4 ms·

Oh, this stuff is fun. In high school, I made a WScript that prompted user "Network timed out on line #6. Please re-enter password:" and would surreptitiously r

by elwell 11y ago

Oh, this stuff is fun. In high school, I made a WScript that prompted user "Network timed out on line #6. Please re-enter password:" and would surreptitiously record it. I put this on a floppy, popped it in when someone in the library went to the printer, waited, came back and said, "sorry forgot my floppy; can i get it, excuse me". Didn't use it maliciously; usually would just modify the folder settings on their home drive on the network to have repeating images of Pokemon as a background image. I suppose this all sounds quite devious in writing.

pavlov 11y ago
I also made a password logger in high school (like presumably a great many bored kids). The network was all DOS machines where you used a command line tool to manually log in to a Novell server. There was no security in that system, so I wrote a simple wrapper that looked like the Novell login tool, saved the passwords and then shelled out to the real thing to provide access. I didn't use the passwords for anything... But there was a guy in another class whose password was the name of the girl on whom I had a crush too. Illicit knowledge bred jealousy! Neither of us ever got the girl.
- gauravphoenix 11y ago
  Are you me? I did the very same thing ~20 years ago. I used a DOS Terminate and Stay Resident (TSR) code to achieve this, I did't have to fake any screen. The key strokes were stored in a file. I still remember keyboard interrupt value (0x9) while registering TSR code.
  - PiRX 11y ago
    Was it with Novel network? 'cuz I remember their login being paranoid and starting to emit beeps with TSR hooked on keyboard interrupt. Or maybe it was just a sloppy coding from 12 years old me :)
  - cubix 11y ago
    I did the same except that I put the file onto a network drive so that I could access it from a less conspicuous location. Also, made a crude chat program in a similar manner.
- naughty 11y ago
  That brings back memories, I did exactly the same too. The logins were shared with the Windows machines so after nabbing the password of our maths teacher, a few friends and I went through his account vandalising his PowerPoint slides to add subtle nonsense. Poor guy didn't know what on earth was going on during his lectures. Also found out the 'debug' login for the switches and used it to rather destructively mess with the network, much to the chagrin of the sysadmins. Good times!
  - gh02t 11y ago
    Hey, at least you had passwords. The network in my school district just used an invisible drive to store everything. If you manually navigated to something like h: or g: (can't remember) you'd suddenly have full access to every person in the school's home directory.
- gadders 11y ago
  I used to use a discussion forum website that didn't encrypt cookies. A friend created a 1x1 pixel transparent flash app that read everyone's user name and password and transmitted it to him.
- neotek 11y ago
  Chalk me up as another person who did exactly the same thing (Novell and everything), only I got expelled for it.
- cm2187 11y ago
  Net Send was another nice temptation to the average teenager troll.
  - stephengillie 11y ago
    As an admin, I really miss Net Send. I would love to have a simple way to send messages to users, especially in an emergency (like the office internet going out) so I don't get told 20 times. It sucks that they depreciated it. I wish it were still around, maybe we could have it disabled by default, and just use a GPO to enable it.
    - mattcrox 11y ago
      If I need to get a message to a machine or troll someone, I do a psexec -s cmd to their box, then do: msg * "insert message here"
joshstrange 11y ago
Not the same thing but in Middle School we used our "id numbers" for passwords everywhere. They were also helpfully printed on all of our schedules which a number of students simply slid into the front see-through plastic sleeve on their binders making it trivial to get nearly anyone's password. I wanted to see if there was a pattern to the id numbers (to see if given some info I could guess the id number) so I started collecting them passively. Just writing down the name of the student and their id number and storing them all in a program called HyperStudio (This was like powerpoint for mac but much more kid friendly and easier scripting) which I hid behind a number of hidden buttons on a project that looked legit (No clue why I did this, I could have just stored them in a text file but I wanted to play with HS some more and hiding them felt more fun). I never got to the point that I could discern any pattern because I very stupidly read off a student's id number when they pissed me off for shock value (I was in middle school, cut me a break) and they told the teacher and by the end of the day I was sitting in the principal's office. I got in a bit of trouble and lost computer access for the rest of the year (that really sucked) but I'm just glad it didn't happen in today's climate where I probably could have been charged with computer hacking/fraud charges. Like elwell I never once considered using it for malicious reasons and honestly I only logged into 1-2 accounts to confirm they worked but the vast majority I had no interest in looking at their network share folder (They were just full of a bunch of school assignments after all). Looking back it was extremely stupid and could have resulted in much worse consequences. That said I stand by my opinion at the time that they were blowing it WAY out of proportion and used the word "hacked" a number of times when really all I did was observe data that students were exposing right on the outside of their binders. I only lost computer access because I stored the numbers on a computer which to me at the time and now seems like some pretty stupid reasoning but whatever.

by elwell 11y ago

pavlov 11y ago

I also made a password logger in high school (like presumably a great many bored kids). The network was all DOS machines where you used a command line tool to manually log in to a Novell server. There was no security in that system, so I wrote a simple wrapper that looked like the Novell login tool, saved the passwords and then shelled out to the real thing to provide access. I didn't use the passwords for anything... But there was a guy in another class whose password was the name of the girl on whom I had a crush too. Illicit knowledge bred jealousy! Neither of us ever got the girl.

gauravphoenix 11y ago
Are you me? I did the very same thing ~20 years ago. I used a DOS Terminate and Stay Resident (TSR) code to achieve this, I did't have to fake any screen. The key strokes were stored in a file. I still remember keyboard interrupt value (0x9) while registering TSR code.
- PiRX 11y ago
  Was it with Novel network? 'cuz I remember their login being paranoid and starting to emit beeps with TSR hooked on keyboard interrupt. Or maybe it was just a sloppy coding from 12 years old me :)
- cubix 11y ago
  I did the same except that I put the file onto a network drive so that I could access it from a less conspicuous location. Also, made a crude chat program in a similar manner.
naughty 11y ago
That brings back memories, I did exactly the same too. The logins were shared with the Windows machines so after nabbing the password of our maths teacher, a few friends and I went through his account vandalising his PowerPoint slides to add subtle nonsense. Poor guy didn't know what on earth was going on during his lectures. Also found out the 'debug' login for the switches and used it to rather destructively mess with the network, much to the chagrin of the sysadmins. Good times!
- gh02t 11y ago
  Hey, at least you had passwords. The network in my school district just used an invisible drive to store everything. If you manually navigated to something like h: or g: (can't remember) you'd suddenly have full access to every person in the school's home directory.
gadders 11y ago
I used to use a discussion forum website that didn't encrypt cookies. A friend created a 1x1 pixel transparent flash app that read everyone's user name and password and transmitted it to him.
neotek 11y ago
Chalk me up as another person who did exactly the same thing (Novell and everything), only I got expelled for it.
cm2187 11y ago
Net Send was another nice temptation to the average teenager troll.
- stephengillie 11y ago
  As an admin, I really miss Net Send. I would love to have a simple way to send messages to users, especially in an emergency (like the office internet going out) so I don't get told 20 times. It sucks that they depreciated it. I wish it were still around, maybe we could have it disabled by default, and just use a GPO to enable it.
  - mattcrox 11y ago
    If I need to get a message to a machine or troll someone, I do a psexec -s cmd to their box, then do: msg * "insert message here"

joshstrange 11y ago

Not the same thing but in Middle School we used our "id numbers" for passwords everywhere. They were also helpfully printed on all of our schedules which a number of students simply slid into the front see-through plastic sleeve on their binders making it trivial to get nearly anyone's password. I wanted to see if there was a pattern to the id numbers (to see if given some info I could guess the id number) so I started collecting them passively. Just writing down the name of the student and their id number and storing them all in a program called HyperStudio (This was like powerpoint for mac but much more kid friendly and easier scripting) which I hid behind a number of hidden buttons on a project that looked legit (No clue why I did this, I could have just stored them in a text file but I wanted to play with HS some more and hiding them felt more fun). I never got to the point that I could discern any pattern because I very stupidly read off a student's id number when they pissed me off for shock value (I was in middle school, cut me a break) and they told the teacher and by the end of the day I was sitting in the principal's office. I got in a bit of trouble and lost computer access for the rest of the year (that really sucked) but I'm just glad it didn't happen in today's climate where I probably could have been charged with computer hacking/fraud charges. Like elwell I never once considered using it for malicious reasons and honestly I only logged into 1-2 accounts to confirm they worked but the vast majority I had no interest in looking at their network share folder (They were just full of a bunch of school assignments after all). Looking back it was extremely stupid and could have resulted in much worse consequences. That said I stand by my opinion at the time that they were blowing it WAY out of proportion and used the word "hacked" a number of times when really all I did was observe data that students were exposing right on the outside of their binders. I only lost computer access because I stored the numbers on a computer which to me at the time and now seems like some pretty stupid reasoning but whatever.