Slashdot Mirror
Student Charged By FBI For Hacking His Grades More Than 90 times (sophos.com)
An anonymous reader shares a report: In college, you can use your time to study. Or then again, you could perhaps rely on the Hand of God. And when I say "Hand of God," what I really mean is "keylogger." Think of it like the "Nimble Fingers of God." "Hand of God" (that makes sense) and "pineapple" (???) are two of the nicknames allegedly used to refer to keyloggers used by a former University of Iowa wrestler and student who was arrested last week on federal computer-hacking charges in a high-tech cheating scheme. According to the New York Times, Trevor Graves, 22, is accused in an FBI affidavit of working with an unnamed accomplice to secretly plug keyloggers into university computers in classrooms and in labs. The FBI says keyloggers allowed Graves to record whatever his professors typed, including credentials to log into university grading and email systems. Court documents allege that Graves intercepted exams and test questions in advance and repeatedly changed grades on tests, quizzes and homework assignments. This went on for 21 months -- between March 2015 and December 2016. The scheme was discovered when a professor noticed that a number of Graves' grades had been changed without her authorization. She reported it to campus IT security officials.
At least he cares about grades. Most student athletes dont.
**Life is too short to be serious**
Not sure what he thought he would be doing with his life after graduating with a degree and knowing absolutely nothing about the subject matter.
He should change his major to "Hacking"; problem solved!
Table-ized A.I.
>> when I say "Hand of God," what I really mean is "keylogger." Think of it like the "Nimble Fingers of God." "Hand of God" (that makes sense)
Hey, um, "Nimble Fingers" is a dangerous thing to type into a search bar. And no one has used that phrase in a SFW setting since 1978.
>> and "pineapple" (???)
Prolly this: https://www.wifipineapple.com/
Why would he intercept exams and test questions if he could just change his grade directly anyway?
Seems like smart would have been to either obtain the quiz questions OR to change your grades only once every semester. Attacking both sides of the system makes way too much noise.
--
"What's up doc?!" - B. Bunny
He will be arrested and then hired by the FBI or someone else.
Why is USB device plug can read keyboard input without installation or authorization from the computer? Is plugin a mouse or keyboard really have the feedback of each key pressed? I know they need to know when caplock is on but what about all normal keys?".
Good thing I graduated when I did - in the bad old days. I once had to hack into a CS faculty member's account to enter a test grade she hadn't entered before she went on sabatical at the end of the Semester. Sadly, I guessed her password on the second try.
You plug the keyboard into the usb device which then plugs into the computer.
The computer isnt outputting things to the usb ports, the device is intercepting them. Considering that keyboard communication with the computer is not encrypted, the logger can record the plain text keyboard strokes.
Not sure what you're trying to say here. Looks like you're assuming that keypresses are broadcast to all USB devices, which is, of course, nonsese.
Your run of the mill hardware keylogger is a device that's between the computer and the keyboard. A "man in the middle" attack, only in hardware. There's no software installation, and no way for an OS to detect it.
https://en.wikipedia.org/wiki/...
Stick a keylogger where he wasn't supposed to. That's "hacking", says sophos.
I say that if this is the level to expect from ostensibly respected computer security companies, it's no wonder they fail to protect anything.
Anyway, why send in the FBI to deal with a student? So he's been naughty and now he'll be a criminal felon all his life, doomed to do more and more of this sticking keyloggers where he isn't supposed to, bereft of other skills?
The PC is notoriously poorly designed as if it were meant to be run disconnected from the internet and in a room hidden away from intruders.
It's Intel's and Microsoft's security design flaw that allows USB keyloggers to be attached in between the PC and the real keyboard. This is as stupid as the autorun feature for DVDs and USB sticks.
Use TFA. Here it is 2017. I'm running low on sympathy for those who get hacked because they didn't use TFA.
"Shoot, a fella could have a pretty good weekend in Vegas with all that stuff."
Why is USB device plug can read keyboard input without installation or authorization from the computer?
News for nerd: many, if not most, modern keyboards are USB. Plugging a device into the computer and then the keyboard into the device means it looks like a keyboard to the system and there is still only one on the system.
Is plugin a mouse or keyboard really have the feedback of each key pressed?
Yes, a keyboard knows what keys have been pressed. That's kinda the whole purpose of a keyboard.
That one is ridiculously expensive. Nice try sneaking in that affiliate link though.
Hey, let's get the exams and test questions in advance so I'll have a good score!
Fails.
Hey, let's enter the system and change my grades since I failed even when I had the exams and test questions in advance!
That guy's C.V. can be resumed in one sentence: Can't even cheat his way out by cheating. I'd never hire that guy in a million years.
#DeleteFacebook
He would have been far better off spending the time and energy to study and improve himself not only to do better in academia but concordantly in business. In the amount of time he spent hacking, he could have aced everything. Instead, he fails miserably, demonstrates his moral fibre, and shows that he will excel at nothing but politics.
Sad.
> The PC is notoriously poorly designed as if it were meant to be run disconnected from the internet and in a room hidden away from intruders.
Which, for those who don't know, is exactly the case. Prior PCs (PERSONAL computers) running DISK Operating System, there were time-sharing computers running NETWORK operating systems. Computers prior to the PC each had many users, hundreds of uses for each computer. They often used it over a network, using terminals. Security was of course important - you didn't want one authorized user to mess things up for another user.
Then technology advanced to the point that it was feasible fr a single person to have their own personal computer, with several KBs of RAM. What OS would run in just a few kilobytes of RAM, though? Just the security-related stuff was a couple KBs. But wait, a *personal* computer with only one user, running from local disk and not attached to a network didn't NEED security. So to fit the OS in 16KB, the smart thing to do was to make a minimal OS without any of that security or networking stuff. It worked great. Then the internet happened and the manufacturer of Disk Operating System shit bricks.
Haven't these guys heard about the Kobayashi Maru? Kirk cheated once, and he made Captain. This guy cheated 90 times, he's going to be President of the World!
What is this? War Games?
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
"Ferris has been absent 9 times"....."GRACE!"
Sent from my TARDIS
He has clearly demonstrated excellence in the IT field. Instead of arresting him, he should be issued a Bachelorâ(TM)s in Computer Science.
on the football / basketball team then no need to hack to your grades as the school will find away to make you pass.
"...no way for an OS to detect it."
It's not easy, but it can be done. The USB keyloggers present themselves over the USB bus as a keyboard, but not necessarily YOUR keyboard. They will have the same USB vendor/device ID across all of the devices. So look for that ID in place of your normal keyboard. Boom, detected in software. ;)
in the 80's just needed to know where they wrote down the password
https://www.youtube.com/watch?...
https://www.youtube.com/watch?...
https://it.slashdot.org/story/...
https://www.csoonline.com/arti...
http://www.businessinsider.com...
The USB keyloggers present themselves over the USB bus as a keyboard, but not necessarily YOUR keyboard.
A keylogger need not present itself as anything over the USB bus. It can simply monitor the data lines that pass through it, allowing your keyboard to talk to the system. How do you detect that?
Second, what OS has the 'feature' of locking itself to one specific vendor and device id for its input devices? That 'feature' would be disabled the very first time the keyboard needed to be replaced in a hurry, like "I just showed up to deliver a lecture and the keyboard on the display computer is broken. I'll use the keyboard from one of the other systems in the room..."
Iowa wrestling. Guaranteed these were the same 'easy As' that other jocks take.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
so what pair each system to a there own keyboard?
So now you need to keep track of all of that if fails a lot then users will just get used to repairing them all the time.
Creimer affiliate spam. Mod down please. Thanks.
It's coming. Lookup 'Rubber ducky'. Essentially a reprogrammed flash storage device that presents itself as a keyboard and runs scripts (typically attack scripts).
Many places have computers set to call IT if anybody plugs in a USB storage device. Soon it will also call for a keyboard.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
I noticed a kid (old enough to drive) sneaking out of CiCi's with a plate (a restaurant plate) of pizza.
Nimble fingers indeed!
Hey, I brought pizza into the thread....
The university told the FBI that the cheating scheme cost the school $68,000 to investigate the breach and to beef up its IT security.
Maybe they should have thought about IT security from the start.
I've been to college and I see how "security" is done. The computers the instructors use are just put on a desk or table in the front of the room. To keep it from walking away there will be a flimsy cable attaching the parts to the desk or wall. Even basic security, like setting BIOS passwords, will not be done. This can allow spying on the computer with software keyloggers and such, or simply vandalizing it so it's unbootable. The installation of a hardware keylogger, like in this example, takes no real skill.
Newer classrooms will have a proper podium designed to hold a computer. The computer will still just be out in the open for someone to mess with, and being in a podium will make things like a hardware keylogger more difficult to see.
Had the school thought of security from the start then this would not have happened and the costs would have been minimal. For example, when installing the podium use one with a locking door to the space for the computer. This would make installing a keylogger, hardware or software, much more difficult. It would also add some inconvenience for the IT support and the instructors, which is likely why it wasn't considered until something like this happened.
There's a lot of simple things that should have been done on just getting basic physical security on the computers. From what I know the network and software is pretty secure. The software people on universities love to play with this and it costs next to nothing to implement since graduate students' time is effectively free.
Assuming that these computers have some basic physical security, and pretty solid software security, that doesn't stop things like a student sneaking into a classroom early in the morning, before classes start for the day, and putting a cheap cell phone in the ceiling tile so the camera looks down on the keyboard through a small hole, and recording keystrokes.
What I think will solve this problem is the inevitable march of technology. I suspect that computers will get small and powerful enough that instructors will simply bring their computer with them to the classroom. There will be nothing in the room to mess with that would allow keyloggers or whatever. Access to computers in public spaces like labs, libraries, and so forth will be require an actual thought on security instead of technology fixing it for them. I'd think that there's lots of ways that could fix this where graduate students could do some research and development on this, which doesn't require any hardware, and they get to write a paper on it for a grade.
At the start they need basic physical security. They failed on this, and when someone took advantage of this they claim this wasn't the school's fault. No, it was the school's fault. If you own a house but don't lock the door when you leave then don't be surprised if someone walks in to walk off with your spare change jar and the beer in your fridge. Punish the trespasser but own up to leaving the door unlocked.
I am armed because I am free. I am free because I am armed.
This seems like simple criminal trespass, fraud and larceny. The local or state PD can handle this.
Silly mistakes are silly. Kid had access to the test banks and answers. He could have easily memorized the correct answers.
Even if he failed the test, he could have corrupted everyone else's grades to obscure the fact that he was doing it.
If you're going to commit any sort of computer forgery, make sure you spread the love far and wide so even unrelated students in completely different classes have their grades changed. There would be absolutely no way they would be able to find him in this instance.
Only the stupid get caught.
I wonder how one would protect against keyboard loggers. Since they are totally passive, an ID on a keyboard would do little at all.
The only way I can really see it happening is with a separate protocol from USB (perhaps fiber optic, a la S/PDIF), where the keyboard and the computer are paired, the keyboard uses epoxy potting and tamper-evident wiring and enclosures, and some form of cryptographic handshaking is done. The instruct users that no "secure" light on the keyboard, no typing.
Of course, this also shows how important 2FA is, especially with regards to grades. One ideal would be having the info changed on the computer, then confirmations showing the changes appear on someone's smartphone, similar to how the old IBM Zurich ZTIC would show proposed transactions and ask to allow or deny them. That way, someone would have to get ahold of the access token as well as get the username/password pairing.
In the late 1970s, Ken Thompson added paging support to Multics so it could use the full 4MB of memory available in the first generation PDP-11 machines with the original Unibus. 4MB is 250 times as much memory as the 16KB PC.
By the time DOS was released, multi-user systems like the IBM System/370 3081 had 32MB, or two thousand times as much memory as the PC.
It will be whack a mole. Lock the computer to the keyboard model and the keylogger will just get updated to report it is whatever keyboard plugged into it.
Epoxy is a solution, but not a good one.
They need to encrypt traffic between the computer and keyboard. Which will add admin overhead.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
Just record Bluetooth keystrokes. Way easier and harder to detect.
Use Bluetooth with encryption? You control both in the pairing?
and then pay for battery's?
And a modem with an acoustic coupler!
A strange game.
The only way to win is not to play.
Epoxy is a solution, but not a good one.
There is no security without physical security.
The computer is in a place that the public can access.
If he was as smart as he was cunning, he should have intercepted tests ahead of time and aced them (article says he had the access) rather than changing grades and risking capture
There is a saying in the Army - never give an Order that will not be obeyed. It just breaks down the respect for Authority which is needed for soldiers to take an order which will mean risking their life but will probably save lives during battles.
A similar principle should apply to laws - dont pass laws that will not be obeyed. The 21 yr drinking age is a stupid law. If someone is old enough to fuck, go to war, get married and be executed for a capital crime they very well should be old enough to drink.
Once you pass laws that are stupid people feel no guilt breaking them and breaking other laws like forgery laws to get around the stupid law.
**Life is too short to be serious**
"...no way for an OS to detect it."
It's not easy, but it can be done. The USB keyloggers present themselves over the USB bus as a keyboard, but not necessarily YOUR keyboard. They will have the same USB vendor/device ID across all of the devices. So look for that ID in place of your normal keyboard. Boom, detected in software. ;)
And Boom, doesn't go the dynamite. Take a look at some of the Hak5 products, like the Bash Bunny or USB Rubber Ducky. They allow the owner of the device to specify whatever VID/PID combination they want; they actually recommend you change it from their defaults so that scanning for their default VID/PID won't get you caught.
Besides, you can't simply block alternate keyboard IDs anyway, at least not in America. The Americans With Disabilities Act will quickly be invoked by someone who needs an alternative input device in order to do their job. Perhaps they're in a wheelchair and need a wireless keyboard or mouse. Blocking random USB HID devices turns out to be a real problem for them.
John
I've been to a hospital where all the keyboards have some kind of ID card slot on them. I'll see staff sit down, presumably type in a password, and get their screen. If the keyboard is smart enough, and a matching driver written, then the communication on the USB wire can be encrypted with a key in the ID card. At a minimum the systems on the university could be configured to not allow login without that ID card. I assume that there would have to be a backup plan for cases of broken hardware, lost ID card, and such so that it doesn't keep instructors completely out for the lecture. Maybe have to call the IT desk to ask for an override. Do they still put telephones in lecture halls, or will the instructors not have to be so absent minded to not lose their ID and cell phone at the same time?
Epoxy would work to keep out a lot of tampering but I'd think one of those locking equipment boxes would be much less costly in the long run. Computers with epoxy on the USB ports would have no resale value, and would be difficult to repair in many cases.
I am armed because I am free. I am free because I am armed.
Display the exam questions on captcha banners that protect pr0n sites from bots, and sit back and watch how the whole world passes your exams.
I wonder how one would protect against keyboard loggers. Since they are totally passive, an ID on a keyboard would do little at all.
The only way I can really see it happening is with a separate protocol from USB (perhaps fiber optic, a la S/PDIF), where the keyboard and the computer are paired, the keyboard uses epoxy potting and tamper-evident wiring and enclosures, and some form of cryptographic handshaking is done. The instruct users that no "secure" light on the keyboard, no typing.
Of course, this also shows how important 2FA is, especially with regards to grades. One ideal would be having the info changed on the computer, then confirmations showing the changes appear on someone's smartphone, similar to how the old IBM Zurich ZTIC would show proposed transactions and ask to allow or deny them. That way, someone would have to get ahold of the access token as well as get the username/password pairing.
They can lock the computers up in a box like some kiosks have
Security 101... Would you log in to a sensitive account by typing your password over an unknown wifi connection? Hopefully not. A public PC should be considered similarly untrustworthy.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
"He/she knew Graves was providing the copies to other students and did not want the grading curve to negatively impact his/her scores."
Then report him, you lying, cheating fucker!
Lets be honest here if he is able to do this 90 times then the college clearly has no reputable service to sell the guy and furthermore if he spends jail time with college debt gaining interest its just a new method for sales a means to squash opposition to past alumni.
In short if this dumbass gets caught you can be certain there are far more educated folks doing the same damn thing and getting away with it. He is exactly the kind of guy to keep around to reveal more perpetrators.
If you're smart enough to cheat and not get caught, you are smart enough to not need to cheat
the obvious next step is to change his court or conviction file . . .
"Hey, Sarge! someone screwed up and put this idiot in a cell for jaywalking.'
And off he goes, free again . . . :)
hawk
I learned two things: 1 - this kid is persistent and someone should hire him as a white hat; 2 - the administrators at this school/school district are really, really unteachable. Public education anyone?