3rd Grader Accused of Hacking Schools' Computer System 344
Gud writes "According to The Washington Post a 9-year-old was able to hack into his county's school computer network and change such things as passwords, course work, and enrollment info. From the article: 'Police say a 9-year-old McLean boy hacked into the Blackboard Learning System used by the county school system to change teachers' and staff members' passwords, change or delete course content, and change course enrollment. One of the victims was Fairfax Superintendent Jack D. Dale, according to an affidavit filed by a Fairfax detective in Fairfax Circuit Court this week. But police and school officials decided no harm, no foul. The boy did not intend to do any serious damage, and didn't, so the police withdrew and are allowing the school district to handle the half-grown hacker.'"
Didn't see that one coming. (Score:5, Interesting)
Pleasantly surprised by the last part of the summary:
"But police and school officials decided no harm, no foul. The boy did not intend to do any serious damage, and didn't, so the police withdrew and are allowing the school district to handle the half-grown hacker."
Didn't see that one coming. I thought I was in for a story of stupid teachers overreacting and a poor kid dealt with harshly.
Two words (Score:3, Interesting)
[shakes head]
Google (Score:3, Interesting)
I doubt the kid is the 2nd coming of Kevin Mitnick (Score:3, Interesting)
It is more plausible that the school's Blackboard was mis-managed/mis-configured to allow access to areas it was not supposed to.
Re:More likely, (Score:3, Interesting)
Probably not much skill required. Anecdotal I'm sure, but I've read online of other "hacking" done to Blackboard's software.
This kind of leads me to believe they just have really shitty security. Reminds me of the screen lock software they installed on the old Mac's we had when I was in middle school.
Move the mouse and it appears to ask you for a password, but click in the very far lower left corner and it let you in...
Any security device designed with an intentional circumvention probably has a security hole also.
Same for me!!!!!! Except..... (Score:5, Interesting)
Come on, really? You're gonna make that comparison?
Re:More likely, (Score:2, Interesting)
This happened to my younger brother when he was in junior high (10 years ago).
He had a relatively good understanding of computers at the time, and decided to go to 'right-click, explore' on the start button and found out a number of network mapped drives.
He clicked on a few, and a password box poped up. He typed in "admin" and "admin" for both user and password. He looked around and found some interesting documents pertaining to school administrative officials. Before he was able to read them, the teacher came by and caught him.
They sent him to the principal's office and called my Mom. They said they were going to charge him with "hacking" and theft, unauthorized access, criminal mischief, etc.
My mom freaked out and called me. I set up an appointment with the principal to see what he had actually done. They called in their network administrator and superintendent and all 5 of us had a meeting.
After they had told me exactly what he had done, I mentioned their security must have been lax enough that anyone could access it, even by mistake. We agreed he probably didn't know what he was looking for, if anything.
The network administrator, not content to be outshone after we had all agreed to dismiss it and give my brother a suspension, decided he wanted to prove to me it was secure.
He showed me the firewall. So I showed them all how the network admin had the default user and password still set.
I wish I could say he got fired, but no. He still works there. They just required him to get more training. He's not so bad now.
Re:More likely, (Score:5, Interesting)
Nobody cares - but here is my evil 'hacker' story.
When I was in high school, I was kicked out of my programming class, along with five other of my friends. We were marched down to the principal's office. I was given the title of 'ring-leader'. It was interesting stuff. Apparently, I was an evil hacker.
At first, I was like, 'Don't worry guys' because, after all, I didn't do anything bad. I did some cool stuff - like a program to change the desktop resolution, so I could write code in 1024xwhatever instead of 800x600. We'd also enabled sharing of our network drive so that we could work on our class stuff from anywhere in the building (which meant I could do homework in the library).
When I was in the room with the principal, she asked me to explain what increasing the resolution did, exactly. I tried my best, I told her....'Well, ummm....it means there are more pixels on the screen than you'd have otherwise....and it....ummm....gives you more space.'
She paused....and said.....'So, you mean to tell me, you were able to see parts of the screen you weren't supposed to? Did you ever think that maybe there was a reason those parts of the screen were hidden!'
I'm not joking. I'm not exaggerating. And at that point, I was basically forbidden to speak. Her mind was made up, my fate was sealed.
I thought it was a pretty good explanation from a 16 year old kid who didn't really know jack and who was fairly nervous at the time.
I was threated with expulsion from my school, kept out of class, given an F in my programming class (prior to this, I had an A+ and would literally go around and help other kids, the same as the teacher would. I'd spend hours in the library making my program do things far beyond the scope of the assignment. I was a great student).
Eventually, after much drama, it was decided that I could remain in my school - but that I couldn't touch any school computers for the rest of my high school years. That's to say, for the entirety of my senior year, if I was in English class and we were supposed to type a paper - I had to sit there and not touch a computer.
The stupidity is overwhelming to the point where it seems unfathomable.
I still don't know what trigged it all. The things I did, I had permissions and access to do - so I don't see how that really fits as hacking. We had an idiot running the school, and apparently, an idiot running the IT department. I'm guessing that nothing was locked down and someone did something actually malicious and they looked and saw that, OMG, some kids are working on their homework in the library via their network drive! And so, we (and more specifically, I) became the target of their rage.
Schaumburg High School/Sharon Cross - you suck.
Re:More likely, (Score:3, Interesting)
Re:More likely, (Score:3, Interesting)
The problem is the system has to be easy enough for your average teacher to use it but hard enough a child can't hack it.
That's probably very difficult to do. I'd imagine this "hack" was easier than they're willing to admit, let's not forget this 9 yr old just recently learned how to read most the content required to even start hacking.
But let's play devil's advocate, let's assume this is a super genius kid, that he's been reading since 3, coding at 5 and is now at a college level, that would explain how he figured how to do a real hack, but then wouldn't Blackboard and the school report that? Because as the article reads he's just a "very intelligent 9-year-old". Yeah, so is every 3rd grader now days, [wisegeek.com] but that won't help sell Blackboard systems, couldn't you Doogie Howser [wikipedia.org] up the kid a bit more? Perfect SAT score at 6 would certainly make me feel like this could never happen again. So this kid was not a genius, this had to be a easy hack.
Makes me feel very safe about my info at my old university that has switched to blackboard.
Re:More likely, (Score:1, Interesting)
A very similar thing happened to me at my high school. I took advantage of the schools lack of proper security, and the Luddite in charge of the network made up stuff about what I did and tried to press charges. Eventually it was all dropped and I enjoyed a week long vacation from school. The problem is that most schools just put someone in charge of their computers regardless of whether or not they acctually know anything.
Re:More likely, (Score:5, Interesting)
I told a teacher and happily went on my way; a few days later, the principal, a very friendly and well liked guy, called me to his office and nicely asked me not to browse the network shares on the school computers; it wasn't until years and years later that I found out what had almost happened to me.
Years and years later, I found out from my parents that the school IT adminstrator had wanted to press criminal charges against me, expel me, and all that, and had convinced the board to go along with it. The school principle refused to do it and threatened to resign.
Now, after college and after years of hearing all these horror stories from friends and reading about them online, I appreciate what an amazing principal my school had, and how lucky I was.
Re:More likely, (Score:3, Interesting)
The trouble I see is that most people think that schools principals have no superior, when it's possible (although hidden and heavily discouraged by schools, obviously) to appeal just about anything and complain up to the highest level. This was done with a bad math mark on one of my exams (which the teacher, who disliked me, thought I wouldn't check after I noticed that it affected my final overall average) - the school refused to do anything, and ultimately the director of education for the district awarded me the lost marks after I had independent verification from a university math prof.
If I had to sum up my story, it'd probably be "schools suck, but they are not immune to being smacked around like a bitch if you can find someone to help you."
Re:Dade Murphy? (Score:5, Interesting)
Fuck you WHS.
Re:More likely, (Score:3, Interesting)
It did end up getting escalated to the district superintendents who ultimately decided upon the punishment.
By the time they told us what it would be, I just wanted it all to be over, so I didn't much care. They didn't say they were going to give us F's - they just said that we'd be unable to return to the class and we'd receive 0s for everything we missed. And that, in the future, we'd be unable to use any of the school's computer equipment for any reason.
I honestly figured I'd *still* get an A - the class was almost over and I had a ton of extra credit. Maybe a B. And, I'd taken all the Computer classes the school offered - so it wasn't really much of a punishment at all.
When I got my report card though - it was an F. Mathematically, there is no way it would have worked out like that; but it was the summer and my GPA wasn't anything special. I'd received an A in the AP Computer Science class, scored a 4 on the AP test (as a sophomore) - but received an F in the Intro to Programming class. Despite having done excellent on all the assignments and despite having received lots and lots of extra credit. Some adult, some professional educator who was well paid by tax payer dollars, was angry and decided to give me an F.
My parents wanted to raise hell down at the district over it - but it didn't bother me and, being perfectly honest, I just wanted to be done with the whole mess. So, at my request, they dropped it.
I went through my senior year avoiding the math department, the principal, and all of the computers. It sucked. But, on the plus side, I became somewhat infamous; and pretty much everyone except my closest friends were convinced I'd done something much cooler - like hacked into the grading system or something.
Re:Dade Murphy? (Score:2, Interesting)