Slashdot Mirror
HS Students Steal SSNs to Prove They Can
thatshortkid writes "Local news in Chicago is reporting about two Hinsdale Central High School students who breached their school's computer system and retrieved all of their peers' (plus staff's) Social Security Numbers. They claim they have destroyed the information and haven't given it out, but the SSA and FTC have been alerted for good measure. While they claim their motive was to prove that the breach could take place and no malice was involved, they face possible school disciplinary action and criminal charges."
They should be paying them not punishing them.
Unfortunately, people do not learn from others' mistakes. How many times have people broken into school databases only to be arrested! It does prove that you can break into a DB, but so what? Once again it goes to show you "no good deed goes unpunished!"
-Palal
Was it a Microsoft 2003 server edition computer ?
While it may be an obvious way to get the schools attention on the matter, it is, as the article said, a good way to get yourself expelled, etc. Maybe if they took the issue with the IT staff, and showed them one-on-one how it could be done, they would not be in any harms way.
Okay, I understand that what these kids did was stupid, and serious, but is it really necessary to include quotes like this...?
"When we grow up and get our jobs, that's our life right there. They can access anything about us. It just screws us up for the rest of our lives," said Julianne Junus, student.
I guess it kind of sucks that they're gonna get punished for this, but they deserve it. You can't legally break into someone's house just to show you can, they should have told the school (or some news stations) that they were planning to show how easy it would be to get into the system. Then under a controlled environment (with some type of supervisors there) they can show how easy it would be. That way everyone knows the attack is going on and the school knows what was done by the students rather than relying on their word.
How can the exploit be fixed if the administartion will not admit it exists. These individuals should not receive punishments. If anything, they should receive jobs at their school. It's sad, but it seems High School computers are being ran more by pointy-haired bosses than actual IT individual. I just hope the trend can curb and go back to where data can be secured again in academic institutions.
Just because you can doesn't mean you should.
I know people will come on here and say "OH but the administrators probably wouldn't listen so they had to do this to prove how serious it was". I'm sure if they followed good procedure and presented a good presentation to the Board/etc they would of gotten a better reception then what they did.
Your hair look like poop, Bob! - Wanker.
Nothing will bring pain to you quite like making someone (or some organization) look foolish. Even if you probably are at least somewhat in the right.
A bit off-topic, but still.... If someone steals SSNs of college students and uses them 10-20 years down the road, chances are these people will have perfect credit, and won't even know where the attack came from. It's a long shot, but still.
-Palal
would anyone have listened to them if they hadn't gone public?
If kids can do it, why would this be a problem for the kids? Shouldn't it be publically shown that the system was insecure, not that it was breached?
When is it that our governments will be responsible?
just a thought....
Support NYCountryLawyer RIAA vs People
The people who should be threatened with jail time are those who designed the poor system, not those who pointed out the mistakes. Yes, yes, I know that'll never happen, but honestly, this way is just plain stupid.
I mean seriously, if you were designing a car, and had released it. Millions of people were driving it. Someone takes theirs out to a desert and does some tests on it. They find that if you press the wrong button, it blows up. You decide to sue them and try to throw them in jail. Does that make ANY sense?
The stupidity in the system is really quite astounding.
Those kids grow up so fast. When I was in high school we just worried about ways to drink alcohol, and what Denny's everyone was meeting at. Apparently now thats been taken over by identity theft and listening to NPR.
Often high school IT departments aren't that...trained in security.
There was an isuse at my school for over 2 years with anonymous ftp login to their server, databases for the grading software, and the web server.
Telling the IT department this at least 10 times never got anywhere because "who would actually do anything bad"
Eventually the website got defaced. It was then fixed..
Sometimes it takes a problem they can see before they'll actually fix it.. And a defaced website, is a problem they can see.
We wore our social security numbers around our neck in our county.
Sure, it was after the Columbine crap and during all of the security increases, but tell me what kind of security is requiring all of the students and faculty to wear ID tags with Code39 encoded social security numbers around their neck due to pure lazyness and neglegence?
It's really easy to memorize Code 39, it's a * characters and numbers 0-9, so I'd ask the teachers and the vice principals to let me see their ID for a second and then hand them their social security number.
Security my ass.
Honestly, what a bunch of fuck ups. If you're trying to do a service by penetration testing, you at the very least notify the sysadmins of the vulnerability you plan to explore.
To go all the way through to stealing *everyone's* information, and then afterwards claim you only did it to help is bad judgment at best. In some states it's criminal.
Good, throw them in jail.
Those miscreants are a danger to society, and consider the cash value of all of the damage that they have done, not to mention the bruised egos!
They are terrorists, and should be executed!
</sarcasm>
Copying the openly readable, unencrypted database (say in MySQL) and parsing for XXX-YY-ZZZZ found to be hacking?
Well, for one, it is public knowledge that the SSN X's (in my representation) are in fact, state codes. I have some reason to believe that the Y might be county or some sort of district code, but I cant be soo sure unless I'd gather enough SSN's and location of birth
Yes, the mail center in which you were born is what the state code is attributed to, not the actual locale you live in. Say your parents lived in Phoenix, Arizona but went on a trip to New York City. The baby's SSN would start with 050 to 134, NOT the Arizona 526 prefix.
Well, hope this sparks up some replys (and mod points! yay mod points!)
...given any information out or haven't done anything malicious with it doesn't mean they're telling the truth.
There's fault in your logic. They didn't test their own car. They broke into someone else's car and ran the tests.
These two men broke the law to prove a point they held dear. I feel they did the right thing, but the law does exist and they may be punished. I hope that the judge presiding over a potential criminal case still has discrection to choose the punishment should they be found guilty of a crime. If they should be found guilty and sentenced, we should do our best to provide what support we can.
What did Jefferson say about the tree of liberty and the blood of martyrs? Perhaps a bit over the top, but I feel the sentiment is appropriate.
Blar.
We wore our social security numbers around our neck in our county. Sure, it was after the Columbine crap and during all of the security increases, but tell me what kind of security is requiring all of the students and faculty to wear ID tags with Code39 encoded social security numbers around their neck due to pure lazyness and neglegence? It's really easy to memorize Code 39, it's a * characters and numbers 0-9, so I'd ask the teachers and the vice principals to let me see their ID for a second and then hand them their social security number. Security my ass.
Not many people know this, but you can send a written letter to the major credit companies like Experien, Transworld, and whatever the 3rd most common one is (??). Then they will not release your credit until you contact them and "unlock" your credit report for 3 days, which can be done online. Then you can get your new credit card, online hooker, or crack. It's a bit of a pain in the ass, but I think it's worth it.
I myself have my horrible credit report locked tight, that way nobody can get approved for anything, even if my credit was approvable! Brilliant, I say.
Peace, love, nuclear weapons.
Personally, this makes me wonder why I would ever give anyone my SSN, unless they can prove they will live up to their federally mandated responsibilities.
This just shows that most companies and governments cannot do so.
Support NYCountryLawyer RIAA vs People
I had the "fun" of working in our school's server room my freshman year. We had the servers get hacked at least twice.
The first time was a simple brute force attack on a AppleShare server, because the main admin refused to put a limit on the number of password attempts because it was too inconvient to have them simply go up to an admin and reset their password, despite that's more or less exactly what would have to happen if someone forgot their password anyways. I found out that year who had done it, but congratulated the person.
The second time it was because the rather ancient admin password leaked out and they were able to use that to not only get into the teacher's file server but also the SASI server with all the grade data! Why did we use this password? Well be cause it was tradition! I found out only a couple months ago who did this, he didn't
There's so much incompetence at so many High Schools it wouldn't surprise me if it was something as simple as a server that hadn't been patched in ages. Aren't you glad to know that these are the people with all your insensitive data? As it stands at my college they use SS#s for *everything* even though they probably shouldn't.
Assuming the article is correct in that they have had the data for months and only started talking about it now that they school had sent home a letter regarding the matter, there is a perfectly good reason to punish them now, it has nothing to do with being punished for doing good. Had they alerted the school or the IT department of the break-in when they performed the attack, they would have had some credibility in saying that they had done it to prove that it could be done. Instead they held onto the data for months and only brought this to the attention of the school and other people involved when they had been found out. There is little reason to believe they did it for the good of the school.
I'm certainly not suggesting something as draconian as RealID. But it should not be necessary to keep one's SSN any more secret than the account and routing numbers printed on personal checks.
I support punishment of the administrators who did not sufficiently secure that sensitive information. I also support to a lesser degree the punishment of the children who stole the information. However, had that event not taken place, some less scrupulous children might have misused the information that was so easily stolen.
Most databases and file servers have permissions systems in place that can authenticate by host and IP range. Most administrators assign different IP ranges for different purposes - staff should be different from student-accessible. Also, multiple passwords are required in most systems to access sensitive information: computer login, network login, database login. Passwords are also supposed to change often. Why were these precautions not taken, and why did the admin not notice anything suspicious until it was too late?
Never underestimate 15 year olds. Why? First, they have WAY more free time than any of us working folk. Come on. They get home at 3, and have maybe an hour or two of homework to do sometimes, then they stay up until 1-2 AM. Second, there are a lot of them for every administrator at any school. Third, they are hormonally imbalanced and do irrational stuff to prove irrational points. They can exploit all of those points to their advantage at almost no notice. I did, you did, most everyone did.
Someone needs to be made an example to prevent this sort of thing elsewhere. I think the administrator is the best choice, personally.
So the schools are teaching high school students to be script kiddies? Man, I missed the old days where students were taught how to steal radios, hub caps and hood ornaments from the DINKs (Double Income No Kids). Now the script kiddies are ripping everyone off.
Doesn't really give any hard data in the article on the intentions, other than "it appears" to be "just for sport". It did say, however, that this happened months ago. So it's not as if they cracked in, prove their theory, and then reported it the next day or something. I get the feeling that this was just kids fucking around and did something the felt was "cool" and have the info as a trophy of sorts (though how they can conclusively prove that, I don't know).
:(
If it was done solely to draw attention to a security flaw, I'd be cheering a little more loudly for these unidentified kids, but at this point, to me, it just looks like schmucks needing a spanking.
I'm curious what tipped off the admins 'months later'...
BytesTemplar.com
Rather, bad taste. They most likely had great intentions, but they were mislead. Certainly, they are teenagers who notoriously make poor decisions at times, so maybe this could be swept under the rug. It should, anyways, be obvious these kids probably should be in school and most likely go to college. I also wouldn't be surprised if they were able to get their teachers, office, etc, to fairly easily give them passwords, etc.
"If you are a dreamer, a wisher, a liar, A hope-er, a pray-er, a magic bean buyer
To prevent being expelled just send the SSNs to the IT administration through anonymous snail mail. Explain how you broke in, and hopefully they will fix the problem.
Keeping SSNs around obviously can't be avoided for the school's employees (for tax and other reasons), but employee databases should be separate from student records, and there are far fewer employees than students anyway.
Basically, SSNs seem to have become the knee-jerk instant universal ID number for American firms and institutions of all sorts, which is a pity. It's best if we (as IT professionals) try to encourage the keepers of old databases to transition away from using them, and to strongly recommend that new databases not use them at all, wherever possible.
...a long career in cybersecurity.
Good time to get into it, too.
tasks(723) drafts(105) languages(484) examples(29106)
I broke into my school's netware directory just because the sysadmin was such a S*B. I changed access rights and passwd of a random account and browsed around to find out the sysadmin had usernames and passwords for every account written in a text file. I then printed the whole thing and anonymously pinned it on the main bulletin board.
In another case, a student was cleaning up a messy computer lab, and accidently plugged both ends of the same cable into two network ports. He thought that the second end was leading to a computer (the room was cluttered). It brought down the entire network (>1000 nodes) for at least 12 hours, and he was nearly punished (the wizened up and let him off with a wrist-smacking).
Some students were found with command prompts on their student folders (stored on a school server). It was shown by the IT staff that they neither did nor intended any damage, and the IT staff saw no reason to punish them. While this was obviously stupid on the students' part, they were still punished (initally the school tried to suspend them but after administrative appeals settled for two Saturday detentions).
Just food for thought. It's obviously important that the IT in a high school keep up a secure network, and they should not trust students 100% (at least from the get-go). But punishing students for pointing out security flaws? The school should be thankful. It has always seemed to me that they could save a bundle by letting five or ten students come in over a weekend and, with supervision, try to crack the network. Rumor is that the IT department there instead hired independent consultants to evaluate their systems, and were told they needed either more consultants, or a larger IT staff. It's a tough job to administer a secure, functional network in a school. Especially a big high school.
there will be a lot of teeth gnashing from slashdotters about this "injustice". usually because the average slashdotter trusts some anarchist high school students more than they probably trust their own police department. they will point out that a security system untested is never sound, and that this move will strengthen security. that better these high school students than someone with truly dark intent break in.
the problem has to do with what the word "trust" means. society at large doesn't trust an intelligent well-intentioned hacker (these students are hackers as in the old school sense if there ever was one, as opposed to the new school "hacker=terrorist" sense). but they DO trust a bumbling idiotic underpaid school administrator.
why?
it's about how the average slashdotter views "trust" and how society at large views "trust". the average slashdotter trusts intelligence, cleverness, technical literacy. but the average joe simply trusts accountability.
the school administrator's job is to keep security, he is trusted by society, paid by society to do this. he is accountable. the school administrator will be reprimanded by this breach, and the breach will be repaired. this is society at work. meanwhile, there is no social contract with the high school student. there is no trust. there is no accountability.
yes, security will be better because of what they did. yes, their intent is perfectly sound. but there is no trust, there is no accountability as far as the average joe sees it.
the lesson therein is for the average slashdotter then:
accountability is more important than cleverness.
to put it another way, the average joe doesn't care how technologically sophisticated the security is on their SSNs. the average joe just cares if THERE IS SOME ACCOUNTABILITY. so the SSNs could be on a text file on webserver, they don't care. the question si: is someone's job on the line for the theft? the average joe understands this concept: someone will suffer if my identity is stolen. there fore, someone out there is motivated to protect me.
meanwhile, these students have no social contract, no accountability. what is their intent? what is their motivation to do good by me? all i have to trust is their word, and i don't know them from adam. therefore, all that they have done for the average joe goes unheeded, unrecognized. the students helped the average joe, but the average joe sees them as criminals.
folks: gnash your teeth all you want, i'm just trying to give you all a heads up about the difference in thinking between the average joe and the average slashdotter. if you don't like what i am saying, don't be mad at me, don't shoot the messenger.
be angry that trust does not mean same thing to you and the average guy on the street.
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Most of us live with really crappy security... in our place of residence.
Now, if you're like me, you've got a generic commercial alarm system and generic deadbolts on the front and rear doors, which is the extent of our "security", otherwise known as "just a little harder to rob than the house next door".
I know a determined thief could break in and steal everything I have in the house, thank you very much. If I have the option of choosing,
A) some kids actually breaking into my house during my vacation, stealing my stuff, then returning all of it when I get back with a postcard saying, "Hey! Your house is insecure!", or...
B) some kids pointing out in good faith that my home security model isn't all that secure, and ten ways a thief could bypass it,
I know which option I'd be pressing charges and which option I wouldn't.
Light a fire for a man and he'll be warm for a day. Light a man on fire and he'll be warm for the rest of his life.
The article is sorely lacking. Did the kids 'fess up, or did someone find out? Were they really "hacking", or was there a case of some dumba$$ IT staff leaving an MS Access file sitting in a directory on the webserver? If these HS students "hacked" the SSNs a few months ago, how many other people have had access to them as well in those last few months? Did the students go to the administration first & get the "there's no problem here, leave us alone" PHB brush-off response?
Details, man - we need details!
...do pen testing without approval of the system's owner.
> get tea
No Tea: dropped.
With all sorts of reports of database hacks and the big deal that's made of it, these kids probably felt the problem was very serious and should be addressed. Having graduated from high school relativly recently, I can tell anyone who was out before this was an issue that the administration does not listen to students' suggestions relating to IT. They would rather fear the intelligence that these students possess and punish them. Take it from me, I got kicked out of a comp sci class along with two other students for "hacking the registry" when what was actually happening was we were the top 3 students and we finished everything so we were working on different extra credit programs. That's all. It wasn't even freelance programming, they were extra credit projects offered to us. When I tried to explain this to the principal, he banned me from the computer lab. Unreasonable administration produces unreasonable students.
If I ever found myself in such a situation, the way I would look at it is that my private space was violated by the people who put my personal information where it could be indirectly but publicly accessed, not the people who chose to take advantage of that.
Just a thought.
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
They are being punished more for making the "adults" looked foolish than the severity of their mischief.
ELOI, ELOI, LAMA SABACHTHANI!?
Right or wrong they might provide expertise to terrorists, or might engage in weapons of mass destruction related activity programs.
Jesus. My ID has it printed right on it. If you forgot your ID, you had to tell them your social to get lunch.
For goodness sake, anyone who's seen your driver's license -- say the bartender at whatever club or whatever -- can open a credit card under your name, and from that point on you're pretty much screwed. There is no reason that SSN should be legal proof-of-identity, because it's absurdly easy to steal.
I used to read Caltizzle. I was a lot cooler than you.
when they were done, they climed a mountain.
Table-ized A.I.
if they can't or won't take care of it, there's nothing compelling you to do it for them.
Having my data on their servers seems compelling enough...
I graduated from Hinsdale Central High School in 1998 after my 4 required years before college. Every single teacher during that time had a computer with access to the network as well as the labs in the school. Each teacher and administrative assistant had access to the same SCO system (Where student's grades and private info, as well as the teachers, was stored) through telnet, and each student had open access to the labs and computers in the library. Each and every machine in the facility was slapped into a large rack hub and the concept of locking down was left to a graduate of DeVry who had to give the impression he knew what he was doing (He didn't).
... just kidding. You know what, I think I might just go buy em a beer and see if I can testify on their behalf about the ineptitude of the school. *cheers*
Being stuck in a study hall in the library, I spent my time playing with the computers bored and got in trouble for it. I informed the administration of these issues (setting up a sniffer and grabbing about 10 logins in a day) at the time out of attempting to be helpful back in 95. Let me just say that responses were not exactly kind for pointing out problems and suggesting solutions. These people do not care about it until its thrown in their face like this and make magic happen to make problems vanish. The only impression I truly recieved was that if I told any other students about it, I would be severly reprimanded by the district.
Frankly I think these kids were idiots for not at least playing more with the system and keeping their mouths shut, who knows, they too might have ended up going to CMU/MIT/Stanford/McGill by blackmailing
How about stealing the records of those who were students 10-15 years ago ? Certainly you can use those right now.
Since I am not any sort of legal expert, is there any reason why whistle blower laws dont at least indirectly apply?
I suppose that instead of exposing blatant wrong doing, they are instead exposing what could be considered gross negligence with the handling of sensitive information.
END COMMUNICATION
Them storing your data on their servers only increases their liability in the event it all blows up in their faces. It doesn't compel you to break in just to prove to them that their doors aren't locked well enough.
Ultimately, if your data means that much to you, be all the wiser and don't give it to them.
"There is much pleasure to be gained from useless knowledge." - Bertrand Russell.
Really, Really not smart. Despite their intentions, people totally freak out about things like this. "You hacked our computers? OMG you must be terrorist/credit fraudster/." It doesn't matter how insecure the system is; if you get inside, people think you need to be punished. Depending on how far the school wants to take this, the kids might end up with this on a criminal record, and computer intrusion is (IIRC) a felony. If they wanted to get the problem fixed they should have sent an anonymous email or something saying where the hole is and how to fix it. The downside to that would be you don't get people freaked out and aware of the vulnerabilities that exist. I just hope it ends up ok for them cause this could follow them for the rest of their lives.
Both the system designers and the people wh broke in should be punished. We cannot let anyone out with the excuse that they were just trying to point out security weaknesses. Otherwise every criminal willl use that excuse. "Oh, yes, I did pick your pocket, but I was only trying to demonstrate how insecure your pocket is. You need to put your wallet in a pocket with a button", etc.
Don't inkjet printers these days print yellow markers to indicate a GUID or serial #?
Plus there's the postmark info, fingerprints, the easily identified stocks of paper and ink you used... (hope you bought it w/cash) Not to mention the DNA on skin flakes you forgot to wipe off, and the saliva on the back of the stamp. And all the cameras that recorded you grinning as you bought the paper and then caught you later dropping in that public mailbox.
On the other hand, they never got the anthrax guy(s)...
Once in high school, and once again in college, I discovered that the school's directory (Novell NDS and Microsoft Active Directory, respectively) was populated from the student and employee databases (which used the SSN as an "ID number"*) and that the somewhat naïve admins stored these numbers as world-readable attributes accessible through advertised LDAP servers.
Both times, I made discreet telephone calls to sysadmins I knew, who were somewhat embarassed that I knew more about permissions than they did, but fixed the problems.
I never got in trouble--everyone involved already understood that I would keep my mouth shut unless the problem wasn't fixed promptly, in which case my complaints to the Trustees or the U.S. Department of Education would've cost some people their jobs.
(* As a regular reader of the RISKS-DIGEST even at that age, I had already demanded that my own SSN not be used for that purpose; substitute student numbers were assigned.)
What so "good" about cracking that DB? If they wanted to prove that it is not secure, they could have offered their service to the authorities.
May Peace Prevail On Earth
What ever happened to the good old days, when all high schoolers did was smoke pot and play video games?
I actually went to a college that had email addresses in the form of stu_xxx-xx-xxxx@western.edu. And to make matters worse the school couldn't understand why I refused to use their email.
Restore America: Dr. Ron Paul for President!
The correct quote is:
"When we grow up and get our jobs, that's our life right there. They can access anything about us. It just screws us up for the rest of our lives," said Julianne Junus, local fucktard.
Nobody likes a smartass.
English is easier said than done.
Wouldn't it be great if there were two crimes here? The first being the students breaking into the system. The second being that the system was insecure. With so many systems containing our personal information today, doesn't the holder of said personal information have an obligation to keep it secure? I mean, my bank has to make sure that my money is secure and they insure it for $100,000. If someone breaks into the bank, the bank/insurance looses as well as the person robbing the bank (provided they are caught). Here, shouldn't the school have some responsibility? Maybe the school could pay for an identity protection service to monitor the identities of the students there who had their SSNs stolen. That way, the school is paying for their neglagence in protecting personal information by paying a third party to protect students from identity theft.
I want some responsibility from companies. I'm sick of hearing that "people need to be responsible for their actions, well, unless they're wealthy corportations."
Hacking a computer is hacking a computer, not sodomizing a hamster or breaking into your neighbor's house. It's a computer in a public school, not someone's private stash of Star Trek porn.
Unfortunately, they will probably discover that the adults in the school system view students as "potential discipline problems", not as human beings. Pointing out the stupidity or incompetence of the school system's staff is a serious offense. We do have to prepare them for the real world.
Mea navis aericumbens anguillis abundat
This is not a case of playing the white knight (or hat) and bringing the problem to the public's, or even school's, attention. These students did the theft/intrusion months ago! They didn't come forward, THEY WERE CAUGHT! Read here, for one.
All of you apologists need to get a fucking clue! You are the reason bad people go unpunished. You fucking social relativists can rationalize anything you believe.
Ultimately, if your data means that much to you, be all the wiser and don't give it to them. Um. And how exactly do you propose to do that, since they're already students?
I'm an anonymous Fort Bend ISD student. I have found so much private/personal information, both on students and faculty, that it would make your cringe and probably embarass quite a few people here. I even have found grades.
The file shares are left open and easy to get in to as a regular user. Commonly, there are many accounts on each school's NT domain server that have 'Administrator' privileges, sometimes unintentionally (I think it is the default group membership when you add users or something). Each computer plugged into the school network that authenticates against that domain server can be easily breached - you can access any computers C$ share. Through this, I was able to get into the computers of principals and teachers.
Just a little tidbit of information for FBISD residents and students who would like to know how well their hundreds of millions of dollars in tax hikes are being used. This isn't hacking some obsucre exploit, this is incompetency by FBISD staff IT (MCSE toting idiots) department.
I've accessed sensitive information on school computers and servers multiple times often without using more than a student user account and explorer. High school computers have got to be some of the shittiest in regards to security. And if default windows access exposes information imagine what I see when using a simple linux box ('hidden' shares are all shown by default and such fun things). The kids should be showing people how easy it is to see information so that it isn't stored like that.
-Tim Louden
You're an idiot. And I fed the troll, I know. Still, the fact is you're an idiot.
I think it should be fairly obvious that whatever they claim, they did something illegal. Add to that the fact that they did it months ago and no-one found out until now, and their claim is suspect even more.
Why is it that they had the sense to break into this system, but not to tell the administrators beforehand? If they were trying to show vulnerability, that means they had a little bit of common sense, right? Why not enough to figure out that doing it without permission won't get them anywhere good?
Discworld.
Why does a public high school even need your SSN? I can understand them needing the staff SSNs for payroll, but why do they need a kid's social security number?
Does anyone know? It's not like the students are paying any taxes towards social security through the high school
When it comes to data, I'm wondering what possession actually means. Specifically, say I have a list of SSN's as S, and I apply an encryption function encrypt(), they become encrypt(S). Given only encrypt(S), am I illegally possessing data? Taken one step further. Clearly, applying decrypt() to encrypt(S) gives me back S. Assume I have some data D. If I can arrive at a function decrypt() that can turn D into the original S, shouldn't D be as illegal as encrypt(S)?
As a realistic example, imagine I was able to write a function decrypt() such that it could turn a text file of one of the works of shakespeare into a list of social security numbers. Would then, all people who have a text version of said shakespearean work be in possession of illegal material?
Quite honestly, if you take this to a logical extreme, no matter what the input data, given the ability to write any function, the output data could be anything you could conceive. What if your function is simply the concatenation of "illegal" data to the output. Would then the "reverse engineering" of said "encryption" function be illegal according to the DMCA? It is a "security device" at this point, right?
This all boils down to the difference between data and functions on data. It is illegal to hold certain data. But what if we lable data as functions on data. In fact, security device functions on data. Could we then distribute the functions and make it illegal for people to reverse engineer the functions without permission?
mp3's are only for those with bad memories
It's true that if I thought my bank wasn't securing my money well enough, I might want to check it out, but I'm pretty sure sitting down one day, doing some random fund transfering, then transfering it back would make quite a few people unhappy.
The scary thing is until very recently (last semester) this information on every student included home phone numbers *and* Social Security numbers. Don't go to my school if you value your privacy. Our IT department is stuck in 1999.
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
One easy scenario to imagine: They heard rumors that someone else had hacked into the database. Not knowing anything for sure, they started probing for how it might have been done, only to suddenly discover themselves in the middle of the data. I don't see any way to excuse it if they then copied some or all of the data, no matter what they claim about destruction of those copies--but that certainly won't do much if there actually was an earlier and more "discreet" breakin. Not nearly enough data in the article to really understand what went on there, though it sounds like they never actually reported it, but rather were caught for boasting about it. That makes me think they were idiots, too, and some more cunning and diabolical students may have followed the rumors and also obtained the data.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
Hinsdale school officials say the accused students have had the Social Security numbers of their fellow students and teachers for months
So what happened in the intervening months? Did they only react with charges when it became public? Meanwhile, how did they only find out after "months?" Maybe the kids were cooperating until someone let the cat out of the bag and the administration decided that a public embarasment would have to be punished.
Nooooobody knows. WTG Reporting!
I dunno about any of you. But when I was in college, the professors would post exam grades outside their offices using SSN. If you knew Jane Doe had the highest grade, it wasn't too hard to figure out her SSN.
The Perkins Loan (a federal loan) prints your SSN on each bill you receive. And you're supposed to print your SSN in the Memo section of your payment.
If SSN is going to be so critical, we should be able to change it routinely. According to the SSA website, you can only change it if you are changing your identity (as in to escape an abusive situation or a witeness protection action).
In a civilised country where personal data was actually protected and where personal responsibility existed, such an event would have generated very pointed questions of the people who failed to protect vital personal information for hundreds or thousand of students.
The focus on sound bites denouncing petty criminals makes a convenient smokescreen to avoid them though.
Nihil Illegitemi Carborvndvm
I see a lot of debate about whether or not it's ok to break into a system to prove a vulnrability, and I think a lot of it comes down to knowing how the people who's system it is will react.
When I was in highschool, we had two sets of systems, one was a district wide computer system that held grades, attendence, things of that nature. A second system was shared among the two highschools in my district for the computer science classes. It served webspace, and held shell accounts for all the CS students.
I found vulnrabilities in both systems. On the local CS server we managed to root the server, a couple of my friends and I did a few practical jokes as a demonstration of the vulnrability (nothing to bad really, though certainly a little annoying, things like switching vim and emacs, or changing peoples login shells from bash to tcs). Our CS teacher found it amusing, and even gave us extra credit once we'd put everything back right and shown him the vulnrability. On the other hand, we found a couple of pretty bad vulnrabilities in the main district network. I pointed out to a friend of mine that it probably was a pooor idea to go about doing something similar to the district servers, but he decided that it would be more fun to make a big demostration. He ended up getting expelled for the remainder of the schoolyear. They also never patched the vulnrability.
Famous Last Words: "hmm...wikipedia says it's edible"
I'm not from the US and now I have to get this explained. I'm not trolling. I can't really understand how SSNs are supposed to work.
The SSN seems to be a number identifying a person. (We have that where I live too.) But somehow, this number is assumed to be secret, like a password. If yout can learn the number you can access anything about the person and you also seem to be able to hurt the person financially. Withdraw funds? The security seems to revolve around the fact that the number (the identity of the person) is secret! Because everyone here seems to be upset that these kids expose all those numbers!?!? This boggles my mind.
Are there no other attempts at authentication? IDs? If your SSN is your password, how do you change it? (I would like to have it changed several times a year, no matter what if there is no other security than secrecy.) Can someone explain?
)9TSS
When i was a sophomore in college, I discovered (completely by chance) that my college's email server was using non-shadowed password files. I did the requiste steps and showed security personnell the problem. Six months later I was kicked out of the RTA program (tech support guys in the dorms) and 3 months after that I was kicked out of school. .edu is not serious about security. They're just about keeping their jobs. All I ever saw from our campus IT people was excuses- their internet didn't run enough because students were running AIM too much, not because they built an inadequate network. IT at a college is the dregs of the IT degree world. You or I know more than the average director of IT at a college (hint: he doesn't read slashdot. Really, our colleges should have the best computer people, not the dregs. Unfortunately, that's a job for the legislature, which means it won't get done. oh wel.
I could argue that those who are responsible for the safe-keeping of that information were at fault, not the ones to gained access to it. The access was only allowed to occur because of a faulty system. The faulty system could have been compromised by anyone. It just so happens that it was compromised by some students who wanted to show that it was indeed faulty- not so that they could criminally use the information they acquired, but so that those in charge might be inclined to take their responsibility more seriously, and get the problem fixed.
If this was the first effort on the part of the students to notify the school of the suspected problem, I will say that their modus operandus wasn't the smartest. If, however, the school had been notified earlier, by refused to take action, someone's head should roll...and I'm not talking about the students.
Right, because the authorities would totally not blow them off or anything.
Why yes, I AM a rocket scientist!
What nobody here realizes is that to be convicted, those boys have to be found of "Mens Rhea", or guilty mind. Basically, their actions have to of been malicious for them to be guilty.
-ND
I worked at a fast food restaurant for nearly three years. Their back office computer had a program that listed every employee's hours which us employees regularly checked to see how many hours we had built up. This same program also listed every single employee's social security number too! It wouldn't take much more than getting a job to get that list, fiddle with the computer for a few minutes, and hit print.
Nothing special about what these kids did. I was getting around my high school's computer security every day just so I could work. I even managed to the FTP password for the school's site out of an FTP program because I needed to punch it into another program.
School IT directors are clueless. That should be a scientific fact.
Around 1998 or so I was mirroring with a mirroring website tool healthnet.com for our intranet. Most employees were not allowed internet access btw. Picked up a PDF with over 5,000 names, social security #'s, addresses, etc. Did I dare report it? Heck no....if I tried to be the good guy I'm sure I'd have some sort of record. Anyway I alerted a couple of my co-workers and needless to say we didn't register on their website to access our health records, etc.
The only way to find the flaws in security is to disclose the system's workings and invite public feedback. It is never helpful to punish those who help to find the flaws without causing damage.
This is the same for the circumvention laws. It is now illegal to prove if certain systems are flawed or not.
So wear rubber gloves, print on old stock you got for free in a parking lot somewhere with an older laser printer that you bought with cash at a computer repair place (easily under $50). Boxes of envelopes are so common that they're impossible to tie to any one person.
Expose it to some ozone (from an ozone generator) for a while and the only thing that will be on it when it arrives is the postman's DNA.
From my experiences doing pro-bono work at four different high schools, I'd say that most of them barely have the capability to deal with the most rudimentary data management tasks. I'm not saying this to be dismissive of schools or the people who work there, but they are in many cases so short on human and technology resources that creating and managing unique IDs for each student isn't something that would even cross their minds.
The SSN is, as you mentioned, the knee-jerk instant universal ID number precisely because it requires no extra effort. This is not a good situation, but it has come about because there is no compelling reason (that many institutions can see) to devote extra time and effort to coming up with alternate ID schemes for schools.
Read the EFF's Fair Use FAQ
You seem to think that your personal information is your personal property. It is not. Your Social Security Number is not your property. It is a number the government uses to identify you. Your name is not your property. It is an identifier your parents gave you in order for society to identify you. Et cetera. Those things should be kept private from people who have no business with you, however they are not property and should not be compared to property.
My other first post is car post.
"Your house is not secure. I can prove it to you. All I need is a rock or baseball bat and I can show you that I can get inside." Yay! Now I won't get arrested! - just because it's tech doesn't mean that the laws don't apply
As much as this shows up in the news, you'd think people would learn. In PA right now, there's a guy in the education department who wants to record all of your grades (per subject, per year), as well as statistics on your home life and any disciplinary problems. This will then follow you around for as long as your in school, not just highschool. The supposed purpose is allowing the teacher to bring up everything about you so they can better accomodate you. I can't imagine if all that information were to get into the open.
I sent this to District 86 in Chicago:
Dear Superintendent Miller,
I am sure you have been receiving a barrage of e-mails recently, so I'll make this short.
Recently I read about two of your students attending Hinsdale Central High School breaching network security and the stealing Social Security Numbers for students and staff. While I do not believe that stealing the SSNs was appropriate, I do not support the way your administration has handled the situation.
A communal perspective needs to be taken when looking at the actions of those two students. Often drastic measures, both vulgar and offensive to those in charge, has to be taken. At this moment the citizens of Arizona are spitting in the face of the government by protecting their on boarders. This is not very different from what these two students did at HCHS. While they did break the law by cracking though security, they were trying to protect the student body (including themselves) and the staff by alerting the school of its flaws. Lets say someone was to break into their bank and steal their safety deposit box, and then handed it back to the bank manager the next day. An conceited bank manager wouldn't be able to see the good in what this man had done and would call the cops. However, an intelligent bank manager would hire this man.
Also, I am well acquainted with system admins in school districts. A close friend of mine has been one of the head network admins for the Boston Public Schools for almost 15 years. While he works with gifted students to patch holes in security, many of the other admins disregard student warnings. They let their titles, status, and education get in the way of common sense.
Punishing these students is just another way that red tape and policy is destroying ingenuity in America. Strictly disciplining these students will only perpetuate the notion that students in America should strive for mediocrity and that being bold and initiating change should be shunned.
- Xxx Xxxxxxxxx-Xxxxxxx
"Man, I am so unbelievably stupid."
Once about 6 years ago we had a similar situation involving an Ethernet splitter. Any ports that had a splitter on them had to have their settings changed because of a potential problem.
This port wasn't set up right, someone borrowed a splitter, then their contract was up so they tried to be "helpful" when packing up and plugged both ends of the cable into the splitter, then plugged it into the wall to "keep track of it." Apparently something in the switch didn't like what it saw, there was a huge problem with the spanning tree, and blamo - all the switches on the backbone had to be reset manually.
I could see how plugging one cable into two ports could cause similar (or even worse) confusion if such a bug existed.
This was an older Cisco switch, probably 55xx series, running CatOS. The problem that caused it is fixed by now, I'm sure, but the parent poster didn't say how long ago their failure was.
Unless of course Beavis & Butthead here actually strapped some M-80s to there b0x, lit the match, and tossed it off the edge of Niagra Falls while shooting at it with sport rifles. Then "destroyed" would have been appropriate.
Authority questions you. Return the favor.
The truth is the lazy, idle and incompetent always prefer the cover up to the fix. Whether it is the Roman Catholic church and child abuse, torture at Guantanamo Bay, or security holes, the people in charge will conceal rather than cure. Two examples from my own career:
I was once asked to investigate the apparent failure of an automated component test system. Eventually a review of the hardware and software left the only option as being that the production personnel were deliberately falsifying results and passing rejected batches. Result: three senior managers demanding I be sacked. Fortunately at this point we acquired a new CEO who had several clues. One manager was fired, one left of his own accord and the other was downgraded. But customer confidence had been eroded and the plant eventually had to be shut down. The second example was less exciting: a production director who resisted for years the introduction of statistical process control because it would make clear where systems were failing.
I'm sure many of us have similar examples. It is not in fact important what the motivation of the whistle blower is, we need to change the culture to one in which the response is "Fix it", not "shoot the messenger". With hindsight, we may one day conclude that the tradition of open bug fixing is FOSS is its greatest social legacy.
Panurge has posted for the last time. Thanks for the positive moderations.
i feared it would be nuclear attack submarines (also known as SSNs), now THAT would have been a news story :D
How many times have people broken into school databases only to be arrested!
Back when I was in school, we only broke into the school database to change our grades.
paintball
How would they know that they could break into the system if they hadn't already? (I'm sure the 'IT' staff are bound to think that way.) So calling the 'IT' staff for a "controlled" demonstration wouldn't work either. So the (twisted) moral seems to be: The best way out of trouble is never to get caught (either by never attempting it, or doing it without getting caught.) Techie or Non-Techie, announced or unannounced, someone breaking into a system always triggers fear in the keeper.
No Greater Friend, No Greater Enemy! (Lucius Cornelius Sulla)
Focusing on the kids is a load of bullshit anyway. What was the personal data doing on a server accessible from a home computer? It sounds to me like the school administration is trying to create a smoke screen for their gross or willful negligence.
If the personal data was on a Microsoft server AND it was connected to the Internet, then the school system is in for a world of hurt in the courts: Willful negligence.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Who Is Pamela Jones?
By Maureen O'Gara
Friday May 6, 2005 - A few weeks ago I went looking for the elusive harridan who supposedly writes the Groklaw blog about the SCO v IBM suit.
The now-famous opinion-shaping open source leader Pamela Jones, aka PJ, doesn't give conventional face-to-face interviews. Never has, near as anyone knows. All communication is virtual. Only one person in the world has ever claimed to have met her - in the pressroom at LinuxWorld in Boston complete with a Pamela Jones badge - and described her as a fortyish reddish-blonde who giggled a lot.
Oh yeah? Wonder what cold crème she uses.
Pamela Jones is a 61-year-old Jehovah's Witness who lives in a shabby genteel garden apartment in desperate need of an interior decorator on a heavily trafficked commercial road at 304 North Central Avenue in Hartsdale, New York. Hartsdale is in Westchester and Westchester is IBM territory.
See, even though Groklaw treats cell phones like they were Kleenex and changes its unpublished numbers regularly, one number it left with a journalist led to this flat and - wouldn't you know it but - some calls from there had been placed to the courts in Utah and to the Canopy Group so obviously this just isn't any Pamela Jones.
Pamela has lived in apartment 1A for 10 years at least, according to the super, who says he's watched people move in, have children, and the children marry and move away.
Now, this isn't your usual anonymous New York apartment. It's practically a self-contained village where the super goes for the old ladies' groceries when there's snow on the ground and people know each other's business.
But the super didn't know much about Pamela except that she had a computer, worked at home (maybe sometimes) for a lawyer, was "paranoid" - his word - and "sensitive to smells."
He remembered how he was cleaning paintbrushes one day and she came running down the stairs screaming "Fire."
She was also missing and had been for weeks.
Nobody there knew where she was.
She had up and disappeared one day, and the super was worried about her. He said her son had dropped by and he didn't know where she was, and that some strange man that "nobody knew," as the super described him, had tried to get into her apartment while she was gone - the Medeco lock she had had installed on her door - something nobody else in the complex seemed to feel a need for - was more expensive than the door. But, as it happened, the super said, she had just sent in her rent in an envelope postmarked Connecticut.
Like an episode out of "Where in the World is Carmen San Diego," the trail led to 10 Bittersweet Trail in Norwalk, Connecticut, 24 miles away. Sure enough, parked in the driveway was Pamela's car, just as the super had described it, a dark gray '90s Japanese number with a bunch of Jehovah Witness pamphlets tossed on the backseat.
The woman at the house, Barbara Sharnik, told a disjointed story. She didn't know Pamela, Pamela hated her, Pamela wasn't there, Pamela left her car there because it got bumped, Pamela left her car there because she left town, and so on.
Afterwards Barbara called the cops, and then the cops called the number we left with her and the cops said that she was Pamela's mother and that Pamela was on the run and had shacked up with her mother because she had gotten "threatening mail" weeks before and that she had just gotten spooked again because "people were getting hurt around [my] stories" and had lighted out for Canada.
Odd, the subject of my stories - or any stories - never came up during our brief interview. I was just looking for Pamela.
That left Pamela's son, Nicolas Richards, who, as it happens, had been in the software business in Manhattan until - why, my goodness - things seem to have come a cropper right around the time Groklaw came into existence.
Nick and his ma were apparently involved together in Medabiliti Inc, an ISV, because one Pamela Jones with a Westches
Who Is Pamela Jones?
By Maureen O'Gara
Friday May 6, 2005 - A few weeks ago I went looking for the elusive harridan who supposedly writes the Groklaw blog about the SCO v IBM suit.
The now-famous opinion-shaping open source leader Pamela Jones, aka PJ, doesn't give conventional face-to-face interviews. Never has, near as anyone knows. All communication is virtual. Only one person in the world has ever claimed to have met her - in the pressroom at LinuxWorld in Boston complete with a Pamela Jones badge - and described her as a fortyish reddish-blonde who giggled a lot.
Oh yeah? Wonder what cold crème she uses.
Pamela Jones is a 61-year-old Jehovah's Witness who lives in a shabby genteel garden apartment in desperate need of an interior decorator on a heavily trafficked commercial road at 304 North Central Avenue in Hartsdale, New York. Hartsdale is in Westchester and Westchester is IBM territory.
See, even though Groklaw treats cell phones like they were Kleenex and changes its unpublished numbers regularly, one number it left with a journalist led to this flat and - wouldn't you know it but - some calls from there had been placed to the courts in Utah and to the Canopy Group so obviously this just isn't any Pamela Jones.
Pamela has lived in apartment 1A for 10 years at least, according to the super, who says he's watched people move in, have children, and the children marry and move away.
Now, this isn't your usual anonymous New York apartment. It's practically a self-contained village where the super goes for the old ladies' groceries when there's snow on the ground and people know each other's business.
But the super didn't know much about Pamela except that she had a computer, worked at home (maybe sometimes) for a lawyer, was "paranoid" - his word - and "sensitive to smells."
He remembered how he was cleaning paintbrushes one day and she came running down the stairs screaming "Fire."
She was also missing and had been for weeks.
Nobody there knew where she was.
She had up and disappeared one day, and the super was worried about her. He said her son had dropped by and he didn't know where she was, and that some strange man that "nobody knew," as the super described him, had tried to get into her apartment while she was gone - the Medeco lock she had had installed on her door - something nobody else in the complex seemed to feel a need for - was more expensive than the door. But, as it happened, the super said, she had just sent in her rent in an envelope postmarked Connecticut.
Like an episode out of "Where in the World is Carmen San Diego," the trail led to 10 Bittersweet Trail in Norwalk, Connecticut, 24 miles away. Sure enough, parked in the driveway was Pamela's car, just as the super had described it, a dark gray '90s Japanese number with a bunch of Jehovah Witness pamphlets tossed on the backseat.
The woman at the house, Barbara Sharnik, told a disjointed story. She didn't know Pamela, Pamela hated her, Pamela wasn't there, Pamela left her car there because it got bumped, Pamela left her car there because she left town, and so on.
Afterwards Barbara called the cops, and then the cops called the number we left with her and the cops said that she was Pamela's mother and that Pamela was on the run and had shacked up with her mother because she had gotten "threatening mail" weeks before and that she had just gotten spooked again because "people were getting hurt around [my] stories" and had lighted out for Canada.
Odd, the subject of my stories - or any stories - never came up during our brief interview. I was just looking for Pamela.
That left Pamela's son, Nicolas Richards, who, as it happens, had been in the software business in Manhattan until - why, my goodness - things seem to have come a cropper right around the time Groklaw came into existence.
Nick and his ma were apparently involved together in Medabiliti Inc, an ISV, because one Pamela Jones with a Westches
"But officer, I just jacked my neighbor's car to prove how insecure his door locks were! I was going to return it!" Sorry, but it's very easy to do any number of illegal things you can rationalize away all you want, some even of which are victimless, but just because you can do something doesn't mean you should. It would be very easy for someone to pop my sliding glass door open and enter my home. It doesn't mean it should be legal, regardless of their intentions. I fail to see how electronic crime is any different.
I find a disturbing amount of geeks that seem to think if something is technicly feasable, they ought to be allowed to do it with no repercussions. The situation I generally like to pose is thus:
How would you fee if I broken in to your house, and went through your belongins? I mean 99.99% of people have crappy home security. Your locks are generally an easy point of entry. If you have a simple tumbler lock, that is nothing to pick. So how would you feel if I went and exposed your security weakness, and when I did I decided to go through everything you own, all your documents, everything on your computer, through all your drawers, etc, etc?
Now you'd find no one that would consider that acceptable. Confronted with that situation most people would at the very least call the police and possibly kill the intruder. However for some reason when it invloves breaking in to someone's computer, many on this site see no problem, that because there is a way in it's perfectly ok to barge in and so as you please.
..because I thought they meant one of these SSNs
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
Although I graduated several years ago, I don't doubt such a thing happened. Would you believe that they actually used your initials and the last 4 digits of your social security # as a hard-coded unchangeable password for all staff, faculty, and administrative accounts, assumable some with access to this stolen information? For the students, at least when I was there, the last 4 digits were substituted with the last 4 digits of your student ID. As you an imagine, this also was about as secure as the last 4 digits of your credit card number. Rumor has it that many years ago someone hacked the system and changed the principal's paycheck to 86 cents in resemblance of the school district #. Figures.
If they had plan, and a means to carry out said plan, then they should have gone to the media first.
Seriously. If these kids had cornered a reporter, made an argument for his/her involvement and brought along said reporter with the promises of an exclusive, their ass would be automatically covered. The presence of the media would have proved they were whistle blowers and not some renegade "vigilantes" that got caught in the act. Nothing could prove different once the film and commentaries went to air.
The moral is....Once you decide to show some self centered egotistical bastard which way the wind blows....bring a weathervane.
Be Safe! Sleep with a Marine. Semper Fi!
As for someone here saying that they should report to the system admins first before testing the security, of course they should, but it is not always easy, and we should not expect these high school students to think that much. If you stumble into a page where you can enter arbitrary SQL, surely it looks very wrong, but there is still a possibility that the admin had simply revoked any privileges of that test account, instead of removing the test page, when the system went into production, therefore before you do a "SELECT * FROM students" and see something wrong, you cannot be sure that a security hole exists.
If I were the schoolmaster, I think I will explain to the students that, I understand the crackers' intentions are good, but what they are doing is still causing more harm than good, so they will receive neither praise nor punishment for this time, but they should swear that the SSN data are destroyed, and such action is strictly prohibited from now on. As for the website, if the school do lack the expertise to fix it, the system admins should publicly admit that the system has serious security problems, ask the students not to do such cracking again, and they should welcome any student who can and is willing to work with them to fix the problem.
This is the stem of all security problems.
If you DO blow the whistle, unless you have some SERIOUS clout behind you, chances are most people aren't going to listen to you. (See: Microsoft).
If you DON'T blow the whistle, do nothing and have a vested interest in the company/school then you risk having your money/time lost due to SOMEONE ELSE taking advantage of a flaw you knew about.
If you DO blow the whistle and try to gather attention to it by TAKING ADVANTAGE of the exploit, you SERIOUSLY risk being arrested yourself. (White hackers, black hackers, its all the same in the eyes of the uneducated masses!)
Etc, etc, etc. The list of what you can do and how ineffective it will ultimately be goes on. You can't go public or they slam you for trying to ruin their reputation. You can't go directly to the people cause they ignore you. You can't 'white hacker' them cause they slam you anyway. You can't ask for advice on Slashdot cause Slashdot is a wide, niche audience and is largely ineffective due to city/state/nation/international law differences. Its damned if you do, damned if you don't, damned if you ask for help and damned if you do nothing about it.
I think THAT would be the right punishment. The original admin must revise any change proposed by the offending student. If any further cracking incident happens, the student doing the auditing takes the blame. Of course, if the incident happens because of a backdoor inserted deliberately by the auditor, the admin would be fired and I don't care how hard you punish the auditor.
Holy crap, you actually made a really good point. Several, actually.
"Motion to declare a writ of 'boys will be boys'.
ok, yeah, this isn't exactly anonymous but what the heck, who cares about one post among several thousand...
someone i umm...know...was asked to "transfer" from his school several few weeks before finishing after penetrating the school network, writing a report on it, submitting it to his principal, then being a little less than canny about it...
for some unfathomable reason *rolls eyes*, high school staff don't like being told that their IT security sucks, or that the consulting firm they hired in the 6 figures is staffed with incompetent inebriates who wouldn't know how to set up a network without the funky Wizard crutches offered by Windows 2000...
Or whose idea of security is to store all the critical admin passwords in cleartext in a .bat file, in the root folder of a world-readable server...
Oh well....they'll get their comeuppance when I make their microwaves spontaneously combust, their goldfish grow 3 eyes, and their televisions mysteriously lock on to a paytv adult channel...hehehe...
cya,
Victor
Those people all still have SSNs, right? Thus, they copied them, but they didn't steal them.
A lawsuit with no evidence is not going to get very far. How will you prove that information is not secured? You would have to test it by trying to break in, in order to prove your case. That is what the students should have done, then after they have the evidence, they should go to court.
Oh wait... that's what happened.
I'll probably be modded down for this...
+20 funny
Back in middle school, my 6th grade science teacher gave out weekly grade sheets (quite unusual) and posted grade updates in the back of her room. The thing was, so students couldn't compare grades, she used SSNs instead of names. So there was a list of 50-60 SSNs in the back of a science classroom, right out in the open. I always thought it was insecure, although it did force me to memorize my SSN, which was helpful.
Today, I think the whole school system has replaced using SSNs with using "NCWise" numbers, although in high school SSNs were/are only used as computer passwords (last five digits of your SSN was your password).
My school district does NOT use student SSN for anything at the school level. We use district assigned 6 digit ID numbers. And I actually HAVE had two times when a student came to me to show me a vulnerability in the way we were doing things. In both cases I thanked him and fixed the problem. Now... if this same student ever wanted me to trust him with something confidential and important, I would not do it. Why not? Because he has bypassed our security on two separate occasions. Doesn't matter why. He's proven that he'll break rules if he feels like it. If the temptation is big enough.
Music - www.richardmac.com
See, this is why schools (and all businesses/organizations) need to keep better care of student/employee personal information. These kids just did it to alert the admins of the problem. I, myself have been in the same situation where nobody will take you seriously unless you actually demonstrate the problem.
Randal Schwartz of Perl fame learned the hard way that doing something illegal to show the problems with a computer system still gets you into trouble.
Why are you letting these clowns ruin our country?
Right now I'm posting from my school. I attend a high school, in the states, and have about a C average. I'm the school systems worst nightmare. I don't really have much to lose, and the teachers are too dumb to catch me doing anything wrong anyways.
The schools security policy is a joke. There is one password that covers almost everything. (the password starts with a "cl" and rhymes with "bass") I can, just navigate to the right place on the network, type in the pass, and see information on any student in the school. Now, changing grades are a little more difficult. Luckily, the software that the school uses to maintain grades in on the school's internal server. So all I had to do was download it, install it, and go nuts. Oh, and using that beautifully thought through password, I have installed some keyloggers on some machines, and have plenty of teachers passwords (i.e. can change my grades, or anyone elses).
So, long story short, school security sucks. I'm much more of a linux guy, than a windows guy, and I was able to fly through the network in one class period... Somebody needs to teach these schools right.
Trust No One
Same difference.
Idiots. Book 'em. Dano.
-- Slashdot: When Public Access TV Says "No"
Big deal. Who cares? Anybody can get anybody else's SSN. I did this exact same thing in 1990 in high school, too. I then told all of the school bullies/assholes/jocks that if they so much as looked at me wrong, I'd also change all of their grades lower. From then on, high school was a breeze.
After exposing that the emperor has no pants, don't expect him to be grateful and not have you drawn and quartered.
10: PRINT "Everything old is new again."
20: GOTO 10
No they really should never be used for anything other than social security. As in how the law that creates social security says that it may only be used for social security. All other uses are actually supposed to be illegal. Then Congress had to go and screw up and let the IRS use it in 1961. However, in 1974, they made it illegal for any government agency to require you to disclose your SSN unless specifically mandated by statute.
So really, no college, bank, or most anything else is allowed to make you give them your SSN. If you decided to actually sue that school, you might even win; then maybe places would stop trying to force you to use that damned number.
It's quotes like these that make me afraid for oour future as a human race. "When we grow up and get our jobs, that's our life right there. They can access anything about us. It just screws us up for the rest of our lives," said Julianne Junus, student. And when I say that, I mean...
1) Wy does this deserve to be in the first 1/5th of the article, front and center? You know what, let's throw out any journalistic integrity for shock value... Oh wait, the news has been doing that for ten years.
2) On a closely related note, I don't know how old this kid is, but I just love how alarmist she is. "It just screws us up for the rest of our life." Why? did your social security account get pilfered? Anyway. I'm not going to go further down that path because everyone knows where that ends, but I just love how the most alarmist, non-sensical kid makes the top of the headline story.
Think of the Children!!!! Please!!!
The reporter in this story clearly does not have the razor sharp awarness of what causes people to panic, like say a CNN headline writer does. But sooner or later someone will realize that these kids that got caught/came forward, are the ONLY ones in that school you DON'T have to worry about. It's the other 30 or 40 that already hacked the system or better yet, are trying it right now.
Not the same.
Go look at your average gas station. Cameras, silent alarms, motion detectors, and sometimes even armed guards (only really seen this in Vegas), though you've got about a 50/50 chance of the cashier being armed in the first place, if not trained to memorize you and your weapon to identify you later.
There's a recognized threat there, and steps are taken to minimalize that threat.
Now go look at your average high school network. Run by librarians who have no idea what the hell they're doing, let alone how to do it. Not only is there no risk of physical harm (they weren't pwnzz0ring a hospital) and little risk of financial loss (they weren't haxx0r1ng a bank), but they say they had no intention of causing any real destruction, and they didn't. Your average robber/mugger is out to take your money and possibly kick your ass. These were bored, reckless kids.
Hey, maybe I misread you. Go ahead and explain to me how the fuck holding a gun to someone's face and demanding their money or their life is the same as what these kids did. Go ahead, I'll wait.
In Soviet Russia, students have teachers' social security numbers!
it should not be necessary to keep one's SSN any more secret than the account and routing numbers printed on personal checks.
A whole lot of people don't think of those two numbers as being at all different in terms of how secure they keep them. I know people who carry their SSN card in their blinkin' wallets.
"Fundamentalism" isn't about divine morality. It's about human authority.
I had a similar problem when I tied work and material schedules together at a large manufacturer and discovered that managers were intentionally fudging schedules when it was plainly obvious that certain material items would be very, very late. For six months they kept fighting my schedule reports until it was announced that the scheduling and meterial would be tied together in a new SAP ERP environment. Of course that caused a lot of other problems but my report paled in comparison to the accountability of a realtime scheduling program. As a side note, SAP was so painful it is still causing long ,even now. In a realtime system there is no real way to perform what-if analysis and it is difficult to move resources around rapidly without fear of a trainwreck.
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
Did anyone else read "SSN" and think the students had managed to steal a nuclear submarine, or was it just me?
You can't win Darth. If you mod me down, I shall become more powerful than you could possibly imagine
The bigger question is why does the school have the students SSN's anyway?
The law states the numbers are not to be used for identification, and that the only institutuions that can legally require them are your banker, broker, and employer.
These kids should know all too well by about 3rd grade that teachers are incapable of learning. These NEA worshiping zombies spew out what they are told to and nothing more.
If the kids try to think for themselves or do anything remotely defiant they call the cops. Kid gets bored and writes something mildly violent, call the cops and have the kids dumped in the psych ward.
Too many urban blacks move to your white town, goof off in school and threaten to pull down average test scores, hell why not, bring in the drug sniffing dogs, have weekly drug raids, and put in metal detectors.
If that fails you can launch an "at risk" program. Dump your undesirable dark skins in there until their parents get sick of it all and put their kids into a private school. And when the parents of the white kids start doing it go on the news and cry and whine about privatization eating away at your funding.
These kids are obviously pretty clueless. Activism of this sort was obsolete in the 70s. You want to make a point of something you need shrub style "shock and awe". Sell those numbers to illegal aliens, street thugs, druggies who need to launder money under someone elses name.
Maybe after 20-30 years of this happening every time some two-bit bureucrat collects SS#s and keeps them in some insecure stash they'll wise up. My bet is it won't really happen until it becomes a federal offense for SS# hoarding in an insecure database. After a few thousand of these paper pushers end up in Club Fed it just MIGHT send a tiny little signal to the other idiots to take these security issues seriously, or don't collect the numbers in the first place.
to the crime and also the criminals.
The thing about cybercrime is that it seems to provoke gross overreactions, which I'd speculate come from a sense of insecurity and vulnerability which in turn comes from ignorance about how to protect yourself.
The crime of these kids is akin to trespassing, and has the same kinds of motivations that, say, mucking around on the roof or finding ways into the building when it is supposed to be secure have (both of which I did when I was a teenager, and both of which were stupid and in some cases dangerous). As in that example, the ability to perform the trespass would be highly useful if they wanted to steal something, but clearly that wasn't their intent.
Arguably, they stole information, but information theft is somewhat different than theft of tangible properties. It can be both less serious (the owner is not deprived of the information) and more serious (the information can be reproduced indefinitely, causing serious and nearly irreprarable harm to the owner's privacy). However, there is no evidence at this time that the information was misued, either sold or employed in identity theft or anything like this. It's more a case of puerile trophy hunting.
What should happen is that a thorough investigation should take place with respect to whether the information was used or sold. If it was not, it should be treated as a trespass prank, and a relatively mild punishment administered through the school system should be used. It would be helpful if there were resources available to investigate information crimes, which the local authorities may not be competent to handle.
In any case, if no intent to harm the victims can be shown, we should take into account the age and maturity (lack thereof) of the perpetrators. Teenagers do not have the same cognitive capacity as adults to think through the consequences of their actions -- that part of their brain will still be developing for as much as another ten years. If they intended no harm, they may literally have been unable to see that there was anything wrong with a little information trespass.
If, by the way, you are a teenager and feel insulted by the above paragraph, look at it this way: you can look forward to being even smarter than you are today in a couple of years. Unfortunately, I can tell you from experience it doesn't feel that way.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
I do not know the cracker, but i know several students who do, and who knew exactly what he was up to. As usual, the media spin is different than the true story. He did not do this to steal SSN's. He did it more for Ferris Bueller type antics. I would assume there was some grade changing, but here is what i know for certain:
When a student needs to be excused from a class or a day, and a parent calls administration, the request is recorded electronically so all other faculty can see if it is allowed or not. I heard he was adding requests so that his friends would be able to ditch and it would appear to the faculty that there was a legit reason (the faculty would check the electronic records, the permission would be there, they would assume another faculty member took and granted the request.)
the second thing i know for sure is that he set up a separate web site with all the students pictures and student id #'s on it (which he got from the school's systems), then created his own version of yearbook superlatives (girl you would most likely beer-goggle with, guy most likely to hook up with another dude, etc.) and other students would vote. don't know this for certain, but that's probably what got him busted. I heard the site got quite popular- half the class logged in at night.
anyway... that's what i know. I haven't RTFA so it may say this, but the kid was expelled (my friend said the student didn't show up for a few days, then the news vans and helicoptors were there). And he had been accepted to college, ready to go in the fall- doubtful they will take him now without his HS diploma and this on his record. Maybe he has some tech skill, maybe he's a kiddie, but in my opinion he's still a dumbass. Don't crack, hack.
.. with less risk would be to send a formal letter to someone high up that you believe that the information held on that server to be insecure, and ask that it be secured or your information be promptly removed. Offer to demonstrate how the information is insecure, maybe, but point out that since you have informed them of the possibility of an intrusion you will consider sueing (?) if *your* information is stolen. That will get their attention!
*--BigMan--- Time flies like an arrow.. but personally I prefer a nice glass of wine!
Hopefully these kids (and those who are following this story) will learn the following lesson:
Take, for example, the US's Airport "security." That system is a complete joke. I mean, it is not even funny how easy it is to sneak things past the "guards." If you try to point out where the flaws are, they will arrest you.
Remember, their goal is not to provide security, but rather the illusion of security. The unwashed masses need the government to "do something" so they can go on about their little lives without fear. It doesn't matter if that "something" works or not, or how much money is wasted.
Yeah, right.
Herr Bush teaches that you must obey, and be a good Christian. Only a evil, child-eating, athiest moslem fanatics criticize our glorious leader, or disobey any of our Great Inspired God-given laws. We must hang these terrorists.
Also we must fix the nasty annoying Constitution, because it hinders the Fuhrer's attempts to save us from the evil child-eating terrorists.
Think of the children!
"Fear is the mind killer..." -- Frank Herbert
Cut one leg of a tripod and it leans over. Cut a second and the tripod is seriously compromised. (Yes, I know, cut the third and just make it shorter to compensate, but then the whole thing is diminished).
In the context of "mind/body/spirit", our society is deep in the throes of fear, just like much of civilization has been in history. Much of our social norms are based on fear. While fear is necessary, too much is "toxic" and abusive. Yet we think it's acceptable and normal (eg. Simon from American Idol).
I know that this next bit sounds like General Ripper's "precious bodily fluids" from Dr. Strangelove, but hear me out.
Our bodies get compromised from the unhealthy diets in our society (McDonalds, sulfites, yeast, sugar, etc...). That's the second leg of the stool. Our spirit is left with the burden of holding up the load. It's no wonder to me that so many people have a hard time finding balance in life.
This isn't to place blame on anyone at all, even though I subscribe to conspiracy theories at times. I am trying to say that we, as people in (American) society, have a very subtle burden of maintaining balance, let alone grow, in any of these ways (mind/body/spirit).
Am I surprised at the spiritual emptiness of our society/world? I know it takes a lot of time and energy to maintain myself and I don't do a good job of it. It takes time and effort to avoid fast or processed food, schedule in exercise every day, be productive the way we need to be (work/school), and it takes time and energy to be spiritual in whatever form a person practices.
I keep this in mind when I at work or on the highway, for example, and someone acts unreasonably. I imagine that they are having as hard a time, if not moreso, than I am at living life. That helps me maintain a positive attitude as a basis for affecting my world.
Anyway, I know I'm taking this off on a serious tangent, but this parent post just scrapes the proverbial "tip of the iceberg" of what I think are our deepest social ailments. Don't shoot the messenger.
my friend hacked our school system's main computers just to see if it could be done. We were the techies for our school and ran the local network, but he wanted to see what the district computers were like. Unfortunately, he (stupidly) left calling cards throughout the system, so he called me the next morning when I got in to ask if I'd call the head computer guy for the district and explain why they had so many security flags :-P lol
The guy called my friend to tell him that they had fixed the security holes and would he please try and hack it again to find out? This went on for several months until we graduated.
They did not arrest him, in fact, they offered him a very low-paying job with the city!
I can get SSN's, disciplinary reports, grades, personal information, etc. all through an UNPASSWORDED share on a school computer listed as ATTENDANCE. (the files can be opened in any text editor) I've already told tech guy, and he doesn't seem interested in fixing the problem. I even told him a few months ago. I know I should do something, but how should I go about doing it? I fear some school officials might overreact.
Yeah...because we really have a choice about whether we go to high school...
How did the social security numbers of some students end up on a school computer to begin with? Schools are not supposed to ask or collect social security numbers from any student. In case a school does it would be stupid of anyone to give them his/her social security number instead of simply refusing and educating that school about the legal situation as well as the multitude of risks.
Right, because the authorities would totally not blow them off or anything.
And we can be sure of that because they went to the authorities first and...oh, wait, they didn't.
Let's not bullshit here...they weren't performing a general pen test...they were trying to crack the system and got CAUGHT. This exposes their defense as a lie. Nice try, fellas!
I have no doubt that the majority of slashdotters, if given school admin jobs, would have more sympathy for the hackers than the current crop of sysadmins. How would you implement the value system that the parent described us as holding to? How would you organise things if you were in charge so that a) students could learn advanced computer use within the system, b) accountability could be imposed on students and c) normal use would not be impaired?
The best way I can think of is a three-tier approach. Tier one is a set of stand-alone computers that anyone can use regardless of whether they're an evil brat or not. No connection to any other computers and no internet connection, so damage done from playing silly buggers would be minimised. These computers would be monitored to the maximum extent physically and legally possible.
Tier two would be most of the computers in the school - standard desktops, connected to the internet via a firewall etc etc. Anyone playing silly buggers on these would get kicked off and only allowed to use the stand-alone machines (with the result that they'd have to transfer any files via floppy disks and so on). These computers would be monitored to make sure no-one was playing major silly buggers and no viruses were present etc, but would be mostly left alone.
Tier three would be a stand-alone network, with a variety of computers running a variety of different operating systems. Anyone with an interest in computers could come and try stuff out here, and anything would go, with the caveat that, if you break it, you have to fix it. Little or no monitoring required, since any damage done would be localised to this separate network, and silly buggers could thus be permitted to reign unchecked.
The advantages of this system would be that a) you'd have a place for all the teenage hackers to work off their hormones, b) you'd have a disciplinary system (play silly buggers on tier 2 and you get dropped to tier 1) and c) you'd have a cadre of well-trained young security experts who you could supervise in auditing the tier 2 network.
Does anyone have suggestions for improvements or see any problems with this (apart from cost)?
For the love of God, please learn to spell "ridiculous"!!!
Now your SSN is your life for the most part.
Yes, this is true--though only to a certain extent--but your following argument is quite overstated:
If somsone has your number, they dont even need to know anything else to screw you over. With the number they can do searches and find your name and current residance. With that info they can sign up for credit cards in your name and screw over your credit.
If this were true, nobody would ever bother to steal a "list of SSNs" from a database! They would just randomly choose any 9-digit number. The security (or lack thereof) is in the linkage between the SSN and a person.
They can basicly steal your identity just by knowing that one special number.
Again, this an oversimplification. They still need to know whom that SSN represents. A reverse-lookup, if it existed, would imply that lists of SSNs wouldn't need to be stolen in the first place. Of course the kids in TFA most likely obtained more than just a list of raw 9-digit numbers; they probably also got the linkages between the SSNs and their owners.
(When I hand out "more information" postcards for my alma mater, I black out the space that asks for the kids' SSNs.)
Those of you in the U$A and out of school may want to print and carry the piece of 5 USC 552a beginning at the words DISCLOSURE OF SOCIAL SECURITY NUMBER when they next go to renew their driver's license.
"But all your emitter and collector are belong to me!"
Haven't people learned, by now, that even if you have the best intentions at heart - doing this things will result in you getting in trouble. If you really want to test the security of an organization, get their upper management authorization (hell you could even make a profit).
If they were smart about it (and they have to be somewhat smart to do this) they could have spoken to their principal/advisor and gotten sanctions to do this - potentially earning some kind of HS credit or an award from the the school.
I mod down so you can mod up. Your welcome.
Maybe it's different elsewhere... but back in the day my school IT staff were pretty reasonable. I remember that we had a fair bit of fun hacking other students accounts until the prof got annoyed, at which point we showed him the holes and he plugged 'em.
Nowadays, I am one of the school IT staff. If a student were to show me a flaw in the system I'd be quite happy to address and fix it... no suspensions etc. If a student were to exploit a hole in the system and then bring it to my attention... well that's a different story. I've had quite a few students claim "3l33t h4x0r 5ki11z" and the ability to crack the network, most are just running brute-force programs and never actually get anywhere anyhow...
If it were the students' information on their own computers getting stolen, it would be much like someone breaking into their homes and stealing their things.
However, the school is holding the students' personal information, and not securing it properly. This requires a different analogy, and if one is required, it would be more like going into a restaurant, handing over your credit card, and the staff then allowing anyone who drives by to take a copy of your credit card number and signature.
If the school requires that the students' personal information be stored indefinitely, they should also be required to excercise reasonable care in protecting it from theft. Otherwise, the school should be held fully liable for whatever damage is caused by the theft of the information, much like a restaurant would be peanalized severely for handing out customer credit cards freely.
Since when did a high school become an employer of its students? I want someone to find out why the school had the kids' SSNs in the first place.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
I've been trying to explain to the feds for months now that the SS#'s and personal info that I stole and subsequently used to open credit card accounts, buy cars and hit the roulette wheel was simply my way to show how easy it was go obtain that information and use it in a negative way.
BTW. Be careful. Not all supa-dope-hot escorts in Vegas are what they seem! She WAS hot for a cop though.
Karma means nothing to me, so suck it...
That network was asking for it. Wearing those skimpy security protocols. I couldn't help myself.
Yes, my only tool is a hammer. And you're starting to look like a nail.
I went to Hinsdale south (in darien)A long time ago, I remember A guy Rob E., who changed all the teacher,etc.staff's pay check to one cent. Yup 1 penny.no kidding they had a main frame neer hinsdale central that the schools time shared.After that the schools went with apples, instead of the terminals.Back on topic I generly agree that you may need to demonstrate a weekness to get motivation for a fix. Providing that no harm is done and every thing is documented. been up all nite tired later:)
Comitting a crime just to prove it can be done, is still a crime. Would it be the same thing if they robbed a bank to prove it could be done, "But they didn't spend the money". Is that OK, too?
I read all these posts about how they're "brilliant" and "harmless".
1.) You think they're brilliant for "hacking" the system? Have you seen how bad computer security is these days? Their hack probably involved reading a password off a sticky note on some teacher's machine.
2.) Harmless? In today's world, stealing someone's SSN is worse than stealing their TV, car, sandwich, and wife. A person's SSN is mind-boggingly valuable, these days.
Fuck 'em, punish them. They're not the victims and they need to take responsibility for their crimes. Yes, crimes. They committed a criminal act.
Gone are the harmless days of my youth re-enacting war games on my high school's VAX.
It makes me cringe and wonder why the fuck we're still using something as simple as a 9 digit number to control such huge portions of our lives.
Did anyone else read the title and think some studends stole some nuclear missles?
...that you should never demonstrate computer skills above and beyond that of a high school's staff.
Please note that I'm not saying what the students did wasn't wrong. I believe that the idea behind it, i.e. showing the security flaws in the system, was a good one, but they didn't have to go after the flaws in an illegal fashion. However, not only the students deserve a reprimand here -- what were the SSN's doing on an internet-accessible database in the first place?
Students who demonstrate intelligence beyond their years or insight into problems which the teacher cannot comprehend are VERY threatening to the teacher.
I've found this to be especially true in the realm of computers. If a student is extremely good at, say, math or English or biology, the teachers will often look at the student as a prodigy, although they may suspect the student of cheating in some way if they seem to do so well entirely without effort.
However, when it comes to computers, most teachers and staff at the elementary and high school levels only have the bare minumum knowledge required to turn on their computer and run the applications they have to use in order to keep their jobs. Don't blame the teachers, most of them had the computer age dumped on them with little to no training. But because most records are kept on computers these days, students who are extremely proficient with computers are the equivalent of students who could pick filing cabinet locks and alter their grades thirty years ago. The problem is, thirty years ago, if you learned how to pick locks and forge grades, you probably were doing it for "nefarious purposes." These days, computers aren't just a tool for "nefarious purposes," they are a tool that is used every single day by many students and they are a part of everyday life. But many teachers can only see a student who is good with computers as someone who carries a set of lock picks to school.
Case in point:
My little brother, who was the darling of my high school's (rather meager) computer department, happened to be in the library when another student hacked into the school's database through a terminal in the library. The other student was not known to the staff as being a computer geek, so the blame fell on my brother. But the staff of the school (with the exception of the computer teachers, who for some reason were not consulted on the matter) were not proficient enough with computers to prove who had actually broken the school rules. Based only on the fact that my brother was known to be good with computers, the staff then banned my brother from the school library for the rest of his high school career with no proof that he had done anything wrong. First of all, how is this helping him learn? Secondly, because the school staff did not understand enough about computers, my brother was banned only from the library, not from the school network, nor was his school network ID taken away. He proceeded to graduate from high school after taking every single computer class offered by the school (which were taught on computers that were on the same network as the library) and then to spend two semesters as a teaching assistant, teaching other students the same skills that got him banned in the first place.
The moral of the story is: with the possible exception of the computer teachers, never let elementary/high school teachers and/or staff know that you, as a student, are proficient with computers.
well it was still an illegal act. what if they had bought drugs on campus to demonstrate that it was possible and then turned around and gave the drugs to the police or administration? It's still illegal. They say they destroyed the SSNs/gave back all the weed, but who really knows. What if they sell the HD the numbers were stolen from and someone recovers them?
They could have done a little to cover their butts, like notifing a teacher ( anonymously ) about the intended act so there was foreknowledge they meant nothing about it, or even going to the principle and telling him the system was insecure and that they'd like to prove it.
"Not knowing when the dawn will come, I open every door." - Emily Dickinson
You could always uses this handy Social Security Number generator when someone who has no good reason to have your Social Security Number, like a school for example, asks for it.
http://kearney.servehttp.com/test/newssn.php
You are changing the subject. Attacking the person's spelling (trying to impugn his intelligence) instead of logically countering his arguments is a great way to earn emotional points with the crowd, but whether the poster is good at spelling (or typing, for that matter) has nothing to do with his argument over how to get along with teachers and classmates.
And let met tentatively agree with that poster. I had the same problems with my teachers and classmates until I learned that school was not about gaining knowledge and wisdom, but about social conditioning. As in the rest of the Real World, human beings who rely too heavily on style over substance can be easily manipulated in ways that can benefit the manipulator. That it took me until after college to realize this is perhaps testament to the fact that I have a sometimes abrasive, sometimes attention-seeking personality and am only 1 standard deviation above the norm on the IQ scale. (Now, where is my tongue? Oh yes, there it is, firmly planted in my cheek.)
I'm proud of my Northern Tibetian Heritage
On the other hand, I usually agree with "no harm, no foul." These are kids we're talking about, not malicious computer hackers. I don't see the need to press criminal charges since nothing was done with the social security numbers. Though I think they should be reprimanded by the school appropriately. They need to know they can't go around breaking into people's systems just to prove a point.
I like my women how I like my sugar.. granulated.
As a Hinsdale Central student I would point to the teachers as being the biggest flaw in the schools security scheme. From what I know the students merely store one of their teacher's login and password. Through this they were able to change grades and view student SSNs. They could even access the school network from home through Novell NetStorage. It is not the software that is the weak link, but the human element.
So a handful of SSNs brings about possible criminal charges while corporate criminal negligence compromises hundreds of thousands and is somewhat swept under the media-rug.
These kids raise the warning flag once again: more and more databases contain unnecessary private info and the people working day to day don't have a clue beyond point and click and field entries.
Here is an article my friend wrote regarding SSNs and the magstripe ID cards most colleges use.
http://privacyumd.blogspot.com/
On Discovery channel they have a show called "It Takes A Thief" whose point it is to show people how vulnerable their houses are.
The difference is the 'victims' agree to all this.
The school did not.
I'm amazed we're still debating this and claiming its the only/best/useful way to make security better.
Individuals guessing that so and so might not have listened to a technical alert therefore you have to hijack passwords w/o permission is a risky guess. If you didn't try Plan A then you have no real reason to go to illegal Plan B.
Imagine someone picked your pocket to show you how insecure your back pocket was, copied all your credit cards and medical info and license, then gave you back your wallet and swore they'd destroyed the copies.
What would you do?
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
What he should have done is taken a screenshot of the admin's information, then emailed that anonymously to the admin.
Just use a yahoo email and send on the school library's computers. Include notes on what to do to fix it.
The key is: Don't let them know who you are. That protects you, and scares the admins even more.
Hiding your identity on the internet is about as easy as finding p0rn on it.
"That's so plausible, I can't believe it!" - Leela
People, don't be naive and believe that doing things like this at your school, no matter the motive, will be appreciated. Whenever you "lend a hand" or insist that you were "only trying to help" you always get burned. Let the school deal with their own security problems and tend to your education. Its not worth the trouble, trying to help others that don't want your help anyway.
That situation is different since the very nature of NIS/YP is that it is publishing information. It might be a violation of policy to set up your own client, but it doesn't involving doing anything on the server other than using a service in the usual manner. If you're outside of the jurisdiction of that policy, e.g., due to an absent or misconfigured firewall, it can't be a violation of policy.
An analogy would be comparing somebody walking down the street seeing something in plain sight on a patio vs. entering the house (through an unlocked door) and snooping in the desk.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
Normally I would give the same "make sure you have a contract" speech I've seen in other threads. But that's because I assume my audience is over 18. These KIDS will possibly get into trouble with their school but the criminal charges are total BS. Now when they graduate they should have some nice lucrative jobs lined up. :-o
BTW since school is a government resource isn't this a terrorist action?
If we absolutely have to use the hacker-evil-like-burglar analogy, in this case it's more like the school IT staff had the responsibility for storing their personal belongings. They forgot to put a lock on it, and the students took one item from each person there, and returned it promptly to the school to show that their items (as those of the others) weren't particularly well protected.
This was an idiotic act, but high school kids are generally idiots in any number of dimensions that they don't realize yet. Now nobody can be certain that a copy of their information isn't circulating somewhere, or kept for future malice.
However, this ill effect doesn't excuse the school neglecting its duties towards its students.
There is no dichotomy; both are at fault, but their offenses are different. One group is guilty of poor data security, but they themselves have not committed any crime; you can sue them for negligence, but that's probably as far as it gets. The other group, however, committed an actual crime.
Being in high school myself, I have also stolen SSN #s and given them back, mainly to convince other students to be more careful. All of the information needed to steal an identity is printed on a 4x6" card, which most students tape into the front of their notebooks. I'm somewhat surprised by the lack of care, but at the same time, I'm not. By an odd coincidence, I'm also the only student tech, and I've found all sorts of lovely information on the servers accessibly to anyone. Identities waiting to be stolen :S
HS Students Steal SSNs to Prove They Can
:D
What? Some students stole a submarine?!
Local news in Chicago is reporting about two Hinsdale Central High School students who breached their school's computer system and retrieved all of their peers' (plus staff's) Social Security Numbers.
Social Security Numbers... How lame.
You can not compare hacking into a school network to expose its security flaws to breaking into a persons house to prove they can. It's just not a good analogy.
A person can foritfy their house as much or as little as they would like, because it's their own personal property in which they voluntarily live
But why shouldn't a student be able to protect his/her valuable information, such as a SSN? At school, a student has no choice in the matter of whether or not they give up their personal information. If I'm forced to give up my SSN, I want to know that it's protected, at least.
The students shouldn't be punished for protecting their own SSN's, as well as the SSN's of their peers.
It certainly made it easier for Charlie Brown to find out the telephone number of that red haired girl that he always admired.
Simply go down to your Register of Deeds office. Countless documents that are public record and available to anyone with a quarter have Social Security Numbers on them. The only restrictions are birth certificates, military discharges, and death certificates, which are available only to the immmediate family of the individual. And since a fake ID template can be downloaded from Kazaa, you've spent less time ripping off someone's identity than cooking dinner.
Deeds offices are becoming more cognizant of it, but in so many states with millions of documents already on record (and so many of which are available over the net), most of the states don't even have laws to redact SSNs, though legislation is pending in some states, and people don't know enough to understand that the SSN is never required (nor do the banks, lawyers, etc., it seems).
Check your mortgages and deeds of trust.
eating pussy
Something all the pro-hackers on here seem to be forgetting is they broke the law, plain and simple. Breaking into a network and stealing information, regardless of the intentions, is illegal and you will be punished. People who justify their illegal activity by stating that it's someone elses fault because the information wasn't secured properly are complete morons. Believe me, an argument that idiotic doesn't stand up in court.
And by the way, a reality check for the idealists. For every one person who breaks into a network, steals information and then gets paid by the company they broke into, 1000 others get thrown in jail for it. Feel lucky?
" "This is a growing problem in the United States and to actually experience that it is going on at the high school level, really makes you concerned," said Curt Stennis, parent."
Yes, its called hiring a qualified System Admin. Period. I cannot tell you how many 1/2 ass'd admins that I see working day to day strutting their stuff when their heads are in their ass'.
I will say, with a head in the ass and struting make an interesting site. Period.
Dangit Erabus, the e-mail address you listed on /. is out of commission, and I don't remember your work e-mail. This is Cerebus, and I'd love to toss you a message. Contact me at Brian.Orlick@gmail.com if you could, please. Thanks.
You like splinters in your crotch? -Jon Caldara
Even if you're a whitehat, there is a fine line between testing security, and breaching security.
That fine line is called "getting permission".
What the students did was just as stupid as the virus writers who think they're helping us out by sending out viruses that disable and patch for other viruses (with the added effect of Denial of Service).
Antisource - antivirus, antispam, antispyware
From a Paul Graham essay:
Suppose in the future there is a movement to ban the color yellow. Proposals to paint anything yellow are denounced as "yellowist", as is anyone suspected of liking the color. People who like orange are tolerated but viewed with suspicion. Suppose you realize there is nothing wrong with yellow. If you go around saying this, you'll be denounced as a yellowist too, and you'll find yourself having a lot of arguments with anti-yellowists. If your aim in life is to rehabilitate the color yellow, that may be what you want. But if you're mostly interested in other questions, being labelled as a yellowist will just be a distraction.
---
Pick your fights more wisely... it's obviously that the more you know, the more you realize there is left to learn. Wasting time explaining those that know even less than you that they don't know much may be easier than going out and trying to learn even more yourself, but doing so amounts to nothing but laziness.
Our society has systems of education not to inspire the Einsteins, but to educate the masses (how well it does that is a different topic).
Probably somewhat less than the value of a good book on zen buddhism. For the record I don't have a social security number because I don't live in America.
How do you kill that which has no life?
Of course, the best course of action is to do both. If you want something to be really, really secure that is.
When I forget and leave the garbage bag on the floor instead of taking it out to the dump, and she shreds it into millions of fouling smelling pieces, I don't beat my dog. I take note and try to remember not to be so vulnerable.
Huh?
The Chicago Public School is completely backwards, and I'm saying this from personal experience. It's ridiculous how much they allow and limit on their servers. As long as the admins like the computer team, they can do whatever the hell they want, including running personal game servers and bringing in their own equipment. Most of the computer team executed DoS attacks just for fun. I'm suprised that this made national news, personally. God, CPS is so backwards.
It looked like a couple of highschool kids stole a SSN (Silent Service Nuclear) submarine just because they could.. was worried for a second
They knew the necessary people to just walk in the front door. They could have known absolutely nothing about computers and walked right in. A great deal of people, including students at that particular school, have easy access to this information. All they needed was the proper password to get in, which was essentially handed to them.
...that's a true story. Some tests say I'm a genius, others than I'm quite average. Real life reflects neither.
Got time? Spend some of it coding or testing