
Credit where credit is due, we all WISH *nix had something like PowerShell. Passing strings from program to program is a pain, passing around .NET objects instead is a great step forward, as can be seen by the several attempts at similar shells passing around JSON objects.
- jdmichal 5y ago
  PowerShell has been available on Linux via .NET Core since 2016 and version 6.0. Even my Windows box with PowerShell 5.1 likes to remind me of this fact every time I start it: Windows PowerShell Copyright (C) Microsoft Corporation. All rights reserved. Try the new cross-platform PowerShell https://aka.ms/pscore6
  - judge2020 5y ago
    On that note, i'm saddened Windows 11 doesn't ship with Powershell 7. Are there that many breaking changes in the switch from 5 -> 6 or 5 -> 7?
  - jerrysievert 5y ago
    yep, always good to get ads on your shell when you start it. it's like those awesome ubuntu login motd's, I look forward to them every time I log in, just in case the ad changes. er ...
- 5y ago

edoceo 5y ago

Too right! Get this kid a job, not punishment.

_wldu 5y ago

Being a minor probably helps. There are so many laws today. It's too risky to do this. It's not like it was 25 years ago.

bluedino 5y ago
Yea , kids would get expelled in the old days for putting a screensaver password
flatiron 5y ago
I was suspended for a week for creating a network share in my typing class and dividing the work among my friends and we copied and pasted into a single document on the share. This was on Windows NT though so a LONG time ago. It's also I guess "cheating". But they got us on "computer hacking"
- johnebgd 5y ago
  I used CACLS with an Office hack in NT / 9X to copy homework. Never got caught for that. They got me on propagating computer games through the network using shared drives the teachers were supposed to use for homework. We had BNC network cables in those days and the entire building shared a single T1 line for several hundred computers. The world has changed.
- squareof 5y ago
  Same thing here. Teacher came into class with his multiple month investigation comparing all students work highlighting common errors. Found three different groups that were sharing work load. In school suspension for all of us, only like three kids left in class for the week.
- arenaninja 5y ago
  Also in my typing class circa 2004 the teacher was about to kick me out because he thought I was on a chat room during his class. I was actually viewing page source on an HTML document
  - 5y ago

Waterluvian 5y ago

Yep. What they did was wrong. And by doing so they threw themselves at the mercy of the entity they hacked. The refreshing part is that the entity did the morally right thing and showed mercy.

Angostura 5y ago
> What they did was wrong. It was certainly against the rules. I'm not so sure it was wrong.
- Waterluvian 5y ago
  If I broke into your home tonight to play a prank on you and then handed you a white paper about how to better secure it, how would you feel?
  - NaturalPhallacy 5y ago
    Breaking and entering vs. playing a harmless video at the end of the day in school. False equivalence.
    - Waterluvian 5y ago
      Unlawful access to a computer network is often a far more serious crime with stiffer penalties. So perhaps you’re right that it is a false equivalence.
      - teddyh 5y ago
        Now you’re reverting to the “it’s against the rules” stance again.
  - GreenWatermelon 5y ago
    except in the case of my home all my doors were unlocked. I would definitely appreciate a paper about how to secure my home, especially if the intruder took great care not to cause any damage or disturbance.

Accujack 5y ago

I'm sure it helps a lot that they're in a high tax base area, and the quality of the educators hired probably reflects that. https://statisticalatlas.com/school-district/Illinois/Township-High-School-District-214/Overview https://statisticalatlas.com/school-district/Illinois/Townsh...

sneak 5y ago

"sue" suggests civil action and a decision by the wronged party. They're lucky a prosecutor didn't prosecute them for criminal activity. The school would not have any say about whether or not this happens.

throwaway0a5e 5y ago
>The school would not have any say about whether or not this happens. Schools are members of the local government "club". Prosecutors don't generally burn political capital giving the bird to other members of the club like that without a good reason.