4 ms·

I was put into isolation for three weeks during high school when I was found to be hacking my way through the network. In reality I had found access to the remo

I was put into isolation for three weeks during high school when I was found to be hacking my way through the network. In reality I had found access to the remote server through the winword.exe open dialog that didn't require passwords and was displaying in the list of network drives, but didn't in explorer. Because I found this, I was able to find the RM (Research Machines) Management Console and use a teachers (actually the deputy head) password "teacher" (no word of a lie) to create a hidden admin user in the list of student accounts. Through this I could get to RM Tutor 3 which allowed me to control every PC in the school. I was gathering information to give to the IT staff, but I was grassed on instead, so I was in the wrong. I spent 3 weeks explaining everything and how to fix it, then I was allowed to continue my quest so long as I asked permission and gave info straight away rather than hoarding it. Apparently if I had denied it they would've got the police involved, but I was honest and upfront when they asked me. My brother started the same school three years ago (I've been gone for 8 years) and I was still able to access a few things with the remote panel — after which I alerted the school to it. I don't think they were best pleased to hear from me...

chimeracoder 13y ago
> Apparently if I had denied it they would've got the police involved, but I was honest and upfront when they asked me. The problem is that this is usually a terrible gamble to make. I'm glad it worked out for you, but my general advice for anybody else would be not to talk to the administrators, the same way you should never talk to the police. You never know if they're going to involve the police anyway after you spill the beans, and if they do, you'd rather they do it without already having a confession from you.
- jbrooksuk 13y ago
  > You never know if they're going to involve the police anyway after you spill the beans, and if they do, you'd rather they do it without already having a confession from you. I was definitely worried about this, but I figured that if anything, I've not lied to anybody, so I'd be happy with myself.
  - chimeracoder 13y ago
    > if anything, I've not lied to anybody, so I'd be happy with myself. Unfortunately, that's not the way police encounters work in practice. Even if you've done nothing wrong, talking to the police can really only hurt you. For example, this re-enactment is based on a true story in which an old lady in Baltimore was convicted of drug possession because some neighborhood children had left a dime bag under her sofa (which she didn't even know about) https://www.youtube.com/watch?v=s7RYH8Py6lY[0] https://www.youtube.com/watch?v=s7RYH8Py6lY[0] Just because you think you've done nothing wrong doesn't mean others will agree, especially when it's their job to think you're guilty. [0] This is part of an hour-long video which shows several more cases like this, but for some reason I can't find the full version anymore.
    - deleted 13y ago
      [deleted]
- gpvos 13y ago
  So you don't report it at all? That would be irresponsible, as the holes would remain. Or you report it anonymously? Then, depending on how you got the access, they may find out who you are anyway from the logs. It's a reasonable course of action.
  - chimeracoder 13y ago
    Well, this underscores the problem with the current state of affairs. In general, the person who discovers the vulnerability has every incentive not to disclose it. They have nothing to gain, and they take quite a risk in doing so.
ajross 13y ago
> I had found access to the remote server [...]. I was able to find the [...] Management Console and use a teachers [...] password [...] create a hidden admin user [...]. Through this I could [...] control every PC in the school. And this is why we can't have nice things. Admins at The Age (in this case) see someone trying to "report" a vulnerability and instantly jump to the conclusion that the user is someone like you, who has already compromised and exploited the system and at this point just wants to gloat on top of it all. Surely there is a spectrum between white and black hat hacking. But this is over the line, sorry. Once you start trying to guess passwords and modifying state to add backdoors (seriously!?), you have to reasonably expect the rest of us to try to resist and suppress you, by law enforcement if necessary.
- cmiles74 13y ago
  I don't see the point in bringing the legal hammer down on a student. With security holes this large and gaping, it's the system administrator that needs to change the way they do things. For instance, monitor the creation of new admin accounts, monitor logged data for events that indicate a breach, enforce some level minimal password difficulty, etc. This sort of malfeasance seems like _exactly_ what the sysadmin at a school should be expecting. Someone who waltzes up to the login prompt and types the first thing that comes to mind. Personally, I don't think this or anything close should be made illegal. Who was hurt? What was the damage and the cost? Private data was likely at risk, and maybe there's a case to be made there, but I'm not entirely convinced that shouldn't be laid at the feet of the organization for shoddy security practices.
- TeMPOraL 13y ago
  I don't know if it is the times that have changed, or it's just that old stories were all romantic, but I get the feeling that nowdays IT staff has no sense of humour or understanding of the concept of having (creative) fun. > Once you start trying to guess passwords and modifying state to add backdoors (seriously!?), you have to reasonably expect the rest of us to try to resist and suppress you, by law enforcement if necessary. In this setting (a school) I'd reasonably expect the "rest of you" to play the game, not to swing the legal hammer. If your system is so easily compromised, you should feel professional shame and try to attone, not reach for law enforcement and general grown-up dullness. Especially given that this school, one would hope that everything there, including the computer infrastructure, should be a part of learning experience, as long as no one gets seriously hurt. BTW. in my high school, the school server and computer rooms were managed by students, not teachers or any hired staff. Everything worked well most of the time, and at the same time every generation of students was busy putting their backdoors everywhere, while searching and removing ones left by their predecessors. It was fun, and we learned a lot.

chimeracoder 13y ago

> Apparently if I had denied it they would've got the police involved, but I was honest and upfront when they asked me. The problem is that this is usually a terrible gamble to make. I'm glad it worked out for you, but my general advice for anybody else would be not to talk to the administrators, the same way you should never talk to the police. You never know if they're going to involve the police anyway after you spill the beans, and if they do, you'd rather they do it without already having a confession from you.

jbrooksuk 13y ago
> You never know if they're going to involve the police anyway after you spill the beans, and if they do, you'd rather they do it without already having a confession from you. I was definitely worried about this, but I figured that if anything, I've not lied to anybody, so I'd be happy with myself.
- chimeracoder 13y ago
  > if anything, I've not lied to anybody, so I'd be happy with myself. Unfortunately, that's not the way police encounters work in practice. Even if you've done nothing wrong, talking to the police can really only hurt you. For example, this re-enactment is based on a true story in which an old lady in Baltimore was convicted of drug possession because some neighborhood children had left a dime bag under her sofa (which she didn't even know about) https://www.youtube.com/watch?v=s7RYH8Py6lY[0] https://www.youtube.com/watch?v=s7RYH8Py6lY[0] Just because you think you've done nothing wrong doesn't mean others will agree, especially when it's their job to think you're guilty. [0] This is part of an hour-long video which shows several more cases like this, but for some reason I can't find the full version anymore.
  - deleted 13y ago
    [deleted]
gpvos 13y ago
So you don't report it at all? That would be irresponsible, as the holes would remain. Or you report it anonymously? Then, depending on how you got the access, they may find out who you are anyway from the logs. It's a reasonable course of action.
- chimeracoder 13y ago
  Well, this underscores the problem with the current state of affairs. In general, the person who discovers the vulnerability has every incentive not to disclose it. They have nothing to gain, and they take quite a risk in doing so.

ajross 13y ago

> I had found access to the remote server [...]. I was able to find the [...] Management Console and use a teachers [...] password [...] create a hidden admin user [...]. Through this I could [...] control every PC in the school. And this is why we can't have nice things. Admins at The Age (in this case) see someone trying to "report" a vulnerability and instantly jump to the conclusion that the user is someone like you, who has already compromised and exploited the system and at this point just wants to gloat on top of it all. Surely there is a spectrum between white and black hat hacking. But this is over the line, sorry. Once you start trying to guess passwords and modifying state to add backdoors (seriously!?), you have to reasonably expect the rest of us to try to resist and suppress you, by law enforcement if necessary.

cmiles74 13y ago
I don't see the point in bringing the legal hammer down on a student. With security holes this large and gaping, it's the system administrator that needs to change the way they do things. For instance, monitor the creation of new admin accounts, monitor logged data for events that indicate a breach, enforce some level minimal password difficulty, etc. This sort of malfeasance seems like _exactly_ what the sysadmin at a school should be expecting. Someone who waltzes up to the login prompt and types the first thing that comes to mind. Personally, I don't think this or anything close should be made illegal. Who was hurt? What was the damage and the cost? Private data was likely at risk, and maybe there's a case to be made there, but I'm not entirely convinced that shouldn't be laid at the feet of the organization for shoddy security practices.
TeMPOraL 13y ago
I don't know if it is the times that have changed, or it's just that old stories were all romantic, but I get the feeling that nowdays IT staff has no sense of humour or understanding of the concept of having (creative) fun. > Once you start trying to guess passwords and modifying state to add backdoors (seriously!?), you have to reasonably expect the rest of us to try to resist and suppress you, by law enforcement if necessary. In this setting (a school) I'd reasonably expect the "rest of you" to play the game, not to swing the legal hammer. If your system is so easily compromised, you should feel professional shame and try to attone, not reach for law enforcement and general grown-up dullness. Especially given that this school, one would hope that everything there, including the computer infrastructure, should be a part of learning experience, as long as no one gets seriously hurt. BTW. in my high school, the school server and computer rooms were managed by students, not teachers or any hired staff. Everything worked well most of the time, and at the same time every generation of students was busy putting their backdoors everywhere, while searching and removing ones left by their predecessors. It was fun, and we learned a lot.