zlacker

IoT hacking and rickrolling my high school district

submitted by revico+(OP) on 2021-10-12 19:38:06 | 1912 points 383 comments
[view article] [source] [go to bottom]

NOTE: showing posts with links only show all posts
◧◩◪◨
25. jdmich+Q5[view] [source] [discussion] 2021-10-12 20:09:48
>>blackt+N4
PowerShell has been available on Linux via .NET Core since 2016 and version 6.0. Even my Windows box with PowerShell 5.1 likes to remind me of this fact every time I start it:

    Windows PowerShell
    Copyright (C) Microsoft Corporation. All rights reserved.
    
    Try the new cross-platform PowerShell https://aka.ms/pscore6
◧◩◪
26. judge2+V5[view] [source] [discussion] 2021-10-12 20:10:21
>>_wldu+s3
It can get pretty messy. For example, they could wait until they're 21 to try them as an adult, even if it was committed at 17 or younger [0 p. 128]:

> a person who committed the offense before his eighteenth birthday, but is over twenty-one on the date formal charges are filed, may be prosecuted as an adult.... This is true even where the government could have charged the juvenile prior to his twenty-first birthday, but did not.

However, the statute of limitations for CFAA violations is 2 years [1 p. 2] so this might not apply. If somehow they can still go after him at 21, this post could play a part in evidence for performing the hack (I truly hope not).

0: https://www.justice.gov/sites/default/files/criminal-ccips/l...

1: https://www.goodwinlaw.com/-/media/files/publications/10_01-...

◧◩
61. jdkee+rb[view] [source] [discussion] 2021-10-12 20:42:09
>>mmaund+0b
This post is 100% spot on. While the local school district may treat it as a prank, in the U.S. the federal authorities may not. To see how seriously the government takes this act, look at the penalties section of the relevant U.S. code.

https://www.law.cornell.edu/uscode/text/18/1030

◧◩
77. bellyf+cd[view] [source] [discussion] 2021-10-12 20:52:20
>>mmaund+0b
Ah, 2021, such sad times, where we squash our creativities in fear of the police, where you'd think twice before doing something like one of the MIT hacks http://hacks.mit.edu ...

I do wonder if they could've secured themselves with VPN and "untraceable" anonymous emails (e.g. asking for a guarantee that they won't be sued/charged), although the teenage bragging rights would've been too tempting.

I wonder if it was possible for the hacker to ask a lawyer to represent them anonymously and make a contract, something like the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money...

90. 908B64+De[view] [source] 2021-10-12 20:59:29
>>revico+(OP)
I just hope the author, at least, applied to MIT. He would fit right in.

http://hacks.mit.edu/.

106. nudgee+th[view] [source] 2021-10-12 21:15:48
>>revico+(OP)
I got in trouble and subsequently suspended from school back in the ‘90s for causing BSOD’s on classmates computers using WinNuke [0]. They classed it as vandalism even though the payload causes no permanent damage (apart from losing unsaved work).

I found more severe vulnerabilities including being able to lift home addresses of students by querying an unprotected endpoint. Didn’t get in trouble for this one, and reported it promptly to the IT administrator.

[0] https://en.m.wikipedia.org/wiki/WinNuke

◧◩
107. tkinom+Mh[view] [source] [discussion] 2021-10-12 21:18:11
>>mmaund+0b
For anyone who like to hack legally and ethically, check out https://www.hackerone.com/. If you're very good at hacking devices, software, networks, etc, companies will pay bounties for the vulnerabilities you find thru HackerOne.

Looks like they paid out millions in bounty in 2020:

    https://www.zdnet.com/article/hackerones-2020-top-10-public-bug-bounty-programs/
◧◩
173. Accuja+Du[view] [source] [discussion] 2021-10-12 22:40:39
>>belval+j2
I'm sure it helps a lot that they're in a high tax base area, and the quality of the educators hired probably reflects that.

https://statisticalatlas.com/school-district/Illinois/Townsh...

◧◩◪
191. bfirsh+OA[view] [source] [discussion] 2021-10-12 23:31:16
>>blueda+Zz
https://www.dropbox.com/s/hyt24p4j43szpdi/logo.gif?dl=0
◧◩
204. detaro+RC[view] [source] [discussion] 2021-10-12 23:47:08
>>bfirsh+zg
based on http://www.ex-parrot.com/pete/upside-down-ternet.html by chance? or parallel evolution? :D
◧◩◪
217. Strato+HH[view] [source] [discussion] 2021-10-13 00:29:55
>>pfraze+jE
Yup, you can still do that. AutoHotkey is a wonderful tool for this. You can intercept input events globally, and transform them or send completely different events to the target app.

For example, I use AutoHotkey to implement my JKLmouse program, which turns certain keyboard events into mouse movement for precise control. It's similar to the MouseKeys that comes with Windows, but made for laptop keyboards without numeric keypads.

And yes, you could definitely do that Minesweeper hack in AutoHotkey! :-)

https://www.autohotkey.com/

◧◩◪◨⬒
222. Strato+eJ[view] [source] [discussion] 2021-10-13 00:43:56
>>Quessk+lI
Sure. I didn't want to engage in self-promotion, but since you asked, here's the website and source code. There is an installer, but it's kind of old. I suggest installing AutoHotkey itself, then download the JKLmouse.ahk and JKLmouse.ico files from GitHub, and put a shortcut to the .ahk in your Startup folder.

https://www.jklmouse.com/

https://github.com/geary/jklmouse/tree/master/AutoHotkey/Sou...

One thing to note is that I wrote this to use on my ThinkPads, which have physical mouse buttons. On a laptop where the touchpad itself is the mouse button, it may be difficult to avoid nudging the mouse position when you click.

I've been thinking about adding support for using other keys as "mouse buttons", but haven't done anything about it yet.

◧◩
226. TeeMas+nK[view] [source] [discussion] 2021-10-13 00:53:34
>>jimt12+1C
Oh yeah the early 2000s, not a great day to be a hacker (by hacker I mean actual hacker: http://catb.org/~esr/faqs/hacker-howto.html).

I remember getting yelled at for changing the display resolution and typing a few commands in DOS to change file names quickly.

Computers were never up to date of course, we had cathodic displays up to 2010.

◧◩◪
255. aimor+i81[view] [source] [discussion] 2021-10-13 05:13:14
>>pfraze+jE
I ran into a fun bug in W10 where my arrow keys were moving the mouse cursor around. Turns out MS Paint does this as a feature and somehow it leaked beyond Paint.

https://superuser.com/questions/1467313/mouse-pointer-moving...

257. theshr+F91[view] [source] 2021-10-13 05:29:44
>>revico+(OP)
We figured out that our computer class had a few computers infected by the Ambulance virus[0]. So of course we intentionally infected all the computers with it =)

On the other hand me and a few of my friends were the only computer literate people in the school and were tasked with removing it in the end.

But still, it was fun seeing a whole class of computers have an ambulance run at the bottom of the screen with the poor beeper emulating the siren.

[0] https://en.wikipedia.org/wiki/Ambulance_(computer_virus)

◧◩◪
276. teddyh+gn1[view] [source] [discussion] 2021-10-13 07:41:08
>>bellyf+cd
> the district promises not to file criminal charges, and if they violate this deal they will have to pay a lot of money...

“Your faith in the legal system is appalling.”

https://www.schlockmercenary.com/2009-06-26

◧◩◪◨⬒⬓⬔
292. AnIdio+RK1[view] [source] [discussion] 2021-10-13 11:24:26
>>anyfoo+Q11
They did not: https://news.ycombinator.com/item?id=28846569
◧◩◪◨⬒
306. jve+R72[view] [source] [discussion] 2021-10-13 14:10:45
>>onepla+ar
> Ironically, it hasn't managed to displace the command prompt or batch files

It don't think they expect that people would rewrite their old scripts. That is actually silly to consider. Even with console vs terminal, they are concerned of backward compatibility and leaving it as is:

> Windows Console will continue to ship within Windows for decades to come in order to ensure backward compatibility with the many millions of existing/legacy command-line scripts, apps, and tools

https://devblogs.microsoft.com/commandline/windows-terminal-...

308. pgcm1+Y82[view] [source] 2021-10-13 14:15:33
>>revico+(OP)
This article was great.

If you want to understand the IoT better, I can recommend this article: https://girlsplaining.substack.com/p/internet-of-things-and-...

◧◩◪◨
349. geoffp+8t3[view] [source] [discussion] 2021-10-13 20:43:18
>>michae+373
This was supposedly true of the Apple III (https://www.techjunkie.com/apple-iii-drop/), but upon searching to find that link, it seems this story may be apocryphal: https://retrocomputing.stackexchange.com/questions/12283/did...
364. unwind+545[view] [source] 2021-10-14 12:52:46
>>revico+(OP)
Cool, I guess, but "scary" and as always a bit obnoxious to read about for me.

Anyway, it was fun to learn about the "obscure ARC architecture" used by the IoT devices in question. Unpacked to "Argonaut RISC Core", that made me curious enough to look it up since I hadn't heard of it. And sure enough, it was related to Argonaut as in "the UK game developers founded by Jez San" [1]. That's a really interesting development! :)

[1] https://en.wikipedia.org/wiki/Synopsys#ARC_International

◧◩◪◨⬒⬓
380. moepst+UG8[view] [source] [discussion] 2021-10-15 13:34:23
>>exikyu+2c8
iirc, that was on the spindle axis - i only was gently pushing the drive arm near its supporting point to avoid it touching the platters (chances are i did make it touch the platters)...

Mind you, this was not in a clean room and i tried to be as quick as possible to not allow too much dust into the case..

Here's an online article, might even be the same drive (this was a external WD drive, not sure about the capacity, i think 500GB or 1TB): https://dataanalyzers.com/external-hard-drive-western-digita...

[go to top]