Slashdot Mirror
Alaskan Middle Schoolers Phish Their Teachers
lukej writes "In Ketchikan, Alaska a small group of unidentified students gained access to school owned computers by using phishing techniques on their teachers. The then used the elevated access to remotely control their peers computers. Fortunately the school administrators seem to have a taken a realistic and pragmatic viewpoint of the situation, although no official punishment has yet been determined. '"Kids are being kids," (Principal) Robinson said, adding that he was surprised something like this had not already occurred. "They're going to try to do what they try to do. This time we found out about it."'" And no one got arrested.
There's hope for us yet!
Yet !!
The teachers should of been able to figure out this Phish. Any time a student can up a teacher it means the teachers need training, this is a great example of how teachers are starting to leg behind there students.
In related news, the students were found to have changed their grades and purchased airplane tickets.
In other news, the WOPR unit in NORAD is reported to be acting funny. It keeps asking to play games.
I didn't get headlines when I did the same thing in elementary school. Radical thought: This should be a part of standard curriculum.
They expel and charge kids with felonies for far less....
sig?
Is Alaska the only place where a sliver of freedom is still left in the US?
Me and my friends were doing the same sort of thing on the computer network (BBC Micro) 25 years ago.
We got detention if I remember correctly. It certainly didn't make the news. The fact that it does in 2013 maybe reflects how much society has changed between then and now.
Children shouldn't face any serious punishments for minor "cyber-crimes".
They were all non-black.
Aside from the temperature...
Apparently in Alaska you can pull a prank and it doesn't get turned into a life-altering jail sentence and you being labeled a terrorist. Alaska may be the last refuge of what being in the United States really used to be all about. Too bad the terrorists won in the lower 48.
If telephones are outlawed, then only outlaws will have telephones.
A sudden outbreak of common sense.
Fortunately the school administrators seem to have a taken a realistic and pragmatic viewpoint
The author is probably just joking. That is the worst thing they could do. By saying they're just kids, let's not punish them, they are clearly sending the signal: New kids are welcome to try this again.
It's sad because here we have a school administrator acting sensibly and not being all "no tolerance" and bullshit.
logic and reasoning in a schoolhouse, what ever is this nation coming to? this must be stopped!
if this is supposed to be a new economy, how come they still want my old fashioned money?
Yeah. I probably have nothing to add idea-wise to this story. Just had to chime in that I share this emotion.
What a relief to know that there are non-draconian administrators that can actually administer justice with grace instead of an iron fist.
We should learn what we need to know about issues, before we decide what we need to feel about them.
since there are only 3 children on Ketchikan
Reading in between the lines I suspect it could have looked wildly different, but the teachers were trained to look for some specific text string which the students got to appear in the elevation dialog.
The UAC dialog is designed to look different if a executable is digitally signed to prevent just this sort of phishing attack. Either the school IT screwed up by not using signed tools, or the teachers were not trained on the differences between the dialogs for signed and unsigned elevations.
Made a fake UI for the BBC Micro model B in 1988, got the password for *i am syst, oh yes, that got me a 6mth ban from school computer club.
/clap /clap /clap
It's nice to learn that someone looked at curiosity in a common sense fashion rather than the typical spank-down people get for being smart enough to figure things our for themselves.
Life takes interesting turns, but the most interest is when you're off the beaten path.
If you're not using social engineering to get elevated privileges in your middle/high school's computer network, you're not really a computer geek. Of course, we never got caught (although I'm certain that my high school "computer class" teacher was perfectly aware and just didn't care or even approved as long as we didn't actually fuck up the network).
Lol, we did this too in high school. Mostly so we could set up doom2 and lan play. With Novell netware, there was a peek utility where I could spy/control any students session. Had a lot of fun with that. Funny story: We had a final project in programming class to draw a picture with qbasic graphics commands. I wrote a program to just draw with the mouse, and it generated the circle, point, line, etc code. I gave it to my friend that struggled in the class. He made the most beautiful detailed picture for his end project. The teacher didn't believe that he made it. So he said "ok adam, go write a program right now to draw a simple circle". So I logged in on a machine and made the program and saved it to adam's directory. I forget how I signaled for him to load it, but he did and the teacher got off his back. Adam passed the class. Good times.
A chum in my science seminar class hacked into the principal's office phone, so we could listen to him from the classroom whenever we wanted. When it was close to graduation, he got bored and patched the phone line into the school public address speakers, so all day his calls were broadcast in every classroom (they figured it out and he stopped using his phone after an hour or so).
After lunch, the principal called our buddy up to the office. He asked him "Do you by any chance know something about this?" Our buddy said "Yep." Principal said, "Just go fix it and we won't ask any more questions, ok?" He did, and that was that, no call to his parents or anything.
Now in the early 1950s, when my DAD was in high school, they just led a cow upstairs and locked it in the bathroom (Cows can walk up stairs better than they walk down). It's pretty easy to imagine the same kids pulling the same kind of pranks with the technology of the day.
Gently reply
logic and reasoning in a schoolhouse, what ever is this nation coming to? this must be stopped!
Unfortunately, in a mad rush to show "we are serious about ..." school boards and administrators pass zero tolerance policies. As a result the stupid as well as they criminal get punished equally. Schools cannot apply common sense, as much as they may want to, because of the rules. Everyone gets all bothered by draconian punishment for a minor infraction but are unwilling to change rules because they don't want to be held accountable for making a decision that someone will second guess. That is not limited to schools, many lawmakers seem to share the same viewpoint (and then get all upset when something h clearly ridiculous happens as a result of a zero tolerence law THEY PASSED.)
I'm a consultant - I convert gibberish into cash-flow.
Why would Alaskan children possibly get in trouble for phishing? How else are they supposed to feed themselves when they become adults?
In Ketchikan, Alaska, a small group of unidentified students gained access to school-owned computers by using phishing techniques on their teachers. They then used the elevated access to remotely control their peers computers. Fortunately, the school administrators seem to have a taken a realistic and pragmatic viewpoint of the situation, although no official punishment has yet been determined. '"Kids are being kids", (Principal) Robinson said, adding that he was surprised something like this had not already occurred. "They're going to try to do what they try to do. This time we found out about it."
FTFY
Mentioned they haven't thought of how they will take action against the students? Article mentioned that the school had to collect the 300+ computers to be cleaned (and I'm guessing reimaged). I'd really love it if the school shows they were REALLY wise, and made the response action back an apology to both the teachers they phished along with the IT crew who are now goign to have to scan/clean the rigs. Further, make these kiddos come in on the weekend/after school to help on that scan/clean effort (BUT with a choice---N hours working with the IT dept to clean up the mess, or N*4 hours in standard "sit on your backside and do nothing detention). This way they see there is a tangible impact ("cripes...now I have to spend this time cleaning this mess up, when I'd rather be doing something else on a weekend/after school"), but at the same time in a way that they may actually learn something (working with IT), and in some cases perhaps spin their activities towards something more positive?
When I was in grade 4 at a CSAP school (French school board in Nova Scotia) I had guessed all of the teachers passwords. This is on novell netware mind you.
Grade 4 teacher: Quatre
Grade 5 teacher: Cinq
Principal: Directeur
Etc. Etc.
In Grade 10, I did everyones HTML assignments in Computer studies so that we could play Unreal Tournament. Was pretty fun lol.
I sold grades when I finally got in. Amazing how small changes over a long period of times results in a larger grade.
Send them home for a day to consider that they cost the school some money to fix the computer. Detention for a week... but thank you for not giving them a criminal record.
No, its good that it is. So when people talk about it, they realize this is how they SHOULD act. Not suspend the kids, and call in the feds because they phished a teachers password. Although, the teacher should be sent to some basic network security training. Because if the toolbar says http://lame.angelfire.com/ They shouldnt be stupid enough to enter their password.
Yes, but you don't even have a grasp of basic grammar. So you fail at having any say about this issue by your own "standards".
Your opinions and "facts" about teachers are idiotic. You know nothing about these issues so shut up and stop looking foolish.
Did this same kind of thing in high school. It was so easy to get into the network, though, it didn't take phishing. It just took hitting ctrl-c when the login screen came up. From there, you had full command-prompt access to the network. There was no changing grades or anything, we just had a lot of fun sending out fake network broadcasts for a few weeks, until the teachers figured it out. It was the same kind of thing, nobody got punished, it was all 'You've had your fun, but it's time to stop now.' And that was it.
"They were discovered when one teacher became suspicious during one phishing chat session.
Jose: Come on, show us your boobs, Mrs. Winklemeyer. I mean, WandaX. Crap."
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
At my college they had Intel GMA graphics so we hit ctrl-alt-arrow key to flip all the displays upside down. He thought it was pretty funny.
we did that 20 years ago. Spoofed a Novell login prompt. The first catch was the teacher with the admin rights :-)
But it wasn't that much fun anymore when we were officially granted access to the server a year later.
bickerdyke
A little early to determine whether or not sanity will prevail in the aftermath. The principal's statement indicates that the consequences are TBD.
Also, I thought that most of these computer "crimes" were based on federal laws. Would it be up to the school to decide whether or not to pursue criminal charges?
This is normal. School network admins assume kids are hacking the network.
and getmo has one more person it in
You pulled out the secretary's drawers? So was that your first time with an older woman?
I always heard phishing was best in Alaska...
My name is Antoine. This article brings back my school delinquent memories. I grew up in Ketchikan and went to Schoenbar Jr High ( the school in the article) in 1986. It is a small town but not that small. there are around 10,000 people in a relatively small area. at the time there were about 400 kids in the middle school and around 800 in the high school. I like that the school didn't take legal action. I am sure the kids will have consequences but most likely it will be dealt with by the school. I remember that I had some training grenades from an army surplus store that I kept in my locker. They were just an empty metal case that looked like a grenade. One time I rolled one down the hall for fun. I think I got detention for that. Imagine what would of happened now.
These career-criminals-in-the-making must be made to pay.
Requiem for the American Dream
Back when, at university we all had timeshare accounts on an Amdahl 470V/8. Now if you needed more account time (to play SPACWR probably) you could beg some from the TA's, but the best way was to get another users password, and use their account and their computer $ to play. The came the Valentines day dance. There was a guest list circulating with everyone's name plus the name of their date (so we could make fancy place cards or something). We scammed a copy of the list and headed for the terminal room. We already knew the login ID's because they were based on the person's first initial and last name. We ran the list of Id's against the list of girlfriends names from the dance. Bingo! About 40% of the guys had their girlfriends name as a password. With 100+ cracked accounts, we had unlimited gameplay for the rest of the year.
None of them can see the clouds; The polished wings don't care.
The "Kids are being kids" is the typical reaction when they have no idea who did it.
With nobody to blame and punish the best damage control they can do is to minimize the case in the hope to evade their responsability/negligence. Nothing to see here, move along.
Back in the day. Tried to install a key logger on a teachers computer and failed at that. Instead resorted to simple standing behind and watching them type there password in. Happily they used a super secure firstinitiallastname password scheme and that got us access to a large variety of teachers. Never changed a grade, but enjoyed the power of being able to... And that was 7th grade. It was never "hard"
Is it not computer intrusion? I ask you - is this not the same as intruding into your home and rummaging through your valuables and doing as they please? They are not terribly bright kids and I fear their ultimate failure in life will be to misunderstand the ethics of good honest hard work. What if it were a system to control of some key aspect of infrastructure - like a dam? Even worse.. what if they were Chinese? Lock them up and brainwash some sense into them. Criminal scum.
Ketchican -- a quaint drinking village with a phishing problem.
(Apologies to Homer, Alaska, the "quaint drinking village with a fishing problem.")
That that is is that that that that is not is not.
I did this in hs 4 years ago and I didn't get on slashdot..
You can't blame anyone for honing their phishing skills in Alaska. The winters are so cold and long. Teaching kids to phish early in life will be extremely beneficial in their days ahead..
I hope this was a long time ago... having worked in various SD's that tried to support Novell, things got ugly fairly quick.
That said, I remember students having fun with poorly-secured NN environments back in the day, mainly involving things like backdoors using right.exe to grant themselves permissions to others' files (and sometimes taking away others' permissions to their own files).
Wonder what was the exactbscam (or scams) to get past the teacher's guard.