Too right! Get this kid a job, not punishment.

Not to diminish your comment, but a thing I&#x27;ve found late my career is to abandon dogma when it comes to young folks learning. If they can learn with PowerShell, they&#x27;re a lot better off than a lot of young folks! There is no one-true-way and as soon as you find it, another generation will show up with another-true-way :)

Credit where credit is due, we all WISH *nix had something like PowerShell. Passing strings from program to program is a pain, passing around .NET objects instead is a great step forward, as can be seen by the several attempts at similar shells passing around JSON objects.

You&#x27;re glad to see them using the ancient clusterfuck that is Bash, and not a modern relatively sane shell that is indisputably the most seminal shell in the last 30 years?

I&#x27;m glad to see a kid using bash and not something like gulp PowerShell

I was suspended for a week for creating a network share in my typing class and dividing the work among my friends and we copied and pasted into a single document on the share.  This was on Windows NT though so a LONG time ago.  It&#x27;s also I guess &quot;cheating&quot;.  But they got us on &quot;computer hacking&quot;

Yea , kids would get expelled in the old days for putting a screensaver password

It can get pretty messy. For example, they could wait until they&#x27;re 21 to try them as an adult, even if it was committed at 17 or younger [0 p. 128]:&gt; a person who committed the offense before his eighteenth birthday, but is over twenty-one on the date formal charges are filed, may be prosecuted as an adult.... This is true even where the government could have charged the juvenile prior to his twenty-first birthday, but did not.However, the statute of limitations for CFAA violations is 2 years [1 p. 2] so this might not apply. If somehow they can still go after him at 21, this post could play a part in evidence for performing the hack (I truly hope not).0: <a href="https:&#x2F;&#x2F;www.justice.gov&#x2F;sites&#x2F;default&#x2F;files&#x2F;criminal-ccips&#x2F;legacy&#x2F;2015&#x2F;01&#x2F;14&#x2F;ccmanual.pdf#page=128" rel="nofollow">https:&#x2F;&#x2F;www.justice.gov&#x2F;sites&#x2F;default&#x2F;files&#x2F;criminal-ccips&#x2F;l...</a>1: <a href="https:&#x2F;&#x2F;www.goodwinlaw.com&#x2F;-&#x2F;media&#x2F;files&#x2F;publications&#x2F;10_01-aa-key-issues-in-computer-fraud-and-abuse.pdf#page=2" rel="nofollow">https:&#x2F;&#x2F;www.goodwinlaw.com&#x2F;-&#x2F;media&#x2F;files&#x2F;publications&#x2F;10_01-...</a>

25 years ago wasn’t any better… I recall several in my circle getting suspended for harmless things. The lesson: don’t explore, don’t be curious, and don’t try to fix anything related to the school and computers. Sigh.

Being a minor probably helps. There are so many laws today. It&#x27;s too risky to do this. It&#x27;s not like it was 25 years ago.

That hasn&#x27;t helped in the past. Frankly I think they were naive to reveal themselves no matter what the authorities said. It hasn&#x27;t gone nearly as well for other people.

In many cases, a 26-page report documenting the incompetency of a team would not be taken kindly.

Probably helps that &quot;We prepared complete documentation of everything we did, including recommendations to remediate the vulnerabilities we discovered. We went a comprehensive 26-page penetration test report to the D214 tech team and worked with them to help secure their network.&quot;

&gt; What they did was wrong.It was certainly against the rules. I&#x27;m not so sure it was wrong.

Yep.  What they did was wrong. And by doing so they threw themselves at the mercy of the entity they hacked.  The refreshing part is that the entity did the morally right thing and showed mercy.

I&#x27;m sure it helps a lot that they&#x27;re in a high tax base area, and the quality of the educators hired probably reflects that.<a href="https:&#x2F;&#x2F;statisticalatlas.com&#x2F;school-district&#x2F;Illinois&#x2F;Township-High-School-District-214&#x2F;Overview" rel="nofollow">https:&#x2F;&#x2F;statisticalatlas.com&#x2F;school-district&#x2F;Illinois&#x2F;Townsh...</a>

&gt;The school would not have any say about whether or not this happens.Schools are members of the local government &quot;club&quot;. Prosecutors don&#x27;t generally burn political capital giving the bird to other members of the club like that without a good reason.

&quot;sue&quot; suggests civil action and a decision by the wronged party.They&#x27;re lucky a prosecutor didn&#x27;t prosecute them for criminal activity. The school would not have any say about whether or not this happens.

The fact that the administration didn&#x27;t choose to sue them to oblivion is refreshing. I hope we&#x27;ll see a trend in the future of educator being smart enough to admit that they made a mistake and to encourage the students to develop their talent.One can only hope.

everyone in my school net send bombed everyone all the time. Im not sure how they didn&#x27;t figure out how to just turn it off.but i remember you had to do it from a library computer, because it said who it sent it from. so you had to do a little drive by walking net send as you walked out of the library to not get caught

Sorry you got access revoked. I accidentally did a net send (via the GUI) to the whole district domain instead of my friend in AP CS that said &quot;Time for break!&quot; right before the snack break.In my next class, the teacher was talking about &quot;Time for break&quot; virus going around... :&#x2F;This was after the district IT wanted to suspend me for setting up a Windows 2000 domain for the yearbook lab, so I kept my mouth shut.

I got in trouble once in high school just for discovering and then using `net send` to send a message to my friend that said &quot;Hi from lab 3&quot;.Computer lab access revoked for 6 weeks. Jokes on them, now I send socket messages to my friend that says &quot;Hi from Chicago&quot; and there&#x27;s nothing they can do about it.My friend however keeps begging me to use this thing called &#x27;email&#x27; because he claims he doesn&#x27;t see the socket messages.

There was an excessively annoying kid in my high school and I learned to send remote commands to any computer in our lab, so I sent a command on loop that continuously opened his disk drive (it would automatically re-open after closing), and if he was particularly annoying I would shut down his computer.I never once got in trouble for it - the teacher would ask the class, directly looking at me, from time to time to stop it, but I never got in trouble.I imagine he was just using those announcements to get me to stop from time to time, but knew this kid deserved it so he never did more than that.

Story time, I guess.I went to a small private Christian school back in the late 200X&#x27;s, and not the type of private school that had gobs of money. For two years, our desktop computers in the computer lab and the English classroom ran Ubuntu Linux (presumably because Windows licenses were &gt;$0). The only students with Linux experience were myself and a friend that I introduced to Linux (who is also now an IT professional).For a month or two we systematically changed the remote desktop preferences to automatically accept new connections and not to display any messages saying that there is a connection. We tried to never sit at the same computer twice so that we could &quot;adjust&quot; as many computers as possible and to make a secret map of where each computer was by hostname.If we were in the computer lab and feeling mischievous (always), we&#x27;d poll around English classroom hostnames to see if any were in use, or vice versa. We&#x27;d &quot;help&quot; people write their papers (very creatively, I might add), speedrun through other students&#x27; typing lessons, open a terminal and run &quot;telnet towel.blinkenlights.nl&quot;, or whatever else we could come up with.Well, wouldn&#x27;t you know it, word gets around this is happening and we naturally get called in to the principal&#x27;s office (because who else?). While expecting the worst, we were told &quot;we know what you&#x27;re doing, we don&#x27;t know how to stop you, but we encourage you to stop and use your technical abilities productively instead&quot; and were let off without punishment. We both came out of it with great respect for the administration because they showed us respect we didn&#x27;t deserve, and we stopped.

Stories of more enlightened school administrators are always welcome.My story: the &quot;second best high school in the state&quot; had an AT&amp;T 3b2. They wouldn&#x27;t let me take any classes that used it because they were afraid of what I might do to it (their words). I mean, they weren&#x27;t actually wrong to worry, but it din&#x27;t really have anything on it.

I don&#x27;t know. I feel like a lot of the people here celebrate their former exploits as though they weren&#x27;t committing the computer equivalent of rifling through unlocked desk drawers and graffitiing the walls. They seem so surprised that overworked and underpaid public servants don&#x27;t appreciate that.

It happens at &quot;adult&quot; jobs too. I found a number of webcams in the organization with no password. I flipped the image on one, and sent an email to IT saying, &quot;Hey something&#x27;s wrong with the web cam - it&#x27;s upside down. Oh and probably you should put a password on it ;)&quot;It didn&#x27;t go over so well. It embarrassed them and lead to some major reprimands for me, almost to the point of losing my job for unauthorized access to systems.

Many here, I am sure, got in trouble in high school for exposing security issues in school IT. So I imagine we&#x27;re all very happy to see a sane response from school administration for once!

Free relatively harmless large-scale pen testing! Nice work.

I’ve said this a bunch on here so please tell me to stuff it if it’s tiresome, but having been on the far side of a large scale bug bounty i am incredibly impressed with the skills that young folks are developing in infosec. Probably not particularly unique but the industry is still a bit of a combination of tradecraft and academic pursuit and can be confusing for people to find a way in.  I think this is why i really appreciate those that just bear down and get after it.

The rule does apply. Also, it was a senior prank, which by definition involves breaking the rules.

I think the OP is asking &quot;Why are we applauding them if they broke the rules?&quot;. The answer is &quot;Sometimes, people break the rules&quot;.

The author literally put in TWO disclaimers making that exact point...

Neat story, and this is clearly harmless. But isn&#x27;t the most basic, fundamental, number one rule of security&#x2F;pen testing to try to break into a system (no matter how weak) if and only if you&#x27;ve been given clearance beforehand? Why doesn&#x27;t that hold here?

Glad to see a cooperative and supportive academic administration, and I&#x27;m sure the thoroughness and planning that the team demonstrated made it easier on the administration.The sheer amount of testing and verifying no major impact to academic testing took place probably helped, and cleaning up after themselves and documenting their finding and reporting it to IT was a cherry on the top.I like that the administration even requested that the team brief the district IT on the &quot;attack&quot;.

TIL there is an Elk Grove that is not in California!

Using the school computer&#x27;s webcam to test his exploit at night was genius. Very clean.

Up until OP starts working out the frustrations of RTSP it was pretty much a yawner &quot;scan for ports, http to them, see if sumthins there and unguarded&quot;. But the perseverance to make a prank work like that with a finicky protocol across a wide variety of different OEM hardware is really exceptional!

I wrote an infinite loop in postscript and sent it to all the printers.  This was when postscript printers cost a fortune so there were not many of them.  Fun days were those.

Haha when I was searching for printers across the district network the librarian was looking at my screen. She called me out across the room asking why I was looking at printers at a different school. Oof.

In middle school I used Javascript to change Google&#x27;s button text from &quot;I&#x27;m feeling lucky!&quot; to &quot;Andrew is the best!&quot; (javascript:getElementById(&#x27;&#x27;).text=&#x27;blah&#x27;)I showed some other students who were so freaked out that I had &quot;hacked Google&quot; that I got the attention of the librarian, who promptly banned me from the library computers for the rest of the year, even after I refreshed the page to show them it wasn&#x27;t &quot;real&quot;. Oof.

I thought I was cool being able to modify the ready message on printers across the school network. This is really impressive.

Greatest rickroll since S2E10 of Ted Lasso.

She remembers you.I also graduated in the early 90&#x27;s and my children recently graduated from my alma mater. When I went with them to teacher conferences some of the same teachers were still there. Teachers that I didn&#x27;t even have classes with remember me.

In like &#x27;89 when I was 19 and at university my work-study job was with the IT&#x2F;ComputingResources department (old names). I worked as a graveyard shift NOC operator swapping tapes and handing out print-jobs, running system tests and stuff like that. We had several 24&#x2F;7 computer labs full of Sun 3&#x2F;50(60) workstations and things like that. But there was one lab that was closed from 10-5 overnight and I thought to myself &quot;hey, there&#x27;s a whole room of workstations not doing anything&quot; so I wrote some scripts rsh&#x2F;NFS and used that lab one night to run distributed ray-tracing jobs. The next day my account was disabled and I had to go talk to Security. They sorta laughed a bit then went like NO don&#x27;t do that. I worked for the IT department for the next four years. Then I left for a decade. Then I came back and applied for a job. The interview lasted all of five minutes, I worked for a few months before being forcibly promoted up into the upper circle. My first task was to go around to the dozen others who had root and ask for advice and update the root-speech documentation. I got to Security.... tippity tappity &quot;Oh, hello Mr. zengargoyle, let&#x27;s see... &#x27;89 &#x27;misuse of computing resources&#x27;.&quot; LOL, still had root by the end of the day.So, this is just to say... that places like education where people may stick around for a long while in the system and such. They probably do remember a bunch of events from even a decade ago. It&#x27;s the good places that have a sense of humor or appreciation for a worthy harmless infraction. They may even be secretly proud or have some admiration.Though I do sorta fear that I just happened to hit the tail end of old-school hackery where such things are such things are rewarded. Now get off my lawn.

When I was in High School (early 90&#x27;s) we got a new computer system that nobody was using yet. I discovered there was an email system of some kind and that every student had an email address that we were not told about. I also discovered Tetris installed in a directory on the server. I was able to play Tetris and I could show other students how to access it, but it was inconvenient to get to.Therefore I decided I would email Tetris to every student (I emailed the executable, not a link to Tetris), making it easier for everyone to play also. As soon as I did this the entire system got very slow...apparently the server had no quotas or partitioning and the hundreds of copies of Tetris filled up 100% of the hard drive space. It was a disaster. The computer &quot;specialist&quot; had no idea how to fix the system and she was teaching an adult education class that evening that required the system to work. She was furious and wanted me to get suspended. It didn&#x27;t happen though because I spoke up about the problem right when I knew there was a problem and also some other teachers intervened on my behalf.The woman who was responsible for the computer system back then is now the superintendent of the school system. I wonder if she remembers me.

Maybe, maybe not. The author has graduated from High School, meaning they&#x27;re about to enter college or the workforce. I wouldn&#x27;t be surprised to see this level of detail from someone at that level academically. Delighted, yes. Would I expect if from everyone? Hell no.But surprised that a tech-enthusiast and eager learner might have put this much thought into this prank and it&#x27;s potential consequences, not so much.Teenagers&#x2F;young adults tend to have different stressors and other things to occupy their time than the average adult in the workforce, meaning the author likely gave this prank a fair amount of their free time, and that dedication showed through in the amount of planning done.Additionally it&#x27;s likely, given they mentioned once or twice in the article they planned on posting a blog about the prank, that they might be hoping to use this on their resume or as a talking point in their career. If they&#x27;re hoping to go into security or comp sci, this would be a decent feather in their cap and the amount of time spent is easily justified.

So much attention to detail that I can&#x27;t help but think that the kids parents were helping along the way.

Given the amount of press this is receiving and the fact that the message the administration sent to them seemed a bit suspect, I wouldn&#x27;t be surprised if the kids did end up catching several charges.

No kidding, I was threatened with legal action for significantly less shenanigans back in my day.

My first thought when I read the headline was &quot;another kid with a felony following them around for a prank that didn&#x27;t harm anyone&quot;. Nice to see they weren&#x27;t prosecuted.

This is spot on. I Used to work as a sysadmin for a large private school and always enjoyed the red&#x2F;blue dynamic of tech team vs the smarter students trying to poke through the restrictions of their laptops and network.It was always disappointing when they took it too far and were directly caught by teachers or administration before I could tell them they were being a bit too blatantly malicious.

That&#x27;s definitely true, my elementary school principal once got upset at me for unplugging and replugging the ethernet to fix the internet... I&#x27;m pretty sure the IT guys would have done the same :P

I think the dilenation point comes in with whether they are an IT &quot;person&quot; or a school administrator.Regularly, I would end up in trouble in my High School for things like bypassing the root account (using ShellShock), or nullifying their executable restrictions (because I needed to run my own executables for a work&#x2F;study program). If I got caught, the IT admin would sit down and we&#x27;d chat about what happened, how they could improve their security and such. An administrator caught on to one of my shenanigans, bypassing the content block because I wanted to read a &quot;hacking&quot; article, and threatened me with suspension. Supposedly, she reported the incident to IT, and IT told her to not bother me anymore.

I told my district that I could change my race at-will via a hidden form on the profile page. I changed it to &quot;Purple&quot;. Got a call back from some IT guy telling me I accessed their computer without authorization, and that if it happened again, they&#x27;d press charges. I asked to be put through to the IT administrator, and he laughed and told me don&#x27;t worry about it... Sometimes, they can handle it well. Very glad they did for you as well :)

All this. Plus TI-86 king fu. Though this was 1991-1995, IoT didn’t exist and email and web access was mostly through AOL or Prodigy.

Unfortunately, this feature was discontinued by most graphics drivers.

Even better if you combined it with an upside down screenshot of the desktop. So it looked like only the mouse was upside down and all buttons didn&#x27;t work.

Another good one on that level was using the Windows keyboard shortcut ctrl-alt-down to rotate the display upside down - totally harmless, but absolutely maddening if you don’t know how to undo it

I told a friend who knew absolutely nothing about computers to go and type format c: on the school only computer and wait for the result. It turned a bit ugly but we&#x27;re still friend :)

Change wallpaper to some crap. Take a screenshot of desktop. Change wallpaper back and open screenshot with crap on the background in fullscreen mode.

back in middle school we would just use proxys to play online games on the library that were regularly blocked

I feel so dumb when I read kids doing these things. Back in High School all I knew was how I could run arbitrary executable files by renaming them to calc.exe. We also did the classic &quot;take a screenshot of the desktop, set it as the wallpaper, then remove all icons and the start menu&quot; thing.

About two years ago, I was in high school and decided to, as a joke, “hack” the computer. By logging in as admn:password. I was incredibly surprised when it actually ended up working as a domain admin account. After checking this, I immediately signed out.When my CS teacher filed a ticket asking “who has the user account ‘admin’ and why is the password ‘password?’” IT wanted to revoke my network login and probably put me in ISS for a few days. Fortunately, my CS teacher didn’t reveal who I was.Very glad IT at this person’s school took it in stride, unfortunately this was just the MO of IT in my district.

I&#x27;m impressed with how much foresight this high schooler had in preparing for the prank. My impression is that most high school age kids would out themselves within the first few weeks of planning due to wanting to boast, here they instead took to testing covertly, overnight.

And yet, there is overwhelming demand for what the government calls &quot;cyber security&quot;. As a developer it is easy to get good at your craft by practicing and learning, how in the world is a security specialist able to practice without asking for permission or already having a job? A home lab setup? A college degree and formal education? I&#x27;m curious how people actually evaluate this career choice.

Yeah, go to them about ransomware gangs or nation state actors and you basically get told &quot;lol we cant do shit&quot;. Complain about a kid prank and theyll go apeshit and make a, uhh, federal case of it to make themselves feel needed.

This post is 100% spot on. While the local school district may treat it as a prank, in the U.S. the federal authorities may not. To see how seriously the government takes this act, look at the penalties section of the relevant U.S. code.<a href="https:&#x2F;&#x2F;www.law.cornell.edu&#x2F;uscode&#x2F;text&#x2F;18&#x2F;1030" rel="nofollow">https:&#x2F;&#x2F;www.law.cornell.edu&#x2F;uscode&#x2F;text&#x2F;18&#x2F;1030</a>

&gt; But putting a kid in jail&#x2F;having a criminal record seems way to excessive to me.It absolutely is. Society is clearly harmed by laws like the CFAA.LEO do like overly broad laws though. There&#x27;s nothing better to ruin the lives of people that cops don&#x27;t like.

I agree, that feels wrong to me...When I was younger (~15) I also did some &quot;fun&quot; (aka stupid) stuff with the school computer network and in the end they got me and I received a &quot;formal warning&quot; (it was in France).In the end I&#x27;m glad for it because that scared me off and I never tried again on stuff that I don&#x27;t own.But putting a kid in jail&#x2F;having a criminal record seems way to excessive to me. Kids are dumb. And by punishing them that hard they won&#x27;t become a better person. hell, they won&#x27;t be able to have a job !

When I was in High School in 2003 I discovered you could pretty easily get around the tool that blocked running installers by launching them by entering the full path to the installer in the address bar of Internet Explorer. This was before Windows and IE were decoupled. I installed VNC server on a couple friends computers and used it for some light hearted pranks, but didn&#x27;t do anything else with it.One of my friends who I did this to went crazy with it and used it to mess with his teachers computers. Ended up in huge trouble, cops knocking on his door, and I believe probation. This was the year after I graduated.On the one hand, I kind of feel responsible for showing him, on the other hand, it&#x27;s his fault he had to go off and be an idiot with something I just thought was fun.

&gt; I do wonder if they could&#x27;ve secured themselves with VPN and &quot;untraceable&quot; anonymous emails (e.g. asking for a guarantee that they won&#x27;t be sued&#x2F;charged), although the teenage bragging rights would&#x27;ve been too tempting.If you read TFA, that is effectively what happened. Even with the guarantee, only one of them revealed themselves.

&gt; I wonder if it was possible for the hacker to ask a lawyer to represent them anonymously and make a contract, something like the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money...Criminal charges are generally filed by the prosecutor. They&#x27;ll generally follow the wishes of the victim, but are not required to (think, e.g., domestic violence cases). There is absolutely zero the school can do to guarantee that you won&#x27;t be charged if the prosecutor does catch wind of the incident and decides to make an example of you.

&gt; the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money...“Your faith in the legal system is appalling.”<a href="https:&#x2F;&#x2F;www.schlockmercenary.com&#x2F;2009-06-26" rel="nofollow">https:&#x2F;&#x2F;www.schlockmercenary.com&#x2F;2009-06-26</a>

Ah, 2021, such sad times, where we squash our creativities in fear of the police, where you&#x27;d think twice before doing something like one of the MIT hacks <a href="http:&#x2F;&#x2F;hacks.mit.edu" rel="nofollow">http:&#x2F;&#x2F;hacks.mit.edu</a> ...I do wonder if they could&#x27;ve secured themselves with VPN and &quot;untraceable&quot; anonymous emails (e.g. asking for a guarantee that they won&#x27;t be sued&#x2F;charged), although the teenage bragging rights would&#x27;ve been too tempting.I wonder if it was possible for the hacker to ask a lawyer to represent them anonymously and make a contract, something like the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money...

&gt; Anyone in the field will tell you that this is an absolute disaster of a post because it sends the signal to other young aspiring cybersecurity professionals that this is OKMaybe a bit overzealous with the reaction here. OK, sure, the OP could have been even more serious about this but literally the first labeled section is &quot;DISCLAIMER&quot; and says:&gt; With that said, what we did was very illegal, and other administrations may have pressed charges. We are grateful that the D214 administration was so understanding.

Ah, you young whippersnappers with your labs and networks and CDs... my high school just got one Commodore PET, that was &quot;the school computer&quot; in my day.Fortunately, I got on well with the math teacher who had charge of it, and he&#x27;d let me take it home over the weekends. Those were the days...

I remember back in high school we had this computer lab that was all locked down. Didn&#x27;t allow opening the CD-ROM drives, only allowed certain educational websites, etc. I put a little remote access app on my share drive as a way to open my own CD drive, mostly just to see if I could do it. The school&#x27;s computer guy came and found me and was like &quot;hey, a file pinged as malware, what&#x27;s up with that&quot; and we had a fun discussion about it and I deleted it and we moved on with our lives. I didn&#x27;t think about it again. Years later, I looked back with horror at how badly that could have gone for me.

Every district is different, heck -- every school within a district can be different in extreme discipline like this. Frankly, the size of his district represented a lot of risk; those often have the policies with the least wiggle-room -- like &quot;Weekend Jail for Sharing a WiFi password&quot; (insane).At the school my child attends, I am confident he would have ended up with a pat on the back if the circumstances were similar. I can&#x27;t speak for the district -- I&#x27;d be willing to bet that&#x27;d be very risky. At the school I had once attended, I&#x27;d expect the entire district would behave similarly. I&#x27;m sure there were people within the district administration that wanted to throw the book at the kids involved.Here&#x27;s the thing for those people: the last thing a school district wants is to become national news for punishing a bunch of kids who the evening news can make out to look like &quot;Geniuses&quot;. Since nothing failed in their plan -- that&#x27;s crazy important -- there would be very few ways to frame the story that makes the administration look like anything but bullies, and many will frame them as &quot;petty bullies&quot;. I have a friend I went to High School with who is now a High School principal. He&#x27;s still &quot;that guy I went to High School with.&quot; I have no doubt he would have given the kids an award privately, if not publicly.It&#x27;s sad that some public school districts are using discipline approaches you&#x27;d expect to see in prisons, rather than a school, and I&#x27;m sure in certain places in the country, that might be a necessity. Context matters, too -- were these kids who were constantly pulling pranks like this, had been talked to in the past&#x2F;impacted things in the past, etc, I&#x27;d expect a harsh response: &quot;Yes, we get it, you&#x27;re smart, stop breaking things already, read the horrors of the 1986 CFAA because that&#x27;s coming if it happens again.&quot; I&#x27;m guessing these were otherwise good students.

I know somebody - I think they post here, hi! - who ended up in &quot;weekend jail&quot; with a conviction for sharing a school&#x27;s WiFi password without permission. I also once got reprimanded for writing a blog post not too dissimilar to this one at a less sympathetic school. I also remember the joy of hiding a server in the ceiling of our school so we could play UT2K3 on the library computers before that exploded similarly. Adults are so boring.

Of course -- but we aren&#x27;t the ones making the rules, and the ones who do make the rules have certain incentives that lead them in dark directions.

That said, maybe we should lighten up on minors performing harmless&#x2F;non-destructive pranks.Not everything warrants felony charges for kids.

Anyone in the field will tell you that this is an absolute disaster of a post because it sends the signal to other young aspiring cybersecurity professionals that this is OK, and the school will laugh it off, and you&#x27;ll be seen as an adorable Matthew Broderick type Wargames character. I can&#x27;t overemphasize how far this is from the truth in 2021.Or maybe it will shame other IT departments into not having a stick up their butt. Especially if there is already a culture of overlooking minor criminal activity in the name of harmless pranks.

Gross but true. The administration has every incentive and opportunity to spin this into a self-serving story about taking down evil sinister hackers -- and maybe scapegoat a few unrelated problems while they are at it.I am delighted that these admins had the character to resist the perverse incentives of the system.

Worth a try, but I didn&#x27;t have a good experience with it.Companies can mark items as duplicates without fixing the underlying bug for an indefinite period of time. So the 3 vulnerabilities I found all got marked as duplicates without any compensation or even acknowledgement of my time writing up the issues. Felt like a complete waste of time.If you&#x27;re great, you can probably find novel stuff better than I was able to, but if you&#x27;re that great you likely already have plenty of employment opportunities.

For anyone who like to hack legally and ethically, check out <a href="https:&#x2F;&#x2F;www.hackerone.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.hackerone.com&#x2F;</a>. If you&#x27;re very good at hacking devices, software, networks, etc, companies will pay bounties for the vulnerabilities you find thru HackerOne.Looks like they paid out millions in bounty in 2020:<pre><code> https:&#x2F;&#x2F;www.zdnet.com&#x2F;article&#x2F;hackerones-2020-top-10-public-bug-bounty-programs&#x2F;</code></pre>

Probably better to try and reform the law instead of suggest children break the law and ruin their lives.

This is a very complicated problem.Unless you kill someone I generally don’t believe in life long criminal records. They only serve to drive people into further criminality.I imagine for a robbery you could get 5 years in prison, 5 years with it on your record and then automatically get it expunged.Back to the topic at hand , what if the IT hack stopped people from getting paid on time. How many suffered emotional distress ? Evictions can literally cause suicide.Maybe someone can’t afford medication, skip it and have a stroke.The entire criminal justice system is broken. So you did something stupid at 20, at 46 you still can’t find a job due to your record.People want simple easy solutions. Things are much more complicated. If you release a dozen felons 5 years early and 2 go on to commit horrific crimes it’s easy to ignore the good the other 10 did

Unfortunately, &quot;desensitizing&quot; people to existing law by illegal rebellions is a Pyrrhic victory at best when the consequences are so impactful to the individuals that martyr for The Cause.There are processes for changing the laws without sending kids to jail, having to treat kids like terrorists, or potentially making the law even harsher because it isn&#x27;t effective enough to dissuade lawbreaking. If the laws feel draconian, perhaps following those processes might be a better approach to change the system without as many sacrifices.

I don&#x27;t think telling kids not to narc on themselves &quot;validates the insane over-criminalization&quot;. I think telling legislators or parents would, though.The comment didn&#x27;t say &quot;respect the system&quot;, it said to deal in the realpolitik and don&#x27;t try to effect legislative change by ruining your life as a high school student.

I don&#x27;t understand this response. Having been on the wrong end of it you should be advocating harder than anyone to teach kids the complexities of cybersecurity law and ensure they can make the right decisions rather than throw away their future over a stupid prank. There is no &quot;validation&quot; happening here, the OP is just stating reality. Random high schoolers&#x27; rebellions aren&#x27;t going to result in Congress overturning the Computer Fraud and Abuse Act and a hundred related laws.

GP isn&#x27;t validating over criminalization. GP is trying to steer people clear of catching charges. The end results for both is, &quot;Don&#x27;t hack your school district for a prank,&quot; but the context of the two are very different. Students&#x27; minds are still developing. You can tell them not to respect Draconian laws surrounding hacking, but do the students understand what&#x27;s at stake?Yes, students get in trouble all the time, but most of the consequences for their stupidity are slaps on the hand. Lunch in a classroom, a parent-teacher conference, after school detention, in-school suspension, getting grounded - none of these things carry civil or criminal charges that are a matter of record. What should be a harmless prank can turn into a life altering civil and criminal charges. With high school kids, things quickly go from, &quot;I hacked the school network to do a Rick Roll; they laughed and sent me on my way,&quot; all the way to, &quot;I gave my friend the exploit to do something similar; I didn&#x27;t know he was going to change everyone&#x27;s grades to 69%.&quot;Further, I would not want to teach in a district where students doing digital pranks is the norm. I volunteer at a high school. Unchecked digital pranks would quickly turn into a constant stream of disruptions. Everyone would think that their prank is better than the last.

&gt; a prankWhy do we tolerate pranks? You shouldn&#x27;t be able to interfere with someone else and say &#x27;just a prank bro&#x27;. Leave other people&#x27;s things alone. Don&#x27;t create work for other people. Don&#x27;t bother people just trying to do their jobs. Don&#x27;t impose your sense of humour on others. These all seem like basics to me?If you think someone&#x27;s funny? Great. Just don&#x27;t bother other people with it. Do it with your own stuff, not other people&#x27;s.

We need to have harsh penalties for this. People who don&#x27;t understand the complex systems they were able to access, might introduce vulnerabilities that more malicious entities can exploit. An example of this would be a student at a university accessing internal network from a physical terminal in a building, (intranet), and accidentally disabling a firewall, (say to play a video from a remote location). In doing so, its no longer just a prank as they may have exposed the entire internal network to outside internet.This is a super basic example, but it serves to illustrate my point. It&#x27;s not just a prank bro, even when it is.

What? How is warning someone that they are going to ruin their lives the same as endorsing it?

validate the insane over criminalizationI think you misread the GP. He&#x27;s not defending the system, just describing it, and how the OP was lucky that the people in charge were unusual and open-minded. He&#x27;s warning others that the risk&#x2F;reward implied by the OP&#x27;s experience is misleading.I suspect that most commenters on this site applaud the kids adventurousness and style. A great hack! But we are uniquely aware of how rare it is that anyone with authority, school administrators or law enforcement, would show any leniency or self-restraint in these cases. On balance, the instinct seems to go for the jugular, dehumanize the kid as a criminal hacker, and ruin his life. No-one is saying that&#x27;s good, or reasonable. It&#x27;s just how it is.

Warns kids against jumping off cliffs. Accused of causing gravity.

Posts like yours validate the insane over criminalization of what essentially amounts to a prank. I had literally the exact same experience in high school. Got expelled and had to get a GED. They could have easily pressed charges.Part of the issue is people like you who advocate for respecting &quot;the system&quot; and essentially scaring kids into not doing anything. Except that simply re-enforces the draconian laws that are currently in place. If more kids rebelled and this was a regular occurrence it would help to desensitize society to digital pranks instead of always treating these kids like terrorists.

&gt; because it sends the signal to other young aspiring cybersecurity professionals that this is OK,There are multiple disclaimers in the text, almost every other paragraph.

It depends on how regulated the particular industry is.  If you&#x27;re building consumer web apps at a startup, it probably won&#x27;t matter.  If you want to be a government contractor, it&#x27;s probably a nonstarter.

Id actually wonder if criminal history matters when you have skills like this that are very much in demand.If this went to court, the charges of malicious intent would likely not stick, so jailtime could likely be avoided in leu of fine&#x2F;community service.Competent tech companies will not give a shit about criminal record of this nature.Expulsion from school is pretty much irrelevant, especially for CS careers. You can get a GED, find any college with CS program that will take your money, spend a year having fun, apply for an internship at a tech company, do a good job to be offered a return, talk to HR to go directly into entry level role, and you are set (have personally seen 2 cases of this happening with an intern).The most functionally harmful thing would be monetary cost, which is still inconsequential considering the salary this guy would make.

&gt; This kid is very very lucky.No, he is just smart. He did it anonymously. He knows how to cover his a$$.&gt; it sends the signal to other young aspiring cybersecurity professionals that this is OKThe post literally has a whole section dedicated to explaining that this is not OK, but whatever.

Malicious hackers could have shown something unspeakably vile on all those screens. If this kid reduced the likelihood of that... he&#x27;s a hero. Alas, I totally hear you.

There is something obscenely totalitarian about this whole mindset. You&#x27;re making a very pragmatic point, but take a step back and look at the whole thing.You&#x27;re warning a teenager against making a brilliant, harmless, funny and responsible prank so that they won&#x27;t get their whole life fucked up forever. Think a little about what kind of political system necessitates that kind of ridiculous warning. What sort of nation does this kind of thing to its kids? If we strike the United States from the list, what sort of countries are left?You guys really need to get your so-called justice system sorted out. Sorry to make such a blunt point, but this is depressing as hell.

yeah, it&#x27;s pretty messed up that there&#x27;s such extremely heavy penalties for merely playing a youtube video on a few screens whereas looting and stealing go completely unpunished.  what kind of message is that sending to our youth?

The CFAA exists to make sure that nobody can use computers and the internet to have any power over even tyrannical authorities.CFAA and the DMCA are some of the worst, most authoritarian laws ever created, and they exist to do nothing other ensure a system where being rich enough to afford lawyers means you don&#x27;t have to do anything else.Use default passwords like an idiot and someone uses their autofill? They&#x27;re the criminal, not you.Let people just change the account number in the address bar and switch accounts with zero authorization or authentication? They&#x27;re the criminal, not you. (Bank of America literally did this.)Have open access for students to download papers and one of them uses it to download all of them? They&#x27;re the criminal, not you. (RIP Aaron Swartz)I support jury nullification for the CFAA and DMCA and so should everyone reading this.

Someone I know did something similar, was arrested in their college dorm, and at the sentencing hearing in federal court was fined and sentenced to 5 years probation, and now has a criminal record.This kid is very very lucky. Obviously they violated the CFAA which carries severe criminal penalties. They engaged in actual hacking without any permission or defined scope. And they exploited the system without any responsible disclosure process.Anyone in the field will tell you that this is an absolute disaster of a post because it sends the signal to other young aspiring cybersecurity professionals that this is OK, and the school will laugh it off, and you&#x27;ll be seen as an adorable Matthew Broderick type Wargames character. I can&#x27;t overemphasize how far this is from the truth in 2021.Absolutely do not access systems you are not allowed to. If you do want to do penetration testing, you need permission from the systems owner and a clearly defined scope. And when you do find issues, you don&#x27;t exploit them, you responsibly disclose them within a clearly defined framework.If you want to end up with a criminal record that will profoundly effect the rest of your life, including your career prospects and ability to travel internationally, then by all means, do what this guy did.I wish it wasn&#x27;t so. It never used to be. But this is how it is now. Overzealous prosecutors have been given a huge amount of power, and all you need is one embarrassed systems administrator, school board or management team to trigger a disastrous outcome in stories like this.

When I was in elementary school in the early 90&#x27;s, I discovered you could use AppleTalk to print to just about any printer in the district.I would print pages and pages of &quot;I AM THE MASS PAPER WASTER!!!&quot; to random printers in other buildings. I&#x27;m genuinely curious if it actually worked.

Fun story! Such incredible attention to detail and thoughtfulness, all the way up to automatically sending a pen test report to the district&#x27;s technical supervisors, and sharing a presentation after graduation. This kid was one step ahead all along.Great work, Minh.

The Aaron Swartz prosecution continued, even after MIT and JSTOR said they didn&#x27;t want to press charges, because of a zealous prosecutor.

What happens when the suspect publicly admits to doing it and providing detailed information on the motive and means

They don&#x27;t legally need it, but such cases are pretty much dead in court without the victim&#x27;s cooperation so the prosecution will almost always drop it.

Do prosecutors need consent from victims to file charges in cases like this?Also if you&#x27;re going to commit a crime and brag about it, don&#x27;t say &quot;hey well they would point the finger at me anyway and I&#x27;m not going to name my partners.&quot; You&#x27;ve just told them there are coconspirators, and you don&#x27;t have a right not to incriminate others.

Wow. That&#x27;s terrifying. And you didn&#x27;t even run anything!I&#x27;m guessing that they never told you &quot;don&#x27;t browse this network drive&quot;?

&gt; whether or not they had a nut allergy (protected by HIPAA)Personal pet peeve:Your high school is not a covered entity and is not acting as a business associate of a covered entity. HIPAA does not apply. They are free to keep a plaintext file with your name, nut allergies, COVID vaccination status, and anything else they want to put in there - without HIPAA entering into the discussion.FERPA could apply, but I don&#x27;t know much about that.

Similar story: the dean of my &quot;high school&quot; [1] asked me to create our school website. Another student apparently poked around on a network drive and found an SQL dump of all the students&#x27; network username&#x2F;passwords. I brought this file to the dean, told them it was available on a shared drive (so they could remove it), and asked if they&#x27;d like me to use it -- since I already had it -- to enable all the students to log in to the school website with their existing network usernames&#x2F;passwords. They said that was a great idea and gave me the OK.A week later, police escorted me from my dorm and both I and the other student were eventually expelled and threatened with harsh legal action, which never came.[1] The &quot;high school&quot; was an early-entrance-to-college program where we started college at 16, lived on campus, took the normal freshman&#x2F;sophomore college courses, and eventually received a high school diploma and an Associate of Science when we graduated at 18. The website was for the school I attended, but the SQL dump included all of the university students as well. The school has since shut down.

I graduated high school in 2015. I remember similarly poking around a network drive until I found a file in plaintext which contained everyone&#x27;s student ID and whether or not they had a nut allergy (protected by HIPAA), for the bus system.I didn&#x27;t think much of it, but some other students caught wind. Before I knew it, the superintendent threatened to have the police involved and press legal action for &quot;hacking confidential student data.&quot;It&#x27;s CYA all the way, usually at the expense of the person in the chain least equipped to cover their ass (the student).

Kids have been jumping fences for millennia.That said, I did know a kid that had charges pressed against him when I was in school so things weren’t necessarily innocent back then either. He was admittedly an idiot and borderline malicious though.

I can&#x27;t answer your question, but I strongly suspect the backstory on your furious IT admin went something like this:<pre><code> * SEND happened
 * Minor kerfluffle ensued among various functionaries
 * Big Boss worried that something Big was going on
 * IT admin was questioned and had no answers
 * Simmer for a few days, Big Boss repeating questions and IT admin being flummoxed
 * Eventually adequate logs are found and correlated that place you as the likely responsible party
 * IT admin is lathered up about a big nothing because Big Boss keeps asking and their competence is in question
 * IT admin unleashes the pent up frustration of a few days of stupidity and job security uncertainty on you, and is not satisfied that all this drama was initiated by boredom and not malice
 * IT admin reports to Big Boss, who basically brushes it off because they have moved on to other things -- and at the end of the day knows they run an organization filled with kids, some of whom are more curious than others
 * Issue disappears</code></pre>

Good old &quot;net send.&quot; Out of all the things, that was the one I got chewed out about too.Wasn&#x27;t a regular MS user, but we were in a computer training lab at a company for &quot;computer day&quot; field trip. Was bored during instructions, so naturally I logged in, found &quot;net send&quot;, and sent a few crank messages to classmates using * as destination. Everyone, including the instructor, got a good laugh.Approached later in day by corporate IT. Apparently the lab had poor routing rules, no firewalls, and sat on the main Corp network. My messages were received on 25,000 terminals.Thankfully, they recognized this as (a) harmless, and (b) their own lax failure. No adverse outcome.

Serious question. What, if any, instruction do kids these days receive regarding what&#x27;s allowed on computer systems?I remember in high school poking around a network drive until I found an executable with the name &quot;SEND&quot; in the name. I had a sense that it would send some kind of message somewhere, but I honestly didn&#x27;t know where or to how many people. I was quite surprised when all the screens in our computer lab froze and, five seconds later, my message appeared on all of them. (I later learned that my message appeared on every desktop screen in the school!)I&#x27;m not sure exactly how they found me out, but I was called into the IT admin&#x27;s office a couple of days later. She was furious with me. I told her the truth. I didn&#x27;t know what exactly would happen when I ran that command, but she didn&#x27;t buy it. Fortunately, nothing ended up happening after that.I&#x27;ve wondered to this day what exactly they could have done to me if they decided to press whatever legal authority they might have had to its fullest extent. I was never told &quot;don&#x27;t go to Z:\&quot; or &quot;don&#x27;t run any program other than those on this list.&quot; Even after I was found out, I wasn&#x27;t ever explicitly told that my actions constituted unauthorized access.It was a different, perhaps more innocent (or ignorant) time back then. How much have things changed now?

My time in highschool was wasted. Kudos to these amazing kids.

I just hope the author, at least, applied to MIT. He would fit right in.<a href="http:&#x2F;&#x2F;hacks.mit.edu&#x2F;" rel="nofollow">http:&#x2F;&#x2F;hacks.mit.edu&#x2F;</a>.

I live near this kid and I&#x27;d offer them an internship on the spot if they came forward...but I fear they&#x27;d just be bored.

Quick!  Hire them before they can use their powers for the forces of good.

Hypothetically it could happen and even if it isn’t true, I feel it adds something to the conversation. Besides, you cited as many sources as they did.

<a href="https:&#x2F;&#x2F;www.dropbox.com&#x2F;s&#x2F;hyt24p4j43szpdi&#x2F;logo.gif?dl=0" rel="nofollow">https:&#x2F;&#x2F;www.dropbox.com&#x2F;s&#x2F;hyt24p4j43szpdi&#x2F;logo.gif?dl=0</a>

I&#x27;m less skeptical. OP already mentioned that most things were not encrypted back then, so this was probably still in the days of transparent proxies, so OP could have &quot;just&quot; added one with some ARP spoofing. They were somewhat common in school and office networks, and like regular HTTP proxies (except the transparent ones had the traffic redirected forcefully to them) they essentially consumed HTTP requests and sent new ones out to The Internet. While mostly used for caching and blocking, it seems relatively simple to me that OP could have just replaced e.g. some stylesheets served back to the client.

I did some similar shenanigans when in 10th grade, with backtrack 3 and ettercap-ng it was pretty easy. I didn’t do the load balancing, and ended up crashing the network when my laptop couldn’t keep up lol.

This was 13 years ago so my memory is fuzzy... if I recall correctly, spoofed ARP replies were unicasted to every possible address on the network. It switched from machine to machine slowly, which is fine because they all served the same content.There were several subnets at the school, each with its own gateway. I remember having to set up live CDs in several computer labs to cover each of the subnets.

Wow, somehow that use of random and slowly ARP proxying as a duct-taped together load balancing mechanism makes this so much cooler.I&#x27;m not sure I quite understand the details, though. I assume there was only one gateway for the segment, so were the spoofed ARP replies unicast instead of broadcast? Otherwise, wouldn&#x27;t all clients just switch to whatever machine announced their spoof for the gateway IP last?

Hah! I have vague memories of this. I think this might have inspired it, yes.

based on <a href="http:&#x2F;&#x2F;www.ex-parrot.com&#x2F;pete&#x2F;upside-down-ternet.html" rel="nofollow">http:&#x2F;&#x2F;www.ex-parrot.com&#x2F;pete&#x2F;upside-down-ternet.html</a> by chance? or parallel evolution? :D

Oh, yeah. That&#x27;s a very good point. That&#x27;s probably why it stopped working. I always thought the network admins pulled the plug assuming they&#x27;d been hacked.

Unless you had a special case for the hijacking machines to ignore the spoofed ARPs, the whole thing probably fell apart when they ended up with a loop between each other rather than a path to the real gateway.

Yup, you can still do that. AutoHotkey is a wonderful tool for this. You can intercept input events globally, and transform them or send completely different events to the target app.For example, I use AutoHotkey to implement my JKLmouse program, which turns certain keyboard events into mouse movement for precise control. It&#x27;s similar to the MouseKeys that comes with Windows, but made for laptop keyboards without numeric keypads.And yes, you could definitely do that Minesweeper hack in AutoHotkey! :-)<a href="https:&#x2F;&#x2F;www.autohotkey.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.autohotkey.com&#x2F;</a>

I ran into a fun bug in W10 where my arrow keys were moving the mouse cursor around. Turns out MS Paint does this as a feature and somehow it leaked beyond Paint.<a href="https:&#x2F;&#x2F;superuser.com&#x2F;questions&#x2F;1467313&#x2F;mouse-pointer-moving-on-arrow-keys-pressed" rel="nofollow">https:&#x2F;&#x2F;superuser.com&#x2F;questions&#x2F;1467313&#x2F;mouse-pointer-moving...</a>

&gt; This might be why a few of my Highschool’s computers would interpret every 5th right click in minesweeper as a left clickThis is just pure evil.

Used to be that Windows allowed programs to hook into each others’ event busses. (It might still, I’m not sure.) This might be why a few of my Highschool’s computers would interpret every 5th right click in minesweeper as a left click

Reminds of me my school leaving prank. I rewrote the whole internet on my school&#x27;s computers. Google&#x27;s logo became &quot;Leavers &#x27;08&quot;, Facebook became &quot;Hatebook&quot; and was red, YouTube only played videos of cats, amongst other things.These were the days when nothing had SSL, so you could just intercept and rewrite traffic!My only requirement was: do no actual damageIt was implemented as a Debian live CD that you could drop into any school computer. It would boot up, then Ettercap would MITM the whole network by spoofing the router. It routed all HTTP traffic via Squid and a custom ICAP server that did the actual rewriting. If you removed the live CDs, the network just went back to normal within a couple of minutes.Routing the whole school&#x27;s network through one old Pentium machine wouldn&#x27;t work though, so I figured out a way of doing distributed load balancing: it would do the ARP spoofing slowly and randomly. So, as you added more machines, it would just magically balance between them.It worked great for about an hour then whole network mysteriously stopped working for the rest of the day. I left all the live CDs in the computers as a calling card.Sorry, school network admins.

This is excellent; reminds me of (very much smaller and far less cleverly executed) grief that I caused the administration at my HS back in the day[0].There&#x27;s a few comments about the risks along with a little surprise&#x2F;at least applause for the administration choosing not to waste the courts&#x2F;various other parts of the justice system with this prank. I completely agree -- I don&#x27;t know if I&#x27;m terribly surprised they chose that route (whether or not they were truly upset in the first place). I applaud the students for executing this so carefully&#x2F;well and if my kids pulled something like this off with this level of care -- well, they&#x27;d at least be getting a dinner out of their choosing -- probably a trip to a nearby theme park.I suspect the kids involved were also certain that their approach, attention paid to keep from disrupting class and (thankfully thorough) testing that helped avoid a harmless prank turning into expensive litigation&#x2F;really pissed off parents. But I&#x27;ll bet there was a lot of fear around that, anyway! Had something gone awry -- and that&#x27;s always where the risk is -- I&#x27;m guessing the outcome would have been more severe for these kids.They really played the social engineering&#x2F;covering their hind-quarters side of this prank very well. A large amount of effort was put toward making sure class was not interrupted[1], things worked and were tested and they provided detailed information to the administration on how to secure their systems -- that last piece allowing them to say &quot;Without our minimally invasive prank and report you&#x27;d have never known these issues existed. We&#x27;re not that special; a more malicious student could have discovered these flaws, opted for a porn broadcast and made it difficult&#x2F;impossible to find them to punish.&quot; They probably understand their own school&#x27;s administration and took an educated guess as to how they might handle something like that, too. At least for the scope of anything I did, I knew I wouldn&#x27;t hear from the Vice Principal or Principal -- I&#x27;d solved various computer problems for them by then that the worst I&#x27;d get would be &quot;that was cool, but please don&#x27;t do that again.&quot;I didn&#x27;t get in trouble because the pranks worked similarly -- I tested&#x2F;avoided disruption (most of the time), did no permanent damage and anything was resolved by a reboot (DOS and no fixed disk) and our harm was necessarily limited since there are only so many computers you can covertly pop a floppy disk in -- there was no network. The biggest factor, though, was that our programming teacher sometimes got involved, himself. He was the head of the math department, not your traditional &quot;computer geek&quot; and I was doing things that he wasn&#x27;t teaching, so he encouraged it. The guy was amazing (passed away in the mid-00s).So, kids, if you do try this at home, make sure it all works, provably, very very well and don&#x27;t do anything that will give them other reasons to throw the book at you. And if your administration has more than the typical &quot;Zero Tolerance[2]&quot; stance on things, it&#x27;s just a bad idea regardless.I&#x27;m sure there were a few among the ranks that became furious but cooler heads prevailed. The report at the end was a nice touch.[0] Mostly contained in the computer lab, which was non-networked, but when we discovered the three-letter-acronym TSR (DOS&#x27;s Terminate and Stay Ready) and realized it was rare that another student would reboot an already booted machine (it took forever counting to the 512KB or so RAM installed). Incredibly, I graduated in the late 90s -- my Senior year, the lab that taught (Turbo, then Borland) Pascal was 15 years behind what most people had at home... these diskless all-in-one bastards wouldn&#x27;t break.[1] I&#x27;m sure it took the kids a little longer to get to their classes after that all happened -- that&#x27;s a minor, completely expected, situation here and at least a small reward for the efforts involved.[2] The school ten miles north of us was in a rural district and had a parking lot full of trucks with hunting rifles attached sitting in the parking lot every day (well after all of the schools installed additional locks and added security theater to make parents feel better post-Columbine)...that wasn&#x27;t forbidden at least as far back as the early 00s and I wouldn&#x27;t be surprised if a blind eye is mostly turned, today in some parts of that district.

I got in trouble and subsequently suspended from school back in the ‘90s for causing BSOD’s on classmates computers using WinNuke [0]. They classed it as vandalism even though the payload causes no permanent damage (apart from losing unsaved work).I found more severe vulnerabilities including being able to lift home addresses of students by querying an unprotected endpoint. Didn’t get in trouble for this one, and reported it promptly to the IT administrator.[0] <a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;WinNuke" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;WinNuke</a>

Reminds me lightly of when I was in high school, email was fairly new -- especially at a school. My friend at a fancy private school had a Linux machine to access, and she really wanted to know what someone else had said about her. I managed to script kiddy my way in leveraging her existing shell login, got root, and read the email. What I didn&#x27;t realize was that my .history file contained everything I had done. Eventually the sysadmin wrote me an email saying he knew what was going on and wanted to meet up, stating &#x27;he wouldn&#x27;t cuff me&#x27; and that he was &#x27;a chill dude&#x27;. I was obviously scared, deleted everything, and tried to pretend nothing ever had happened.Luckily no one got in trouble (meaning me or my friend). Not so sure this would happen in 2021.

Hey I know someone who goes to that school, interesting. He was telling me about this incident before

Hey, thanks for the reply. Appreciate the writeup too, it was a fun read. Hope you don&#x27;t mind but I have a few more questions.How were you able to get Chrome RDP access setup without admin privileges? I assume this is automatically blocked via group policy.Now that you have Chrome RDP setup, how were you able to access these machines from outside the network from home?&quot;since I could come in-person with my team for security competitions&quot; I&#x27;m really intrigued now. What were these security competitions about and were they part of a class you were in?

I had Chrome RDP access on a few machines setup earlier, since I could come in-person with my team for security competitions.

I&#x27;m interested to know how was he able to remote access to seemingly any machine in the network, from outside?

In 2001, in 7th grade at the beginning of my web dev &quot;career&quot;, so to speak, I made a website that looked exactly like our school district&#x27;s &quot;snow day&quot; school closure and delay page -- and I allowed anyone to edit the message. I told a few kids about this -- it was a pinnacle of my PHP prowess back then.Got called into an office -- a gifted program administration, not the regular school office. I think one of the teachers there caught wind of my cool little trick, and asked me to take it down right then and there. I was terrified, as I wasn&#x27;t really someone to get into any sort of trouble. I was able to take it down through their machine&#x27;s windows explorer&#x27;s FTP access.Now I realize that this teacher probably saved me from a lot of trouble. I wish these sort of stories were the norm -- where educators welcome the natural curiosity instead of throwing the law at kids who dare to think outside the box.

Hopefully everyone here has seen the movie Hackers, where a similar, but slightly more destructive prank involving the school&#x27;s sprinkler system took place.

It seems like he just was on the school network and  the IPTV devices were also on the same network with no authentication.

He explains it quite clearly that him and his friends were port scanning the schools network for funsies.&quot;From the results, we found various devices exposed on the district network. These included printers, IP phones... and even security cameras without any password authentication!&quot;

In case anyone else is wondering how the heck the kid got access to the district&#x27;s network, the key sentence is hidden in the middle of the post:Since freshman year, I had complete access to the IPTV system. I only messed around with it a few times and had plans for a senior prank, but it moved to the back of my mind and eventually went forgotten.Not sure why they don&#x27;t go into more detail about how exactly &quot;complete access&quot; was obtained, since that is obviously the hardest part of hacking any system. Not trying to downplay the achievement here, just think that this would have deserved a bit more detail.

&gt;and according to them concern about the grade book system being exposed??Junior year in high school, I got suspended for &quot;hacking.&quot;The tl;dr is that I was using a proxy to fetch assignments for class (because the county decided &quot;yeah, this state run Moodle instance is obviously not appropriate for education&quot; and one of my classes used Moodle) and got caught with the proxy configuration screen open. I wish I was joking.Anyway, when I was sitting in the guidance counselor&#x27;s office as the teacher was talking up how &quot;dangerous&quot; I was, I noticed a sticky note with a username and password written on it. Turns out it was an admin account for the gradebook, though I think it was just intended for scheduling.I never did anything bad with those credentials, but that really tanked what little respect I still had for the administrators there.On a lighter note, when stack exchange &amp; co got blocked the next year, I was good friends with the librarians since I helped out a fair amount fixing up their laptop carts (and doing other things the sysadmins were too busy to take care of), and they were able to get them unblocked. It taught me a lot about office politics: people are willing to return favors, so you should always make those connections.

&gt; espite the fact that the only information they had to go off of was my youtube channel which had no references to my actual name whatsoeverAssuming you took the video at the top of the article, it was presumably trivial to figure out who was in the class you were in and then rule out everyone who appears on camera as the camera man. Or just ask the teacher...

&gt; grade book system being exposedIn our high school they didn&#x27;t expose the gradebook in that you could get in and change it, but we were able to see everyone else&#x27;s grades. Teachers would post grades for their class and &quot;obscure&quot; it by posting it with the student ID (you were only supposed to know your own) next to the grade. But when the posted, the entire list was still in alphabetical order so it wasn&#x27;t hard to figure out everyone&#x27;s grade and student ID.And the cherry on top of this was that all the students&#x27; passwords were their student ID.

The school district itself was relatively chill, however the individual deans freaked out. Because the penetration report was sent to the tech team and not the deans, the deans were intent on finding out exactly who did the hack to find something to report to their bosses (and according to them concern about the grade book system being exposed?? Not sure how you’re supposed to rick roll a grade book but if anyone has an idea i’d love to know). As the earliest poster of footage of this event, I actually got tracked down (despite the fact that the only information they had to go off of was my youtube channel which had no references to my actual name whatsoever) and interrogated about what I knew of the event by the dean. The penetration report had been sent a while prior to this (which I knew about, as being a sibling of the original blog poster can have many benefits) which made the entire thing so much funnier. I was thankful that masks were a requirement for in person students at the time, as my mouth was literally twitching the entire time during the interrogation.

Same story but with putty.My own child will never use a school-issued laptop or school wifi.

If they were that nazi-like with their IT policy, why wasn&#x27;t AppLocker turned on?Why report when you can simply administratively deny?

For contrast, I once got suspended from the school computer labs for two weeks for the heinous crime of... running an unauthorized executable from a flash drive.It was Rainmeter; I was showing it to a friend. The IT guy even was like &quot;yeah Rainmeter&#x27;s pretty cool, I read about it in a magazine&quot;. But it was auto-detected and school policy, apparently.

Three things are remarkable about this, and make it a happy story.First, that the pranksters were so egregiously responsible in the way they went about it. They avoided disrupting any actual educational activities; it was meant to be harmless fun, not vandalism. No harm came to anything here.Second, that they documented their findings to the administration as part of the action, including recommendations for improvements.Third, the administration took this as exactly that: a harmless prank by smart, ethical kids who ALSO did them a favor by pointing out the vulnerabilities. If the admin had a panicked fit about this, they could have made it an ugly situation.My educational experience was populated far more by &quot;freak out and yell&quot; types than this school district, which was a shame.

I was at my own community college 2 years ago, and they had those Smart TVs showing news and weather everywhere, as well as custom images uploaded by the clubs on campus.It was supposed to be that a club could log into them, make, and submit a graphic to display on the TVs, but the school would have to review them before they would be displayed.However, I would later find out, a software update had messed up the roles system and so that club username&#x2F;password which was in a public document actually had the ability to post things immediately on the TVs, without review. I found this out when I made a Math Club poster, hit the button, and it was immediately live without a check.I just reported it and it was fixed the next day. My instructor said that could have been really really bad considering some more unscrupulous college kids who would have (not naming names) probably gotten a kick out of throwing pr0n on them...

In middle school all classrooms had their own printer. They were also shared on the entire school network with no security. We had a lot of fun printing stuff to other classes and never got caught.

I went to Buffalo Grove High School in this same district and graduated many years ago. At the time no IPTV systems or EPIC bell systems were in place. However, as soon as I walked in my freshman year I noticed the &#x27;teacher&#x27; WiFi was only using MAC Address Filtering. One minute scan and a spoof later I was poking around to discover a whole lot was visible from this privileged network. “...From the results, we found various devices exposed on the district network. These included printers, IP phones... and even security cameras without any password authentication!” It was even worse back then. It was all exposed on wide open WiFi!My senior prank was going to revolve around the printers. We were shocked to discover every printer not just in BG but across the entire district was accessible with no authentication of any kind. We cooked up ideas and were planning to print either porn or I has cheezburger&#x2F;lolcat memes via telnet (I&#x27;m dating myself.)Ultimately I got into other trouble before we could execute and figured this wasn’t worth not graduating over. I moved on and so happy to see a much better prank on this same network happen so many years later with almost no repercussions. Congratulations and great prank!

For sure lots of fun, we also very quickly found the staff wifi password, and just cloned mac addresses of allowed devices to bypass the filtering.

Nice! I used to carry around a wireless router in my backpack for the same reason, and made sure to surreptitiously plug it in at the back of every class. Similarly, the school had very restricted WiFi, but no restrictions on the wired network. Fun times.

Preface this by saying this was a smaller school, and the students had limited access to wifi. For example a teacher would create a set of radius credentials that would only be active for 1 hour. Since data was also expensive that was not an easy work around.In my grade 11 electronics class, one project we were assigned was to create a digital clock with notifications for one of the teachers. Me and a friend set up a raspberry pi with magic mirror installed on it, and modified some available plugins at the time to allow a google calendar for test dates embedded on the display. The teacher was quite pleased with this, but we convinced him to hard wire it to the network for &quot;stability&quot;. In the background we had installed a vpn connection to one of my vps that I used to host my website, and created a new set of sudo enabled credentials naming it magic-mirror or something. The teacher then reviewed the project and changed the normal user credentials etc. Then right before it was installed in the ceiling, we attached a wifi adapter to the pi. A week or so later we remoted in through the tunnel and enabled a wireless hotspot from the pi. This provided us with internet while we were close to the classroom for the next year. People also over time learned that you could extend the range by hot spotting additional jumps using laptops.

That&#x27;s funny, I worked for a school district about 10 years ago and our IT director was also the transportation director. He knew nothing about IT but I guess they had to give the role to someone at one point and it was him. I think I lasted 2 years before finding my current job.

That’s hilarious, at a small school our bus driver was the local it admin… 7 minutes of rainbow tables with ophcrack live cd was all it took to become domain admin.. never changed it for all 4 years lol.

I&#x27;ve had an internship once at a chain of elementary schools, the main IT guy(s) at those schools were regular teachers that had computers as a hobby. I came in with a few years of school, doing some maintenance, installing some printers (really satisfying with the stick-on stuff), fiddling with the server (a workstation in a broom closet), and playing runescape &#x2F; internetting in the dark, warm server room at the other location away from the main IT guy.

The IT in my district was so bad the students basically ran it for my middle and high school. We did all the desktop repairs and component swaps for free. I don&#x27;t even think we had an &quot;IT guy.&quot; This was 2009-2014 for me.On the bright side, we got comfortable with computers and ended up building our own little projects (in and outside of school). In 10th grade we souped up one of the engineering lab computers by consolidating a bunch of old graphics cards and played games on it, lol.

Are you me?! This basically was my experience working for a very large school district in the early 2000&#x27;s. My favorite was they asked me to train a school bus driver to be the newest member of the IT staff because &quot;they wanted to learn computers&quot;, it also just so happened that this person was the only person their budget could afford (less than 40k&#x2F;year).I worked for them as a contractor for a while and one of the big issues they had was they had tons of money to implement new technology (mostly from grants and things like that), but nearly nothing to maintain old tech. They could buy new computers all day long, but if something needed to be repaired&#x2F;updated&#x2F;maintained, there was no budget or resources to do it. So there were all sorts of fun issues, like they would buy computers and before they could get deployed their warranty would expire (since they weren&#x27;t allowed to buy 3 year warranties on the computers) and computers with bad HDDs would get disposed of, even though the fix might be $50 and 10 minutes of time.

A good buddy of mine did the same, but with the message &quot;DOOM!&quot;His punishment was community service, and the service was having to be basically an intern for the school IT guy. Smart administration, really.

I haven’t thought of net send in years. Circa 2000 I worked at Cisco and added some javascript to my profile in the corporate directory that sent me a net send message with the hostname of the computer that viewed my profile. At that time the hostname usually included the employees username, so I had a nice heads up that somebody was looking me up.I should have left it at that, but Ingot cheeky and also did a net send back to the origin saying something like “thanks for your interest in onionisafruit”. That got escalated and I was threatened with disciplinary action. It didn’t occur to IT that they shouldn’t allow arbitrary script tags in user profiles. The best response was just to threaten the people who were creative with what they were given.

O mannn I was suspended from HS, and banned for 2 years from touching school computers for net send shenanigans as I wasn&#x27;t smart enough to cloak the originating workstation.My message to every single computer in our HS:&quot;Hey what&#x27;s up!&quot;my friend added to this:&quot;Your network (H:&#x2F;) drive is being deleted.&quot;School administrators and teachers did not find this funny.

When I had my net send fun back in school, an IT guy found me and just explained that if it becomes a recurring thing, they&#x27;ll have to disable it on the network. And that they would prefer to keep the functionality available, so it would be a real shame if I ruined that for them. I never did another one, because I understood it would be a dick move.No condescension, no threats. Just treating me like an adult with a constructive conversation. It never occurred that anyone might overreact like many in this thread experienced. Makes me feel pretty fortunate now.

Wow, almost the exact same thing happened to me and I was thrown out of that school, mainly for using another students account to send the base message.

Loving all these net send stories. Back in the day I wrote a C++ program that was basically an IM interface on top of net send. Fun times.

&gt; All the computers displayed a popup windowWhen I engaged in `net send` shenanigans at the local community college, at least the IT staff was smart enough to know where to scramble a runner whenever those dialog boxes popped up across campus.&quot;ALL YOUR BASE ARE BELONG TO US&quot; was quite the meme then, but apparently they thought it was some form of cyber-terrorism.

Oh yeah the early 2000s, not a great day to be a hacker (by hacker I mean actual hacker: <a href="http:&#x2F;&#x2F;catb.org&#x2F;~esr&#x2F;faqs&#x2F;hacker-howto.html" rel="nofollow">http:&#x2F;&#x2F;catb.org&#x2F;~esr&#x2F;faqs&#x2F;hacker-howto.html</a>).I remember getting yelled at for changing the display resolution and typing a few commands in DOS to change file names quickly.Computers were never up to date of course, we had cathodic displays up to 2010.

Except they don&#x27;t pay, you and all the other citizens pay via taxes

Except they don&#x27;t pay themselves, that&#x27;s why they don&#x27;t care.

&gt; we don&#x27;t have any money for thatThey always have the money. They just don&#x27;t care about doing things properly. It simply isn&#x27;t a priority for them.Makes me feel good when someone comes and exploits their negligence. It&#x27;s like divine retribution and they&#x27;re doing god&#x27;s work. They tempt fate and the gods punish them by making them pay more than they would have paid had they done things right. Amazing.

And now ... a group of 30 - no-longer - students treat their IT equipment with hits by a screw driver ... because it works.Our education system is amazing ;)

&gt;&gt; un-seizes and starts turning again.More likely an armature rather than a platter. Violence also worked when the drive would get stuck on a bad sector. Bashing the drive horizontally, while it was on, would sometimes move the arm enough for the drive to reacquire and hopefully not hit the same error on the next read attempt.

&gt; ...pull out the HD. I beat it with the handle, like a good 10 times...Heh. Nice.A coworker&#x27;s Mac wouldn&#x27;t boot. I couldn&#x27;t hear the hard drive. It was a model with the tip of the spindle exposed. I found a pencil with a gummy eraser. Gave the spindle a twist as I turned the power on.Told the amazed user, &quot;Do not turn off your computer until after you have backed up your data. That probably won&#x27;t work twice.&quot;Good times.

I believe the term for this is ‘percussive maintenance’

I did similar violence to my old HDD-based iPod. One day it just made a chugga chugga noise. Meaning the HDD was dead. In researching how to recover some music a forum member mentioned dropping it really hard. So I slammed it into my desk and terrified the office. And it continued working for the next few years.

&quot;stiction&quot;.  Well known in the Apple community in the ... late 80&#x27;s&#x2F;early 90&#x27;s, IIRC?  I want to say I remember some official Apple documentation saying to drop the machine from a few inches up in the air, but I may be misremembering.

The difference between a professional mechanic and an amateur is that the professional know where to hit something with the handle of a screwdriver

I &#x27;worked&#x27; for my own high school&#x27;s IT dept, a few hours a week, as a student. It was an amazing experience working with those guys. I learned so many things, from how to punch, terminate, and run cables to how to set up a Ghost image and deploy it en masse across the district.One day one of the old macs was showing the frowny face in a in-session classroom. Boss sent me down there with specific instructions: &quot;pull out the hard drive and beat it really hard with the handle of this screwdriver&quot;. I was like: &quot;?&quot; and he was like, &quot;just do it&quot;.So I go down there and let myself in, trying not to interrupt the class. I climb behind the computer on a cart and pull out the HD. I beat it with the handle, like a good 10 times. Of course this got the class all riled up. I blushed, but told them this was normal operating procedure. Plug it back in and it works. I was (secretly) as amazed as everyone else in the class.Back in the IT office, I say it worked. IT boss smiles and nods. I ask how. Well as it turns out some of those old hard drives used a vegetable oil based lube that seizes up if it&#x27;s not used for a while. So if you bash it it un-seizes and starts turning again.Anyway great times, fun memories. We all got our CompTIA A+ certifications at the end, but don&#x27;t ask me what IRQ number is for the parallel port these days.

&gt; First day on the job, email to bossThat email chain could be used to prove that you did what you could before the incident. If you were so inclined.

This is not unique to school districts at all, but any organisation, large or small, that treats IT&#x2F;tech only as a necessary inconvenience, instead of an actual part of the org deserving of resources, planning, and people.If you work in tech&#x2F;IT, and the big bosses consider you and your org disparagingly, leave immediately. Something bad will happen with their IT, and you will be blamed, hassled, and harrassed for it.

If only we could have reframed our approach to these situations.Provided what was sent&#x2F;defaced&#x2F;etc wasn&#x27;t hate speech or punching down on someone else, we should have really used these events as flags for identifying kids who could hone their computer skills into something &quot;productive&quot;.

I got two Saturday detentions for finding that same tool (also ~2002) - though I just typed “Hi” and hit send - to everyone on the school network.I of course didn’t really know what I was doing. Looking back, this was a very strange punishment. Jokes on them I guess - left Oklahoma after HS and am now a software engineer in the Bay Area.

&gt; It obviously didn’t work out so I ghosted them and just did everything myself without asking, out of my own pocket.In my one experience in a university, this how it’s done. Just set you own stuff up, hope you aren’t discovered and ideally have a friend high up the ranks.

<pre><code> &gt; I don’t know if it was outright maliciousness, or just extreme anxiety from the IT team lead about job security
</code></pre>
It&#x27;s probably anxiety about job security&#x2F;being overworked rather than maliciousness, but it could be both. It is made more complex by the likelihood that the position pays far less than comparable positions pay elsewhere. This causes the district to hire whatever candidate they can get to take the job. The outcome of that works out one of two ways: (a) the employee leaves as soon as they have enough experience to be paid more to do less work by someone else or (b) the employee stays knowing nobody else will hire them and makes sure to only hire other people who know less than they do.<pre><code> &gt; If I wanted to do something, I would be told that there weren&#x27;t the resources.
</code></pre>
You were told correctly, but probably not told just how bad it is. If it works like it worked for folks I know in similar situations, 80% of the job -- regardless of what you were hired in for or what your title is -- is fixing things that teachers&#x2F;administration broke or didn&#x27;t know how to use correctly. Tell them the laptop is for school business only until you&#x27;re blue in the face, they&#x27;ll visit every web site offering Flash games, some will surf porn sites riddled with malware and if your IT guy doesn&#x27;t have a mental breakdown by then, the only thing they&#x27;re spending the rest of the 20% of time on is blocking teachers&#x2F;non-IT staff from doing things that they&#x27;ve been told, clearly, not to do. The rest is spent locking things down or softening security policies to keep teachers&#x2F;non-IT staff from taking more of that 80% time.<pre><code> &gt; [Volunteering my time] is against policy.
</code></pre>
It could be against policy, but that&#x27;s probably just an excuse being used because it&#x27;s effective at shutting down the request. There&#x27;s a very good reason to say &quot;no&quot; in the IT person&#x27;s mind: your volunteering will still involve their time, and if you&#x27;re not as capable as you claim to be, it&#x27;ll involve a lot of their time. If you&#x27;re one of their users and you&#x27;re claiming to know a lot about IT, you&#x27;re more likely to be seen as &quot;someone who knows enough to be dangerous&quot;--the worst kind of user. Even if they believe you, they&#x27;re confronted with the reality that you deploying&#x2F;using this new &quot;unapproved thing&quot;, will cause others to ask for it -- another teacher&#x2F;staff member will want it and at some point that IT person is going to end up having to deploy it, patch it, fix it, and maintain it. You&#x27;ll find this thinking prevalent in most IT support organizations -- the camel can barely walk so it&#x27;s easier to say &quot;No&quot; and hopefully keep it that way than say &quot;yes&quot; and add enough load to the break its back.<pre><code> &gt; I gave myself one term to see if we could find a working relationship. 
</code></pre>
I feel your pain. I&#x27;m not sure what you&#x27;ve tried and you could very well have just run into a BOFH but assuming this IT person is typical of those I&#x27;ve worked with when I did this work, there are some options. You may have tried these -- it&#x27;s not meant as &quot;well, you obviously approached this all wrong&quot; but rather advice for others on what I have personally seen work (and had work on me when I did this sort of work, albeit a long time ago).For anyone in a similar situation, there are a few ways to &quot;hack your IT person&quot;. It&#x27;s nothing magical and can be applied well beyond IT folks, but I&#x27;m aiming at folks in this conundrum. While I&#x27;ve not worked for a school district, I spent the first 10 years of my career in several levels of support&#x2F;systems and ultimately architecture with the first few being similar to the whole &quot;small IT with too many users who hate IT[2]&quot;. First, understand what their motivation is -- less support, more time to improve&#x2F;architect (or play WoW ;) ...). If you have the expertise, approach that person and &quot;talk shop&quot; -- don&#x27;t reveal that you &quot;have skills&quot;, just ask a question or two in an area that teachers&#x2F;staff often know little about, or go with a simple &quot;I wouldn&#x27;t do what you do ... all these teachers, many of whom haven&#x27;t touched a keyboard that wasn&#x27;t on their phone since 2010 or so ... it&#x27;s got to be hell&quot;. If you can get them to tell a &quot;war story&quot; or two you&#x27;ll probably find a few opportunities to say something that will reveal that you have somewhat of a clue what you&#x27;re talking about. Do this outside of work, on their schedule -- Happy Hour or off-site lunch (not often possible during the school day due to time).If things go well, say something like &quot;I can&#x27;t imagine how you get anything done with such a computer illiterate staff to babysit (aligning yourself with IT over said staff) ... I&#x27;m happy to help out anywhere I can if you can think of something I can do to reduce that grief[0]&quot; This IT person spends their work life dealing mostly with people who are unhappy about things that are broken and the staff they support place blame for those breakages, not the resolution, at their feet[1].You&#x27;re now in the magical role of &quot;the teacher who believes IT isn&#x27;t incompetent.&quot; If you are received well, make your ask. Make it very limited -- if you need to be an admin of your laptop, insist that it be temporary and that you&#x27;ll call the IT person when you are done (offer to let them watch if they want. They won&#x27;t). Insist that you&#x27;ll not let people know IT made an exception and will provide the required excuse if someone notices you&#x27;re running something they can&#x27;t: usually &quot;IT doesn&#x27;t know about it&quot; is settled on. Maybe it&#x27;s something you want every teacher to have -- don&#x27;t dare explain that, and if you have to, outright lie: &quot;I&#x27;m not interested in seeing the district adopt this, I just want to use it myself.&quot; You&#x27;re not shooting your grand plans in the foot, you&#x27;re giving yourself time to provide hard facts&#x2F;evidence to make the case that it should be deployed. If it works out well, start planting the seeds with your IT person: &quot;I really love this application, thanks for letting me use it on my school laptop ... what do you think the support overhead for something like this would be if every teacher had it?&quot; ... listen to their concerns, find answers to each of them, revisit the topic. Your IT person is used to management (administration in schools) saying &quot;this is what we need on every PC&quot; without care for what amount of work&#x2F;grief IT will deal with to sort it out. Administration doesn&#x27;t care about IT griping very much -- it&#x27;s seen as IT, &quot;yet, again&quot;, complaining about having to &quot;do work&quot; and treating completely reasonable (in their minds) requests as though they&#x27;re equivalent to scaling Mount Everest. If you have the data from your unofficial pilot to back you up, and the right person in IT (at least) not working against you, and other financial considerations&#x2F;contracts aren&#x27;t in the way, you&#x27;ll be successful. If you&#x27;re successful and your project works, the next time you may not have to ask at all.Your IT person makes just as many judgements about you and their users as they make about IT but there&#x27;s a lot more of you than their are IT folks. Having an ally&#x2F;expert among the &quot;clueless users&quot; has a much higher value to your IT person than having that person as your ally does for you, even if it doesn&#x27;t seem that way[1--(again)].[0] How much time is IT spending doing &quot;Help Desk&quot; kind of support for everyone outside of IT (regardless of title&#x2F;responsibilities the IT person was hired in for)? It&#x27;s probably 80% &quot;User Support&quot; and 20% &quot;everything else&quot; which means all of the effort put into &quot;everything else&quot; centers around reducing how often teachers have to take time away from IT. Your offer, if its trusted, will reduce that burden at no cost to the IT person. Don&#x27;t make that promise if you&#x27;re not willing to do it, but it&#x27;s unlikely anything will be asked of you.[1] In the &quot;Game of IT Support&quot; (or it&#x27;s variants: &quot;The Game of Network Security Administration&quot;, etc), you can never have a score greater than &quot;Zero&quot;. Zero is &quot;everything works&quot;. When something breaks, you lose points. When you fix it, you gain points up to (but not always) your top score of &quot;Zero&quot;. Roll out massive new infrastructure for WiFi? You&#x27;re at Zero (or less since it probably won&#x27;t work as conveniently as it does at home). You&#x27;re an expense who&#x27;s purpose it is to make things operate the way everyone expects they&#x27;re designed&#x2F;intended&#x2F;meant to work. They also expect that you (IT) shouldn&#x27;t be necessary -- these things should just work like my router&#x2F;PC&#x2F;internet service at home works and shouldn&#x27;t require so much &quot;policy&quot; to &quot;avoid doing things&quot;.[2] While I was still living with my parents, my neighbor referred me to the IT job -- he was in Development. I&#x27;ll never forget when my Dad called me up asking &quot;why is IT (where I worked) at (company) so bad?&quot; after listening to my neighbor berate my company&#x27;s IT operations teams (never me, specifically). We were so hated. By everyone, especially non-Support IT. That was an impossible conversation to have.

When I was a teacher my school IT was run as a petty fiefdom. I don’t know if it was outright maliciousness, or just extreme anxiety from the IT team lead about job security, but they were universally derided amongst staff (including some senior managers I knew) as being terrible to work with.If I wanted to do something I would be told that there weren’t the resources. If I volunteered to be those resources — in my spare time! — I would be told it’s against policy. If I asked if we could revisit the policy I would be told I was welcome to ask the IT committee (closed door meetings, unminuted) to consider it for their agenda. Time passes. Proposal rejected.I gave myself one term to see if we could find a working relationship. It obviously didn’t work out so I ghosted them and just did everything myself without asking, out of my own pocket. I felt like an asshole but at some point you’ve just got to move on, especially if your end goal is improving teaching and learning for the pupils.

School districts absolutely love consultants. Because they have to make difficult decisions, and they can hide behind a consultant. Its part of the bureaucracy survival suite.

My first thought: Your district had an IT department? I guess that&#x27;s probably more common now than when I went to HS in the 90s but I&#x27;m fairly certain IT duties are still farmed out to a small business for the districts I live near.Outside of that, though, I&#x27;ve talked to folks who worked in IT at a nearby hospital[0] and knew several who worked in IT at a University a town over and heard variations of your story. After ransomware hit a few hospitals across the country, my hope is that this is less common but I&#x27;d be surprised if anything is meaningfully better.The problem with getting non-technical people to understand the importance of securing things is that they assume that everything provides a basic level of security. They read about hacks&#x2F;attacks and hear about them on the news but they have probably not experienced one, personally[1]. They apply physical security considerations to the virtual world -- for instance, the keys you use to lock your front door are almost certainly terrible[2] but requiring physical access to the lock makes attacks on them rare. And that&#x27;s the rub, it&#x27;s the mistake in thinking that &quot;Nobody cares about my stuff enough to hack me&quot; which is the evidence used to justify the &quot;it&#x27;s never going to happen to me&quot;. It&#x27;s a failure to understand that even if it were true that an attacker would literally have no use for anything you&#x27;re protecting with a password (which is absolutely false -- your identity is enough) that another target will be chosen ahead of you[3]. On the internet, every target can be attacked at once, silently, from a distance and targets are chosen based on whether or not the attack succeeds.In a High School, you can fully expect there&#x27;s at least one of me in every graduating class. I&#x27;m surprised things like this don&#x27;t happen all the time given how little attention is paid to network security&#x2F;endpoint security in these places. No amount of threats of expulsion, legal action, etc will serve to help when your attackers are High School students[4]. The same part of their brain that makes them believe they&#x27;re immortal&#x2F;causes irresponsible behavior early-on in driving causes them to not understand the real probability that they will face criminal charges which is coupled with them not fully understanding how badly those criminal charges will affect the rest of their lives.[0] The discussion arose after he had watched Season 1 of Mr. Robot and said &quot;that&#x27;s exactly how it is here except we have a (technical) staff of two rather than one&quot;[1] I can&#x27;t tell you how many extended family members have shared that they still use a single password for every account and in a few cases, that password might as well be a variation of &quot;Password&quot;.[2] I have a close friend who learned how to pick locks as a hobby; he filed me off a bump key and taught me how to use it, whacking it with a branch of a tree; I was able to open my supposedly &quot;extra secure&quot; dead bolt pretty consistently with about 15 minutes of practice, he&#x27;s picked each of my locks at one time or another.[3] The old &quot;You can&#x27;t outrun the bear, but if you and your friend are being chased by the same bear, you only need to outrun your friend&quot;.[4] I used to tell my kids that our High School not only had no doors in the stalls of the mens room, there had never been any doors designed into the plan. The partitions were brick, there were no holes, anywhere, where doors had been removed. I figured this was to make it easier to catch kids smoking but while fixing his PC, I asked the principal about it. His answer was &quot;vandalism&quot; -- students would rip them out. Reallt?! I couldn&#x27;t imagine this. Fast forward to this year, the doors on the stalls at my kid&#x27;s HS were ripped out by students during the first week of class. The kids were caught, criminally charged and had to pay for the damage. Their reason? They saw someone do it on TikTok and didn&#x27;t think they&#x27;d get caught (there are 2 dome cameras at the entry to each bathroom!). Despite paying for the damage, the doors are not coming back this year -- I&#x27;d wager they&#x27;ll never come back.

Just in case any onlookers need it spelled out, the phrase “easier to measure” in this case is vastly different from “better.”

People respond to incentives, and &quot;fast-to-react&quot; is easier to measure than &quot;wisely proactive&quot; in at least two ways. First, the risk is no longer theoretical; the damage was measured. Second, the fix is easy to measure: spend $X dollars on Y firm on date Z. This is all nice, easy to understand evidence of a manager doing their job.Alternatively, you have staff pointing out a possible flaw. That staff&#x27;s time was already allocated; their noticing a flaw is a) taking time away from their allocation, and b) tacitly critical of decisions made above their pay grade. And even if they are right, the manager won&#x27;t get credit for prevention, and in fact will get punished for &quot;wasting&quot; resources in an ad hoc way, rather than what they were acquired for.It is depressing in the extreme to work for such an organization, and you were right to quit, because over time these perverse incentives will start to shape you whether you like it or not. The very idea of owning your work, of caring about real-world outcomes, becomes anathema as a matter of survival. You have to exist, along with your org, in a checking-the-boxes, don&#x27;t-notice-what-you-aren&#x27;t-paid-to-notice, mode. It&#x27;s safe and comfortable for the body; it is deadly to the soul.

Working in IT&#x2F;tech for school district is the worst. My experience from many years ago - around 2002, I think:1. First day on the job, email to boss: &quot;Hey, the computer lab at Springfield High has a ton of known security flaws that are begging to be exploited.&quot;2. Reply, 1 week later: &quot;Sorry, we don&#x27;t have any money for that. Just keep everything up-and-running.&quot;3. 3 weeks later the computer lab at Springfield High got &quot;hacked&quot;. All the computers displayed a popup window that said, &quot;Miss Krabappel is a dyke!&quot; (sorry for the offensive language)4. Next day, email from boss: &quot;The computer lab at Springfield High was hacked! Figure out how to fix this and make sure it doesn&#x27;t happen again!&quot;5. A few days later Miss Krabappel filed to sue the school district. The local newspaper picked up the story.6. Email from boss, in full panic mode: &quot;I need you to figure out who hacked the computer lab at Springfield High so we can report him to the police!&quot;7. A week later an independent consulting firm was brought in to help identify the person behind the &quot;hack&quot;. I heard they were paid $50K and found nothing. However, the kid got ratted out when he told all his friends. (It wasn&#x27;t Bart Simpson! ;) )8. Several weeks later: meeting to discuss working with a consulting firm that&#x27;s gonna fix all the security issues because the current staff (me and my team) lacks the skills.9. About 6 months later, I quit.

IoT hacking and rickrolling my high school district