Slashdot Mirror
Student Charged By FBI For Hacking His Grades More Than 90 times (sophos.com)
An anonymous reader shares a report: In college, you can use your time to study. Or then again, you could perhaps rely on the Hand of God. And when I say "Hand of God," what I really mean is "keylogger." Think of it like the "Nimble Fingers of God." "Hand of God" (that makes sense) and "pineapple" (???) are two of the nicknames allegedly used to refer to keyloggers used by a former University of Iowa wrestler and student who was arrested last week on federal computer-hacking charges in a high-tech cheating scheme. According to the New York Times, Trevor Graves, 22, is accused in an FBI affidavit of working with an unnamed accomplice to secretly plug keyloggers into university computers in classrooms and in labs. The FBI says keyloggers allowed Graves to record whatever his professors typed, including credentials to log into university grading and email systems. Court documents allege that Graves intercepted exams and test questions in advance and repeatedly changed grades on tests, quizzes and homework assignments. This went on for 21 months -- between March 2015 and December 2016. The scheme was discovered when a professor noticed that a number of Graves' grades had been changed without her authorization. She reported it to campus IT security officials.
At least he cares about grades. Most student athletes dont.
**Life is too short to be serious**
He should change his major to "Hacking"; problem solved!
Table-ized A.I.
The same thing most other college graduates do - Fake it till you make it!
Sent from my TARDIS
There's a career in professional wrestling waiting for this enterprising young fella.
That was the turning point of my life--I went from negative zero to positive zero.
>> when I say "Hand of God," what I really mean is "keylogger." Think of it like the "Nimble Fingers of God." "Hand of God" (that makes sense)
Hey, um, "Nimble Fingers" is a dangerous thing to type into a search bar. And no one has used that phrase in a SFW setting since 1978.
>> and "pineapple" (???)
Prolly this: https://www.wifipineapple.com/
Seems like smart would have been to either obtain the quiz questions OR to change your grades only once every semester. Attacking both sides of the system makes way too much noise.
--
"What's up doc?!" - B. Bunny
Why is USB device plug can read keyboard input without installation or authorization from the computer? Is plugin a mouse or keyboard really have the feedback of each key pressed? I know they need to know when caplock is on but what about all normal keys?".
Not sure what you're trying to say here. Looks like you're assuming that keypresses are broadcast to all USB devices, which is, of course, nonsese.
Your run of the mill hardware keylogger is a device that's between the computer and the keyboard. A "man in the middle" attack, only in hardware. There's no software installation, and no way for an OS to detect it.
https://en.wikipedia.org/wiki/...
Use TFA. Here it is 2017. I'm running low on sympathy for those who get hacked because they didn't use TFA.
"Shoot, a fella could have a pretty good weekend in Vegas with all that stuff."
Why is USB device plug can read keyboard input without installation or authorization from the computer?
News for nerd: many, if not most, modern keyboards are USB. Plugging a device into the computer and then the keyboard into the device means it looks like a keyboard to the system and there is still only one on the system.
Is plugin a mouse or keyboard really have the feedback of each key pressed?
Yes, a keyboard knows what keys have been pressed. That's kinda the whole purpose of a keyboard.
That one is ridiculously expensive. Nice try sneaking in that affiliate link though.
Hey, let's get the exams and test questions in advance so I'll have a good score!
Fails.
Hey, let's enter the system and change my grades since I failed even when I had the exams and test questions in advance!
That guy's C.V. can be resumed in one sentence: Can't even cheat his way out by cheating. I'd never hire that guy in a million years.
#DeleteFacebook
Hired by the FBI? For what skill? Being able to connect a USB device between a USB port and a USB keyboard?
#DeleteFacebook
He would have been far better off spending the time and energy to study and improve himself not only to do better in academia but concordantly in business. In the amount of time he spent hacking, he could have aced everything. Instead, he fails miserably, demonstrates his moral fibre, and shows that he will excel at nothing but politics.
Sad.
> The PC is notoriously poorly designed as if it were meant to be run disconnected from the internet and in a room hidden away from intruders.
Which, for those who don't know, is exactly the case. Prior PCs (PERSONAL computers) running DISK Operating System, there were time-sharing computers running NETWORK operating systems. Computers prior to the PC each had many users, hundreds of uses for each computer. They often used it over a network, using terminals. Security was of course important - you didn't want one authorized user to mess things up for another user.
Then technology advanced to the point that it was feasible fr a single person to have their own personal computer, with several KBs of RAM. What OS would run in just a few kilobytes of RAM, though? Just the security-related stuff was a couple KBs. But wait, a *personal* computer with only one user, running from local disk and not attached to a network didn't NEED security. So to fit the OS in 16KB, the smart thing to do was to make a minimal OS without any of that security or networking stuff. It worked great. Then the internet happened and the manufacturer of Disk Operating System shit bricks.
What is this? War Games?
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
"Ferris has been absent 9 times"....."GRACE!"
Sent from my TARDIS
on the football / basketball team then no need to hack to your grades as the school will find away to make you pass.
Why would he intercept exams and test questions if he could just change his grade directly anyway?
Give it to other students? Read TFA... For him, he doesn't study it himself anyway so he just changed his own grade.
* A student identified as A.B. in court documents urged Graves to use the keylogger to steal an upcoming test, saying “I need 100 on final just to get B- at this point.” Graves’ reply: “Or we could use the time to study?”
* A student identified as Z.B. asked Graves whether he had told a classmate “about the Hand of God on that test.” Graves’ reply: “No. The less people know the better.”
"...no way for an OS to detect it."
It's not easy, but it can be done. The USB keyloggers present themselves over the USB bus as a keyboard, but not necessarily YOUR keyboard. They will have the same USB vendor/device ID across all of the devices. So look for that ID in place of your normal keyboard. Boom, detected in software. ;)
in the 80's just needed to know where they wrote down the password
https://www.youtube.com/watch?...
https://www.youtube.com/watch?...
He will be arrested and then hired by the FBI or someone else.
Key logger != Hacking
Hired by the FBI? For what skill? Being able to connect a USB device between a USB port and a USB keyboard?
For being a sociopath, and willing to do whatever it takes to win, without annoyances like conscience or dignity to get in the way.
He wouldn't have gotten caught if he had good enough memory to remember the exam questions.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
https://it.slashdot.org/story/...
https://www.csoonline.com/arti...
http://www.businessinsider.com...
Hired by the FBI? For what skill? Being able to connect a USB device between a USB port and a USB keyboard?
For being a sociopath, and willing to do whatever it takes to win, without annoyances like conscience or dignity to get in the way.
I'd say he could get a job on Wall Street, but you actually need skills and/or education for that. Perhaps he can run for President - the bar for that is apparently quite low now.
It must have been something you assimilated. . . .
The USB keyloggers present themselves over the USB bus as a keyboard, but not necessarily YOUR keyboard.
A keylogger need not present itself as anything over the USB bus. It can simply monitor the data lines that pass through it, allowing your keyboard to talk to the system. How do you detect that?
Second, what OS has the 'feature' of locking itself to one specific vendor and device id for its input devices? That 'feature' would be disabled the very first time the keyboard needed to be replaced in a hurry, like "I just showed up to deliver a lecture and the keyboard on the display computer is broken. I'll use the keyboard from one of the other systems in the room..."
Iowa wrestling. Guaranteed these were the same 'easy As' that other jocks take.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
so what pair each system to a there own keyboard?
So now you need to keep track of all of that if fails a lot then users will just get used to repairing them all the time.
You misspelled Oracle.
MS doesn't put the effort into marketing. It's like they can't be bothered to lie and/or offer no show jobs to decision makers.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
It's coming. Lookup 'Rubber ducky'. Essentially a reprogrammed flash storage device that presents itself as a keyboard and runs scripts (typically attack scripts).
Many places have computers set to call IT if anybody plugs in a USB storage device. Soon it will also call for a keyboard.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
I noticed a kid (old enough to drive) sneaking out of CiCi's with a plate (a restaurant plate) of pizza.
Nimble fingers indeed!
Hey, I brought pizza into the thread....
The university told the FBI that the cheating scheme cost the school $68,000 to investigate the breach and to beef up its IT security.
Maybe they should have thought about IT security from the start.
I've been to college and I see how "security" is done. The computers the instructors use are just put on a desk or table in the front of the room. To keep it from walking away there will be a flimsy cable attaching the parts to the desk or wall. Even basic security, like setting BIOS passwords, will not be done. This can allow spying on the computer with software keyloggers and such, or simply vandalizing it so it's unbootable. The installation of a hardware keylogger, like in this example, takes no real skill.
Newer classrooms will have a proper podium designed to hold a computer. The computer will still just be out in the open for someone to mess with, and being in a podium will make things like a hardware keylogger more difficult to see.
Had the school thought of security from the start then this would not have happened and the costs would have been minimal. For example, when installing the podium use one with a locking door to the space for the computer. This would make installing a keylogger, hardware or software, much more difficult. It would also add some inconvenience for the IT support and the instructors, which is likely why it wasn't considered until something like this happened.
There's a lot of simple things that should have been done on just getting basic physical security on the computers. From what I know the network and software is pretty secure. The software people on universities love to play with this and it costs next to nothing to implement since graduate students' time is effectively free.
Assuming that these computers have some basic physical security, and pretty solid software security, that doesn't stop things like a student sneaking into a classroom early in the morning, before classes start for the day, and putting a cheap cell phone in the ceiling tile so the camera looks down on the keyboard through a small hole, and recording keystrokes.
What I think will solve this problem is the inevitable march of technology. I suspect that computers will get small and powerful enough that instructors will simply bring their computer with them to the classroom. There will be nothing in the room to mess with that would allow keyloggers or whatever. Access to computers in public spaces like labs, libraries, and so forth will be require an actual thought on security instead of technology fixing it for them. I'd think that there's lots of ways that could fix this where graduate students could do some research and development on this, which doesn't require any hardware, and they get to write a paper on it for a grade.
At the start they need basic physical security. They failed on this, and when someone took advantage of this they claim this wasn't the school's fault. No, it was the school's fault. If you own a house but don't lock the door when you leave then don't be surprised if someone walks in to walk off with your spare change jar and the beer in your fridge. Punish the trespasser but own up to leaving the door unlocked.
I am armed because I am free. I am free because I am armed.
This seems like simple criminal trespass, fraud and larceny. The local or state PD can handle this.
Silly mistakes are silly. Kid had access to the test banks and answers. He could have easily memorized the correct answers.
Even if he failed the test, he could have corrupted everyone else's grades to obscure the fact that he was doing it.
If you're going to commit any sort of computer forgery, make sure you spread the love far and wide so even unrelated students in completely different classes have their grades changed. There would be absolutely no way they would be able to find him in this instance.
Only the stupid get caught.
I remember talking to my dad about one of his card playing buddies. I think it was about me overhearing them talking about him going to college. I asked what was his major, Dad said the guy just went to school to play baseball.
A lot of these student athletes don't think much about what they are going to do after college. They'll study just about anything so they can say they went to college. They go to school so that they can play sports and hope some professional team picks them up, or just to live the high school jock life for 2 or 4 years longer.
If they graduate then at least they can check that box on a job application saying they went to college, even if what they will be doing is answering phones and telling people that call to reboot their modem. Which will be especially odd if they end up working at an ice cream parlor.
I am armed because I am free. I am free because I am armed.
I wonder how one would protect against keyboard loggers. Since they are totally passive, an ID on a keyboard would do little at all.
The only way I can really see it happening is with a separate protocol from USB (perhaps fiber optic, a la S/PDIF), where the keyboard and the computer are paired, the keyboard uses epoxy potting and tamper-evident wiring and enclosures, and some form of cryptographic handshaking is done. The instruct users that no "secure" light on the keyboard, no typing.
Of course, this also shows how important 2FA is, especially with regards to grades. One ideal would be having the info changed on the computer, then confirmations showing the changes appear on someone's smartphone, similar to how the old IBM Zurich ZTIC would show proposed transactions and ask to allow or deny them. That way, someone would have to get ahold of the access token as well as get the username/password pairing.
In the late 1970s, Ken Thompson added paging support to Multics so it could use the full 4MB of memory available in the first generation PDP-11 machines with the original Unibus. 4MB is 250 times as much memory as the 16KB PC.
By the time DOS was released, multi-user systems like the IBM System/370 3081 had 32MB, or two thousand times as much memory as the PC.
It will be whack a mole. Lock the computer to the keyboard model and the keylogger will just get updated to report it is whatever keyboard plugged into it.
Epoxy is a solution, but not a good one.
They need to encrypt traffic between the computer and keyboard. Which will add admin overhead.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
I remember hearing something like that before... That's right in the movie Grosse Pointe Blank.
http://www.imdb.com/title/tt01...
Debi: [about the man Martin killed at the reunion] He was trying to kill you, right?
Marty: Yes.
Debi: It wasn't the other way around?
Marty: No.
Debi: Is it something you've done?
Marty: It's something I do... professionally, for about five years now.
[He lifts the gun in his hand]
Debi: [Gasps] You were joking! People joke about the horrible things they *don't* do, they don't *do* them! It's absurd!
Marty: When I left, I joined the Army, and when I took the service exam, my psych profile fit a certain... "moral flexibility" would be the only way to describe it. I was loaned out to a CIA-sponsored program and we sort of found each other. That's the way it works.
Debi: So, you're a government spook?
Marty: Yes, I mean no. I was before but I'm not now... but that' all irrelevant, really. The idea of government, nations is public relations theory at this point.
Debi: Don't. I don't wanna hear about the theories. I wanna hear about the dead people. Explain the dead people.
I am armed because I am free. I am free because I am armed.
and then pay for battery's?
Epoxy is a solution, but not a good one.
There is no security without physical security.
The computer is in a place that the public can access.
There is a saying in the Army - never give an Order that will not be obeyed. It just breaks down the respect for Authority which is needed for soldiers to take an order which will mean risking their life but will probably save lives during battles.
A similar principle should apply to laws - dont pass laws that will not be obeyed. The 21 yr drinking age is a stupid law. If someone is old enough to fuck, go to war, get married and be executed for a capital crime they very well should be old enough to drink.
Once you pass laws that are stupid people feel no guilt breaking them and breaking other laws like forgery laws to get around the stupid law.
**Life is too short to be serious**
"...no way for an OS to detect it."
It's not easy, but it can be done. The USB keyloggers present themselves over the USB bus as a keyboard, but not necessarily YOUR keyboard. They will have the same USB vendor/device ID across all of the devices. So look for that ID in place of your normal keyboard. Boom, detected in software. ;)
And Boom, doesn't go the dynamite. Take a look at some of the Hak5 products, like the Bash Bunny or USB Rubber Ducky. They allow the owner of the device to specify whatever VID/PID combination they want; they actually recommend you change it from their defaults so that scanning for their default VID/PID won't get you caught.
Besides, you can't simply block alternate keyboard IDs anyway, at least not in America. The Americans With Disabilities Act will quickly be invoked by someone who needs an alternative input device in order to do their job. Perhaps they're in a wheelchair and need a wireless keyboard or mouse. Blocking random USB HID devices turns out to be a real problem for them.
John
I've been to a hospital where all the keyboards have some kind of ID card slot on them. I'll see staff sit down, presumably type in a password, and get their screen. If the keyboard is smart enough, and a matching driver written, then the communication on the USB wire can be encrypted with a key in the ID card. At a minimum the systems on the university could be configured to not allow login without that ID card. I assume that there would have to be a backup plan for cases of broken hardware, lost ID card, and such so that it doesn't keep instructors completely out for the lecture. Maybe have to call the IT desk to ask for an override. Do they still put telephones in lecture halls, or will the instructors not have to be so absent minded to not lose their ID and cell phone at the same time?
Epoxy would work to keep out a lot of tampering but I'd think one of those locking equipment boxes would be much less costly in the long run. Computers with epoxy on the USB ports would have no resale value, and would be difficult to repair in many cases.
I am armed because I am free. I am free because I am armed.
Display the exam questions on captcha banners that protect pr0n sites from bots, and sit back and watch how the whole world passes your exams.
Security 101... Would you log in to a sensitive account by typing your password over an unknown wifi connection? Hopefully not. A public PC should be considered similarly untrustworthy.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Not sure what he thought he would be doing with his life after graduating with a degree and knowing absolutely nothing about the subject matter.
Most people don't do a degree in (say) Chemistry then go on to become Research Chemists. If you do a degree in English Literature, you're somewhat more likely to end up as a banker or teacher than a professional poet.
To have a right to do a thing is not at all the same as to be right in doing it
the obvious next step is to change his court or conviction file . . .
"Hey, Sarge! someone screwed up and put this idiot in a cell for jaywalking.'
And off he goes, free again . . . :)
hawk
I learned two things: 1 - this kid is persistent and someone should hire him as a white hat; 2 - the administrators at this school/school district are really, really unteachable. Public education anyone?
He will be arrested and then hired by the FBI or someone else.
The part I do not understand is, what part of this crime is interstate commerce?