6th Grader Expelled After Zoom Provided Possibly Inaccurate IP Address (ajc.com) 143
An Atlanta newspaper tells the story of 11-year-old Malachi Battle, who's been suspended from school for the rest of the year after being accused of "repeatedly trying to log into Zoom classes with threatening phrases" in lieu of his name (according to documents shared by the family's lawyers, in a story shared by Slashdot reader McGruber).
The student says they're innocent: Malachi's lawyers say Gwinnett County Public Schools accused him based on an inaccurate list of students' Internet Protocol addresses from Zoom, a problem that could repeat elsewhere since the company's online sessions are replacing classrooms for millions of students amid the coronavirus pandemic... Chris Gilliard, a fellow with the Technology and Social Change Project of the Harvard Kennedy School Shorenstein Center on Media, Politics and Public Policy, had not heard of a situation similar to Malachi's but said "it's hugely unlikely that this is the first time" a student had been disciplined based on questionable data from Zoom...
During the "Zoom bombing" attempts, Malachi had already logged into the classes under his regular name, according to his appeal. The school district retrieved from Zoom a list of the names and IP addresses in each waiting room, Malachi's legal team said. The Zoom bombers' public IP addresses matched Malachi's — but four other students who did not appear to be Zoom bombers were also listed as having Malachi's public IP address, an impossibility since they were not in the same house, said Scott Moulton, a Woodstock-based forensics expert hired by the attorney working on Malachi's case. Moulton said the school district's technology employee who investigated should have been able to tell that many of the IP addresses in the Zoom report were wrong. "I would have at least picked up the phone and called Zoom before hanging the life of an 11-year-old kid based on a log that looks like an error," Moulton said.
The Zoom bombers' local IP addresses, which identify the exact device being used, did not match Malachi's, according to the log his attorneys provided. Nor did the local IP addresses match any of the possible sequences available under the configuration of the router in Malachi's house, Moulton said. There were no other routers or devices in the house that could have used those local IP addresses, Moulton said... Teachers also said Malachi's camera was on and he did not appear to be doing anything unusual...
Teachers also said unknown people had tried to enter their virtual classes using false names before the day Malachi stayed home sick.
Wild theory: pranksters spoofed Malachi's address.
The student says they're innocent: Malachi's lawyers say Gwinnett County Public Schools accused him based on an inaccurate list of students' Internet Protocol addresses from Zoom, a problem that could repeat elsewhere since the company's online sessions are replacing classrooms for millions of students amid the coronavirus pandemic... Chris Gilliard, a fellow with the Technology and Social Change Project of the Harvard Kennedy School Shorenstein Center on Media, Politics and Public Policy, had not heard of a situation similar to Malachi's but said "it's hugely unlikely that this is the first time" a student had been disciplined based on questionable data from Zoom...
During the "Zoom bombing" attempts, Malachi had already logged into the classes under his regular name, according to his appeal. The school district retrieved from Zoom a list of the names and IP addresses in each waiting room, Malachi's legal team said. The Zoom bombers' public IP addresses matched Malachi's — but four other students who did not appear to be Zoom bombers were also listed as having Malachi's public IP address, an impossibility since they were not in the same house, said Scott Moulton, a Woodstock-based forensics expert hired by the attorney working on Malachi's case. Moulton said the school district's technology employee who investigated should have been able to tell that many of the IP addresses in the Zoom report were wrong. "I would have at least picked up the phone and called Zoom before hanging the life of an 11-year-old kid based on a log that looks like an error," Moulton said.
The Zoom bombers' local IP addresses, which identify the exact device being used, did not match Malachi's, according to the log his attorneys provided. Nor did the local IP addresses match any of the possible sequences available under the configuration of the router in Malachi's house, Moulton said. There were no other routers or devices in the house that could have used those local IP addresses, Moulton said... Teachers also said Malachi's camera was on and he did not appear to be doing anything unusual...
Teachers also said unknown people had tried to enter their virtual classes using false names before the day Malachi stayed home sick.
Wild theory: pranksters spoofed Malachi's address.
IP addresses? (Score:5, Insightful)
Am I missing something? AFAIK, most people's Internet connections are through a temporary DHCP-assigned IP address that the ISP assigns when the modem (cable, fiber, cell phone, whatever) connects to the network.
And also, AFAIK, it can change on the fly. As in, DHCP lease time runs out and you get a different IP address.
And any power interruption, modem reset, ISP change, network problem, etc., and you'll get yet another IP address.
I now have a gmail account (ugh) through work at a new employer. I have many ways of logging in at many different places, and I keep getting annoying emails from google saying they don't recognize my "device" or IP address. I tried to disable that in settings, but I still get the annoying messages. Geez people, I move around, connect in many different places with many different "devices". Is that going to be a crime in the coming survielance state?
Re:IP addresses? (Score:4, Informative)
It really depends. Technically they are DHCP addresses - usually NAT IPv4 addresses - but how much they change depends on the carrier. Our Comcast IPv4 address hasn't changed in several years - nor has the IPv6 /64 they've assigned to us.
Even after a couple day-or--more-long power outages, it always comes back with the same address.
Re: (Score:1)
Re: (Score:3)
Right, I actually help manage our DHCP (and DNS) at work and prefer using fixed DHCP address assignments versus coding a static IP assignment into a computer - especially if they're laptops. The DHCP solution means a computer's network access will continue to work when someone moves the machine to a different subnet, which happens surprisingly often even withrour desktops.
But I would think Comcast must be doing something a bit unusual, since we've had the same IP across three different cable modems (all pur
Re: (Score:2)
OTOH, my IP address changes once every 24 hours or more if I reset the modem, which it needs about once a week. Depends on the ISP.
Re: (Score:2)
Anything that ignores the fact that the log showed several students having the same IP address as the accused student is besides the point. The log is clearly wrong and should never have been used as evidence, the student has a rock solid case here. I hope a student body organises a protest walkout.
Re: (Score:2)
So MrL0G1C, you expect 6th graders attending school from their bedrooms over zoom to organize a protest walkout?
I await your description of how that's going to work, because I know it's going to be hilarious.
Re: (Score:2)
It can be done:
https://www.abc.net.au/news/20... [abc.net.au]
Just needs a little bit of behind the scenes help from older people.
Re: (Score:2)
When I was in grade 6 (maybe 5) it was over nuclear testing (Amchitka) that we all walked out.
https://nvdatabase.swarthmore.... [swarthmore.edu]
Re: (Score:2)
You never had a walk out at school in the 6th grade?
Re: (Score:2)
As long as the lease doesn't expire, the DHCP server will typically offer the same IP address to a requesting mac address. Your lease time could be several days, and your modem should renew the lease at the halfway point of the lease duration.
Re: (Score:2)
Re: (Score:1)
10 bucks says his "local IP" was 192.168.1.1.
Re: IP addresses? (Score:1)
It was not
Re: (Score:1)
Yes it was.
Re: IP addresses? (Score:1)
Since I know, Iâ(TM)ll tell you it was not
Re:IP addresses? (Score:5, Insightful)
Sounds like either Zoom's logging of public IPs isnt working properly or the attackers are other students in the class and being geographically local they may be under the same carrier-grade NAT public IP address (if their ISP is using carrier grade NAT).
Re: (Score:2)
Re: (Score:3, Informative)
Why would Zoom have provided a LAN address? Seems unlikely to be something Zoom would bother logging.
In the enterprise edition, the Zoom dashboard provides me with WAN/LAN IPs, the hosts MAC, operating system name and version, the clients version, the percentage of the call the zoom window was in the foreground vs background, the CPU load in one minute increments through the call for windows and macs, and separately lists audio and video bitrate, latency, jitter, and packet loss.
This seems unlikely to differ between educational and enterprise accounts.
Re: IP addresses? (Score:1)
True
Re: (Score:3)
It seems like the release of the LAN IP addresses without a law enforcement order is contrary to Zoom's posted privacy policy and maybe they should also be sued for divulging private personally-identifying network information which is not required to 3rd parties that users will have not given consent to be divulged..
Re: IP addresses? (Score:1)
Log everything, figure out a use for it later. Big Data!
Re: IP addresses? (Score:2)
Re: IP addresses? (Score:3)
You aren't wrong.
I'm willing to bet a lot of customers who aren't internet savvy will be behind plans that are going to place them behind a NAT, especially cellular wireless (super common) or satellite, and even cheaper DSL/Cable plans.
All the customers behind the NAT will have the same public facing IP address. So, the zoom log may not even be in error. They all have the same public IP address.
Re: (Score:1)
I'm willing to bet a lot of customers who aren't internet savvy will be behind plans that are going to place them behind a NAT, especially cellular wireless (super common) or satellite, and even cheaper DSL/Cable plans.
I doubt there are many consumers in the US who AREN'T behind at least two levels of NAT - at least for IPV4 of course. IPV6 end to end adoption is still pretty patchy AFAIK. Your average home user is behind a mini NAT stage at his/her home router (ergo, it's difficult from the outside to tell which computer in a given household is the origin of any given piece of traffic, and behind a much larger CGNAT system in their broadband provider's infrastructure, making it hard to disambiguate even what house the tr
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
There are small patchy announcements everywhere - for instance "04-08-2013 10:31 AM Verizon has announced some DSL customers will move to Carrier
Re: (Score:2)
Re: IP addresses? (Score:2)
Yes they are Comcast has that info on the law enforcement page.
https://www.xfinity.com/-/media/4231839e374c4f618b2d34004d50987c
Re: (Score:1)
Just imagine the chaos that would ensue if one of these students was using AOL.
Re: (Score:2)
Re: (Score:2)
A DHCP routable address is still exclusively hours for the duration of the lease, if the lease expires your router will renew it so it's very unlikely to just change, and if it did in the middle of a call you would experience an outage.
However a lot of ISPS - especially wireless ones, use CGNAT whereby you don't get a routable address to yourself, you are actually sharing one with potentially hundreds of other customers of the same provider.
If several users were using the same ISP there is a significant cha
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Leave it to the person complaining about security protection on an email required for work to somehow not understand that they are exactly the type of person that made such protections a requirement to begin with.
Score 5: Insightful...
Just curious, do you work for Colonial Pipeline?
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Its an Irish name, and a Jewish name.
Re: (Score:2)
So the people working... (Score:2)
So, the people working for an gov org that is breached almost daily by crackers throughout the country bans an 11 year old based upon an IP address, wow. Glad they know what they are doing /s
Re: (Score:2)
an gov
Gov is not pronounced Uv.
org that is breached almost daily by crackers throughout the country
How is a local school district breaded throughout the country? It seems like they'd be breached... in their own school district.
Re: (Score:1)
Yea, well. After 2 generations of that type of schooling it is no surprise that our politicians are similarly incompetent.
Inaccurate IP data happens all the time. (Score:2, Interesting)
Re: (Score:1)
Yep, I regularly get captcha hell because in 2021 ATT still hasn't figured out how to deploy ipv6 and their own 6in4 tunnel doesn't work most of the time. Apparently "untrusted" users often use HE's free tunnels, or at least that's what the bot police want to think.
It's amazing how ideas like collective punishment are arbitrarily excused when its "not the government" who does it despite how much government funding they receive.
Surely Expulsion (Score:2, Funny)
Another Wild Theory: (Score:2)
Imbalance of power, lack of accountability (Score:5, Insightful)
The school can just do this, cite whatever flimsy reason that it wants and it is up to the 11 y/old (or his family) to try to prove otherwise and at probably great expense. The impact of this can be great on the child, especially if this is exam season. The impact on the school admins is almost zero, they can forget about doing this almost immediately. The admins are not automatically held to account, this might only happen if they get taken to court.
If there was any doubt of evidence the school should have suspended its action; but they will not as to do so would involve them in more work for no benefit to them. Tossers.
This is a logging problem (Score:3, Insightful)
This is not a matter of DHCP, it is a matter of logging. According to the Zoom logs, several students in the conference had the same IP address. It sounds like the school system just went down the list playing pin the tail on the donkey and they stopped at the first match and expelled the student without further thought. I don't blame the parents for looking into other alternatives. I wouldn't blame any of the parents in that county. Do they really want their kids to be "educated" by pointy headed morons?
Re: (Score:2)
According to the Zoom logs, several students in the conference had the same IP address.
Which is entirely unsurprising if they're using the same local ISP and that ISP uses CGNAT.
Re: (Score:1)
Or if the logs were hosed. Either way, it shows that the IP address cannot be reliably tied to any particular student. I'm not aware of any ISP in that area that is using CGNAT.
Wild Theory: (Score:5, Insightful)
Wild theory: pranksters spoofed Malachi's address.
Wild theory: Gwinnett County Public Schools officials are fucking morons.
Re: (Score:2)
Re: (Score:2)
sconeu's Corollary to Hanlon's Razor:
Any sufficiently advanced incompetence is indistinguishable from malice.
Re: (Score:2)
And zoom for not supporting IPv6, so even if the user actually has IPv6 support the call won't use it.
Re: (Score:2)
Who knows... It seems they have some plan to implement it but just haven't done so.
Their page listing firewall rules has a /40 IPv6 block listed:
https://support.zoom.us/hc/en-... [support.zoom.us]
What's even more stupid is that this page tells you to open up rules to a total of 116 different IPv4 ranges for Zoom, or a single IPv6 range.
root cause (Score:5, Insightful)
I have special insight into this kind of thing because I have children in school. Schools are run by idiots.
My kids were in online school during part of the COVID epidemic and the school accidentally scheduled my son for two classes which met at the same time. They take Zoom attendance and mark students absent who do not show up for their Zoom class sessions. So my son was always absent from one those two classes . Of course, we called the school right away and pointed out that was a problem. They could not figure out how to reschedule him to a different session of either class. The school knew that they had created the problem by scheduling two classes at the same time but was too incompetent to undo that, despite repeated calls from us over a period of months. So what the school finally did was to call the local police department, requesting that they send a truancy officer to our house because my son had missed too many classes. The police called ahead to say they were sending an officer over. We explained the situation and they told us well, never mind then. We told the school that this was really getting to be a problem. After that the police called again, said they were sending over a truancy officer. We explained the situation, they told us ok, well never mind then. Eventually someone at the school figured out how to move my son to a different session of one of those courses.
It would not be as large a problem that schools officials were idiots, except they are also determined to make students suffer for the ineptitude of school officials. Too incompetent to reschedule a student out of class conflict? Mark him truant and send over a police officer. Misidentify a student's IP address by using an evidently bogus table if addresses? Expel the student, then fight him court to resist undoing the mistake.
Re: (Score:1)
What I don't understand is how a populace of a country that has been born out of an independence war could ever accept this kind of crap as normal.
I don't even know what to say about stuff like that anymore... Some people get to do things in America that are so vile, idiotic and/or damaging and nobody does anything to stop them. I get it, we're all just cogs but by god, most machines grind to a halt when they pop out and wedge themselves in between other stuff....
Unicorns and rainbows (Score:2)
Also, the smarter of us are too busy being productive in the world to take a governing job where one sits in a room and argues with dumber people, begging the voters to keep his job every 4 years. That often leaves only the less competent to run things, people who may have (political) "ideas" but perhaps have never really done anything in the real world.
Re:root cause (Score:4, Insightful)
Report the school for making false police reports and wasting police time.
Re: (Score:2)
requesting that they send a truancy officer to our house because...
...the computer said so.
Society has slid into a rot of allegation = execution. Individuals have human reasoning, but they have less rights than the systems ruling over them, systems we want "optimized" into oblivion. Human reasoning takes time and money, let's automate truancy handling, let's automate all handling. Allegation is execution. No appeals. No sanity checks. No humans.
Wild theory: Malachi's ISP uses Carrier Grade NAT (Score:5, Insightful)
IP addresses should not be used as the sole means to identify people.
Re: (Score:2)
> IP addresses should not be used as the sole means to identify people.
Correct, and courts have already decided on this.
The school should be sued for damages and duress. Being smugnorant should have consequences.
Re: (Score:2)
can confirm (Score:3, Interesting)
US public schools are still ran by incompetent authoritarians. As it was when I was a child, so it remainsto this day. The only goals are to get children to conform. What those standards of conformance are is unimportant to the faculty, only that a 40 year old adult has power over a small child.
Re: (Score:2)
US public schools are still ran by incompetent authoritarians. As it was when I was a child, so it remainsto this day. The only goals are to get children to conform. What those standards of conformance are is unimportant to the faculty, only that a 40 year old adult has power over a small child.
Teachers in the US (like Police in the US) are a public sector union. Every year, every principle engages in a practice called pass the trash. Once a teacher is hired and stays in the job for a very small amount of time (like a year or two), they are in the union and thus impossible to fire. Yet, every year there are a few teachers that principles wish to get rid of. Everyone on the facility knows who are the bad teachers but since they are in the union, they know unless they get caught molesting (or ac
Re: (Score:2)
As it was when I was a child, so it remainsto this day. The only goals are to get children to conform.
It is almost certain that the people running those schools are thinking of their own problems, and not trying to get the kids to conform or do anything, really, unless it affects them personally.
These are the "hero" "qualified educators..." (Score:5, Insightful)
The Zoom bombers' local IP addresses, which identify the exact device being used, did not match Malachi's, according to the log his attorneys provided. Nor did the local IP addresses match any of the possible sequences available under the configuration of the router in Malachi's house, Moulton said. There were no other routers or devices in the house that could have used those local IP addresses, Moulton said... Teachers also said Malachi's camera was on and he did not appear to be doing anything unusual...
Now wait a second here. As mentioned by other commentators, he is almost certainly behind an IPV4 NAT. So how the hell does the school know what the local IP address is, since the Zoom logs are only going to show the outward-facing external IP? So his internal address is 192.168.0.20. Big deal. Like other posters said, the ISP is probably using some CGNAT implementation (sorry, ISP, if you don't allow me to actually have an IP accessible from the Internet, fuck off), so there might have been other people...Oh the hell with it.
Then, if he's going to engage in Zoom bombing enough for it to be an actual problem, even at 11 (if he's doing stuff like this) you'd think he'd be clueful enough to use some cheap-ass VPN or Tor.
I wouldn't normally advocate anyone really going on such shows, but maybe this kid should call out these idiot officials by name and go on Tucker Carson or even interview with some nutjob like Alex Jones. The administrators need to be called out for being the utter morons that they are.
Re: (Score:2)
I would guess the Zoom client also logs the local IP. CGNAT is very common with mobile network internet and becoming more common in others as we run out of IP addresses.
Of course it could even just be a dynamic IP and they lumped everyone who ever used that IP. It's plausible that multiple students in the same neighborhood could have reused an IP
Re: (Score:2)
Obviously, you don't get the Fox Network. How many times have Tucker Carson or Alex Jones complained about an average joe having a child sex-slave? These shows exist to perpetrate the 'evil government' rhetoric used by States' Rights activists, white supremacists and euphemistically named 'job creators'.
Carrier Grade NAT means address sharing (Score:2)
Some operators I am working with use Carrier Grade NAT, which means multiple cable modems can be sharing the same real-world IP address simultaneously.
It's creating havoc when law enforcement is asking to trace IP addresses back to subscribers.
Re: (Score:2)
How many kids were involved? (Score:2)
From the article I thought it was one. But the author referenced theyâ(TM)re. Does Malachi have 2 personalities?
I havenâ(TM)t been here in awhile. I suppose this is an intentional gender neutral pronoun?
*sigh*
I suppose there is no stopping it.
Re: (Score:2)
And in the very first sentence of the subsequent quote, his gender neutrality is crushed out of existence, exposing the stupidity of the "they" pronoun.
Probably not spoof; Zoom's audit logs are not good (Score:2)
I had to look at Zoom audit logs which was prompted due to a complaint about misconduct in a Zoom class/call. The Zoom audit logs (at least in 2nd half of 2020) were lackluster. There were inconsistencies in IP addresses and most importantly, the reported times of "sharing" for users was completely wrong. Person who was sharing screen most of the call was reported to have spent 0 minutes 0 seconds sharing video or screen. I ended up testing those metrics in other calls and it also misreported the share time
Coming next? (Score:1)
Enough (Score:2)
"Wild theory: pranksters spoofed Malachi's address."
That's enough crazy speculation for one day, Citizen.
Outdated people using technology (Score:2)
Earlier, the schools were using outdated technology. Now they are are having outdated people using tech. The technology they don't understand but ready to fire bullet through it.
Sure, it's evil, but ... (Score:2)
Re: (Score:2)
Not understanding recent tech is at least forgivable as long as they recognize their lack of understanding. But their willingness to dump on a kid based on their obvious complete lack of understanding erases all sympathy.
clueless lawyer? (Score:2)
Re: clueless lawyer? (Score:1)
There is more to this than is easy to explain in a small comment, the lawyer is aware, the article cannot point out everything and currently cannot release the logs.
Re: (Score:2)
Re: (Score:2)
need to hire a forensic expert with a fucking clue (Score:5, Insightful)
he school district retrieved from Zoom a list of the names and IP addresses in each waiting room, Malachi's legal team said. The Zoom bombers' public IP addresses matched Malachi's — but four other students who did not appear to be Zoom bombers were also listed as having Malachi's public IP address, an impossibility since they were not in the same house, said Scott Moulton, a Woodstock-based forensics expert
A forensic expert that doesn't understand something as basic as CG NAT?
The Zoom bombers' local IP addresses, which identify the exact device being used, did not match Malachi's, according to the log his attorneys provided. Nor did the local IP addresses match any of the possible sequences available under the configuration of the router in Malachi's house,
holy fuck, The school shouldn't be chasing this, but damn the defense team are technically incompetent.
Re: need to hire a forensic expert with a fucking (Score:1)
This isnâ(TM)t related to CGNat. Clearly this article doesnâ(TM)t have all the details or the logs, and as you probably realize we talk to a reporter for an hour but they can only tell so much. Itâ(TM)s a complex issue. Iâ(TM)m not able to release any of the more detailed items but the logs from zoom absolutely have errors and issues.
Re: need to hire a forensic expert with a fucking (Score:1)
There are also local ip numbers in the logs tracked by zoom software installed on the client side. What the school is doing is blaming ALL the other student sessions on this one kid as if he is zoom bombing with all their names. Thatâ(TM)s the point, it sticks out like a sore thumb that those are other real sessions but the school says this kid is all of them, himself, more than 20 other kids, and the âoebad actorâ
Re: need to hire a forensic expert with a fucking (Score:2)
I believe itâ(TM)s one item in a list of items. There are other items in the log they should have noticed, and the subpoenaed Comcast for the info, however they decided to make the decision before they received info back from Comcast on the person and billing, and then refused to review a report I wrote from the appeal that pointed out all the inconsistencies. So they had a chance to get the correct data, before deciding. Thatâ(TM)s why I say it has nothing to do with facts since they made the dec
I was in sixth grade once (Score:1)
Not a wild theory at all (Score:1)
Re: (Score:2)
Not exactly.
You can spoof outbound traffic, but you won't be able to receive the responses so you won't be able to establish a full session. You typically won't even be able to open a TCP connection because you won't receive the sequence numbers.
Spoofed packets are mostly used for DDoS attacks since the goal is only to send malicious traffic and not receive any of it back.
Comcast’s Parasitic Xfinity Wi-Fi (Score:1)
If I’m not mistaken, the Comcast piggybacked Wi-Fi networks share the same IP address as the host’s modem.
carrier grade nat (Score:2)
more than likely this may be a consequence of the use of carrier grade nat,
if the kid was on 4G any number of people in the area could be coming with the same public IP address, managed by a CGNAT equipment at the 4G telco.
it is time we switch to IPv6 !
It's called a VPN (Score:2)
If 20.000 people use the same out country/region, they all have the same IP address.
Just as people using a company computer where 3000 people share the same IP.
Local IP? Really? (Score:2)
The myth of computer infallibilty (Score:2)
This would appear to be yet another example of the evil effects of trusting computers more than people. When information on the computer contradicts what a person says, then that person must be lying, because the computer can't lie.
Only today, in the UK, I read of an innocent couple who were wrongly accused of trafficking child porn, because police computer forensics led to their home WiFi, which had of course been hacked by the real villains. No amount of protesting innocence and the absurdity of the charg
Re: (Score:1)
Re: (Score:2)
First amendment doesn't allow you to disrupt education or school, that's the gist of it.