News for hackers. Stuff that matters.
Re:IoT hacking and rickrolling my high school district by bluedays on Tuesday October 12, 2021 @07:24PM (#28846332)
I don't think this happened.
Re:IoT hacking and rickrolling my high school district by bfirsh on Tuesday October 12, 2021 @07:31PM (#28846383)
Re:IoT hacking and rickrolling my high school district by collegeburner on Tuesday October 12, 2021 @08:16PM (#28846720)
Wow takes me back to old Google's former logo! It looked so much better with old logo.
Re:IoT hacking and rickrolling my high school district by samschooler on Tuesday October 12, 2021 @07:27PM (#28846346)
Hypothetically it could happen and even if it isn’t true, I feel it adds something to the conversation. Besides, you cited as many sources as they did.
Re:IoT hacking and rickrolling my high school district by bluedays on Tuesday October 12, 2021 @07:33PM (#28846401)
Sounds way overly complex for a high schooler to pull off. At least the OP sounded legitimate, the details didn't sound over the top.
Re:IoT hacking and rickrolling my high school district by anyfoo on Tuesday October 12, 2021 @07:40PM (#28846463)
I think you're underestimating motivated high schoolers.

When I was in high school I was a huge Linux fan and had a side job as a network administrator for small companies in my town. I don't know if I would have gotten the "random ARP load balancing" idea, but overall it seems well within the knowledge admins of the days had about TCP/IP.

When I was between 15 and 17 or so, I wrote small HTTP, DNS servers etc. in C++ for fun (straightforward implementations and not better in any way, so in the end just learning exercises), and I definitely had friends who did similar things.

Re:IoT hacking and rickrolling my high school district by AnIdiotOnTheNet on Tuesday October 12, 2021 @08:28PM (#28846803)
Not really. Sounds like this was class of '08, and at the time BackTrack would have been readily available and popular enough for a curious highschooler with a bit of computing background to find. As I recall etercap was built in and I wouldn't be at all surprised if there were tutorials for setting up scenarios almost exactly like what is described.

Even the ARP balancing thing is the kind of too-clever-by-a-half solution a naive youngin' would come up with since it would lead all the nodes thinking each other are the gateway and crushing the network with routing loops.

Re:IoT hacking and rickrolling my high school district by anyfoo on Tuesday October 12, 2021 @11:54PM (#28848059)
Maybe they hardcoded the real gateway's MAC Address.
Re:IoT hacking and rickrolling my high school district by AnIdiotOnTheNet on Wednesday October 13, 2021 @07:24AM (#28850850)
Re:IoT hacking and rickrolling my high school district by _jal on Tuesday October 12, 2021 @08:06PM (#28846657)
Sounds like you hung out with the wrong kids in high school.

A couple friends and I pulled off some stunts of comparable non-digital complexity. (This was the 80s, schools didn't have networks.) They were more of the logistics and misdirection sort; for instance, having your own version of the printed graduation programs delivered, instead of the boring, official one.

Re:IoT hacking and rickrolling my high school district by foooobaba on Wednesday October 13, 2021 @02:22AM (#28848815)
I did some similar shenanigans when in 10th grade, with backtrack 3 and ettercap-ng it was pretty easy. I didn’t do the load balancing, and ended up crashing the network when my laptop couldn’t keep up lol.
Re:IoT hacking and rickrolling my high school district by anyfoo on Tuesday October 12, 2021 @07:34PM (#28846424)
I'm less skeptical. OP already mentioned that most things were not encrypted back then, so this was probably still in the days of transparent proxies, so OP could have "just" added one with some ARP spoofing. They were somewhat common in school and office networks, and like regular HTTP proxies (except the transparent ones had the traffic redirected forcefully to them) they essentially consumed HTTP requests and sent new ones out to The Internet. While mostly used for caching and blocking, it seems relatively simple to me that OP could have just replaced e.g. some stylesheets served back to the client.