It completely ruined my respect for authority figures. Which in retrospect has been the most valuable outcome from being the local “that kid from Wargames”
Even being in the tech capital of the world, the school administration's views on technology and information access were so backwards. Our school basically didn't allow accessing any websites that weren't on some allowlist. Teachers had accounts to bypass the content filter.
We had a game design class that happened after school. Usually that period was reserved for making up classes you failed, but ROP courses that didn't align with the district's curriculum goals were taught as well.
Needless to say, pretty much every resource we needed was blocked. So the teacher would give out his content filter bypass credentials, because the school wouldn't entertain any exceptions to students not being allowed to have them even though they knew there were classes on campus that would have tremendous difficulty. A couple of times a student would leak the credentials to others on campus and it'd take all of 5 minutes to get to everyone on campus via social media.
They'd always treat everyone who knew the bypass accounts as "guilty unless proven otherwise". I ended up in detention a few times for even knowing it. Parents complained to the school a bunch, school just always blanket said "bypassing the content filter as a student is against policy for any reason. No exceptions."
Makes me think back to 1st grade in 1999 when I was first given internet access and being told not to use Google because "it wasn't safe". Couldn't have been that bad because it took another half decade for me to inadvertently end up on the "adult" part of the internet.
[1] this pdf appears to lend credence to that idea(no affiliation). https://www.kvcc.edu/pdfs/MyItLab/myitlab_BestPractices_Home...
Our school was Windows land as well. They blocked execution of certain programs by some policy in Windows explorer in Windows XP (they had never adopted Vista, and 7 was still "too new"). Funny thing was, if you knew the path to them, you could just point Firefox or Chrome at a file:// URI and run it out of your downloads directory. Oops.
There was also that time I got detention for riding my bike in the school parking lot. Which was dumb, because I always showed up 30+ minutes before any cars did because I made a deal with the sculpting teacher that I wouldn't have to do sculpting if I showed up early to class and learned about the chemistry of clay glazes along with helping him mix them for class, which was honestly far more interesting to me.
Our AP Chemistry teacher was a nuclear engineering postdoc from MIT who spent her entire career helping clean up after US military nuclear accidents.
High school was a weird time. It just boggles my mind still to this day to have a school staffed by some wonderfully brilliant teachers and have an administration that seemed to lived in fear of a student body who dared learn something or learn from someone they didn't approve of.
Microsoft security baffles me. You could run Windows Update in the browser (and also antiviruses using ActiveX). Who would think of making it possible to alter the OS… from the browser?
My school disabled right click in Windows Explorer, I'm still not sure why.
Of course, despite every PC being on a domain, there was still the local administrator account, which was easily obtained by leaving an unused computer running ophcrack overnight. Eventually I found out that the roaming network administrator account password was simply ford, as the admin left a local account on a computer that wasn't networked; this pretty much lasted me through high school. For bypassing the firewalls? That was simple; I got a free shell account, and later my own server, an early openvz vps.
Once I got my own server, I spent long amounts of time trying to increase the amount of RAM available to me (since it was fair-share CPU on a decent server, building and similar jobs ran far faster than my current digital ocean VPS). At this point, I found out about sshfs on my own computer, and spent ages trying to find a decently cheap Xen VPS so I could use kernel modules for sshfs and swap. Eventually, I gave up. One period of my last semester I was a TA, rarely with any work to do, so I spent most of my time on IRC and setting the wallpaper to be Cyanide & Happiness comics.
/me trouts Piper around a bit with a large slap
1: this used to be available at https://bitbucket.org/cryptw/fontloader but not anymore. This might be the source, not sure. https://github.com/stevenstrike/FontLoader
That sounds very big tech to me, exactly the model towards which Facebook et al. are moving.
"Even if I color in the lines, or intentionally dabble in creative thinking, some adult might yell at me... Hm. I don't need their permissions. They obviously don't see how great I am so they are a dumb nuisance."
He was a good friend because he kept silent about the fact that I was the one doing it ;)
Back then, everything really felt like magic.
Old netsend trick, pre windows xp SP2.
There were enough stories at this time online that I knew it was best to say nothing. Did nothing bad, just explored, learned quite a few things and well was surprised how really easy it was to do things.
Nowadays, I feel kids won't/don't get that chance to explore - which is sad. Internet is curated through apps and "enagement" user experience and cloud services/SAAS.
Maybe they can spot a lifetime link to a google sheets master password document. ;)
I was banned from the computer lab for the whole of my secondary school years. It didn't matter though, because when I was 12 (~1989) the headmaster dropped computing from the school curriculum as "computers are a passing fad". They just used the computers for typing up essays after that.
That reminds me of the Decca record label executives rejecting the Beatles in 1962 because “guitar groups are on the way out”.
Picking up a copy of The Wall Street Journal at any point in the previous ten years could have clearly indicated that... and any school at which there's a "headmaster"... I would expect the WSJ is not a foreign entity to them.
It looks like they realised they were out of their depth and found someone who could help. Were they wrong to trust you?
Edit: I may have misunderstood your post. Did you mean:
A. The principal and the music teacher asked you to help out a few times because they knew you were skilled
B. You were always the first suspect when anything went wrong
I understood it as A. If so I really don't see how you'd lose respect for them over that.
The "admin" person calling you for the former? Pretty cool. The principal calling you to their office for the latter? It really does say weird things about authority figures to a kid who's paying attention, especially when mixed with the cluelessness about security.
It sounds like they were right to trust you? Doesn't sound like you ever did anything bad with admin credentials. And you even used it to fix stuff.
So, Costco runs AS/400 in stores, and their online store is in .Net MVC. I worked with both technologies and often have to communicate with AS/400 devs and they are close to their retirement so little fucks are given. Plus, working with DB2 is annoying in general, the .NET data provider from IBM is expensive and sucks.
Now onto the bug, when you purchased items online at a discount, you were able to return to store at a full price as their systems were not communicating that a discount was applied. I returned several items, but did not realize until I bought a laptop that was $400 off and tried returning it. I ended up calling Costco and letting them know. Unfortunately, they didn't give me any lifetime membership or a good citizen award.
If any Costco devs read this and know about this send me some love.
I bought some lions mane mushrooms from a grocery store, which cost $10-12 per lbs. The cashier rang them up as "regular" (button) mushrooms at $2 per lbs. I pointed out the mistake and she tried to correct it but chose the button mushroom again. I brought it up a second time and she selected a different incorrect mushroom at a slight increase ($4/lb?). At that point, I gave up. She's the one ringing it up. I tried.
Did I steal something? Did the cashier give me something for free? Who is responsible? What if I didn't notice the $100 charge absent from the bill? What if I was charged twice as much? What if I told the cashier and they did nothing?
What turns something into a crime, in your eyes?
I certainly don't think I stole anything, nor do I think OP stole anything.
The different between this and the contrived shit you posted is knowing you didn’t pay and walking out of the store in the first place. There isn’t really any subtly here.
It might still be theft (or fraud or some related charge), but only if those laws create a strict liability crime out of keeping something that you know was given to you by mistake. I'm not sure but I think there might be specific laws to that effect if you knowingly take advantage of a bank's mistake. Whether there's a similar law in general, probably depends on where you live.
In the pure theft case, there's no intervening act by a store employee. It requires criminal intent.
The argument that if the customer knew, it's theft, applies equally to cases where the product is rung up incorrectly, which several other people in this thread have claimed to have witnessed. I guess we're all thieves now. I've been overcharged and undercharged at stores.
Also even if the intervening act by the store employee doesn't matter, it would be impossible to prosecute. They'd have to show that the customer knew the checkout person missed the item. How would they do that? Interrogating people you live with to find out if you mentioned it to them? No, they don't have access to admissions on HN years later.
Yes there is, they have cameras and people who can frisk at the doors. I don’t think you want to go down the path of “if there was some action an employee could have taken to stop it, it’s not theft”.
> No, they don't have access to admissions on HN years later.
“They can’t prove it” is not an argument that something isn’t theft. You can go through whatever mental gymnastics you want to go over how difficult it will be to legally prove theft for prosecution, but it doesn’t change what it morally is at all.
I'm not even sure this is relevant. We're not talking about a cashier returning too much change. In this scenario, there is nothing to not balance. The item wasn't scanned, isn't on a receipt, was simply given away. The balance in the till is still correct.
Retail stores change pricing on products and fail to update pricing on the shelf all the time. Home Depot, Walmart, etc have interactions like what OP described occur every day.
The responsibility rests with the corporation to train and reward employee behavior.
If the company has chosen to staff their store with someone that doesn't give a fuck (underpaid, poorly treated, mismanaged, improperly trained, not well rested, etc), then that is a gamble they chose to take, and the last thing I am going to do is rock their boat when they built and arranged it this way.
As for my thinking, it was impulsive, I was a fresh grad and didn't have much money, I was upset about the price, I thought the cashier was being rude by completely ignoring me. I felt like I attempted to engage with the process of buying the cable in the correct way and the process broke down in my favor. I was not going to go out of my way to fix it.
Again, none of that makes it the right thing to do. I wouldn't have considered walking in and stuffing it into my pocket, but feeling like I did my best I shrugged my shoulders and went on with my day.
Can you walk me through the thinking of "corps fuck me over and I should be thankful"?
When I got home later that day I excitedly shared with my parents the new hack I had learned and they told me it was wrong because it was stealing. I had been so taken with the neatness of the scheme I did not register its immorality.
Funny enough, my grandmother told me about a version of this scam, but as a prank. Get some roadkill, put it in a sealed bag. Put that bag in a box. Mail it the slowest way possible to a far away address that doesn't exist. Put your target's address for the Return Address. Be sure to do it in summer. By the time it gets to them... yuck.
Nana, you were weird. But still miss you.
But there's no way to allow those while preventing abuse, so I can't imagine what good options they have other than to reject and trash those pieces of mail (since they have no way to return them). I guess they probably allow them and eat the losses due to abuse?
I would expect that history to include a price, but I guess it doesn't.
I like how you shared how you learned lesson to not share mischievous activities with people in the same post you then go and share more things you haven't been caught for.
This is going on your permanent school record! /s
That's great. I know even as of recent of 2021 I've seen some places that had 0 security on things.
American public schools are quite adept at teaching distrust in authority, particularly in bureaucrats. That doesn't mean distrust in everybody.
It's an important lesson to teach kids while they're young! Strange, though, how you never see it on the formal curriculum.
Unfortunately, they end up learning a different sort of hidden lesson.
In k12, while it's not really meaningful, It's still an extracurricular activity, and at the same time it shows that you can work with others (theoretically) and that people like you enough to put you there.
Unless you're in an anime. The student council in anime not only has power in the school, but outside political and military power besides.
Nope.
> and that people like you enough to put you there.
This. This is all it shows.
I wonder to what extent that property is primarily due to them being schools, or primarily due to them being public, or primarily due to them being American, or is it some combination of the three?
My own impression (having experienced both as a child) is that private schools are less prone to bureaucratic inflexibility than public ones, which is one of the reasons why my wife & I have chosen private schooling for our children. But, not the US, so our experiences may not be directly comparable.
> Oh well, 2 week suspension and kicked off the computers for less than a year. A nice conference with FBI, police, my parents, IT and school administration. Fun times.
Something that most would believe as non-malicious and just for the lolz received a (what I personally think is) heavy punishment. So as a kid you learn to just keep that to yourself because you don't know if you'll get a "oh thanks for telling us" or a "you're expelled". Its not explicitly said to distrust but you learn from experience.
I wouldn't have told the school of a theft I witnessed even if I knew there were cameras recording the entire thing. You're guilty unless you can prove someone else was more guilty and they're not really concerned about the truth of the matter so they're not trying to help you.
A few years later, I cracked the admin password (with a Ophcrack live USB) for a silly reason: they had the machines mostly locked down, and I wanted to change the desktop background hahah. I remember being quite disappointed in the sysadmins that the admin password for all the machines in school was a common dictionary word, cracked in 30 seconds.
Oh, once I met a guy who identified as a "hacker" (in the sense of breaking into systems illegally) and he told me (then a young teen) to "have my fun" before I turned 18 and then to stop, which in retrospect was very good advice.
I was one of the first normal citizens to get dsl internet. I opened windows explorer, and saw all the hospitals and doctors office network folder shares, with patient data.
Yeah, big telecom internet company too.
With all due respect for HN policy of nuanced, Intelligent debate.
"Wimp"
Wimping out is par for the course.
At my university in the early 90s I went the white hat route and had tons of fun. I managed to convince the computing center folks to give me a student job in the Unix group, and then spent the next three years hacking their systems and getting a pat on the back when I did it.
I also figured out how to auto-crawl the networks of all the schools in our district, which, as a self 15 year old whose only experience was non-networked DOS, is still a proud accomplishment. The only things I found were a bunch of printer management, some office form templates, and a cool video game that was like sim-moonbase.
But then my teacher found the file in my home dir called passwords.txt, and I was busted. Oh well. Instead of an FBI file, I got a detention, and I had to teach him how to write-protect the boot floppies so no one else could do what I had. (he didn't need to know that you could reverse the write-protection with a piece of electrical tape)
> Oh well, 2 week suspension
God damn, these idiot school people have no fucking clue that someone who points out a security flaw to you without inflicting any harm is actually doing something good, and that behavior should be encouraged and rewarded.
"We're bug bounties for America's school districts: HackerOne for the K12 market. The product is free if you let our corporate partners, who also fund the bounties, recruit the winners."
He gave the reason why, fragile ego.
At my first high school I was expelled for selling teachers a boot floppy that disabled the district's security software (Fortress) on their machine.
At my second high school I was busted twice, once for selling CDs with a much anticipated unreleased movie, and the second time for finding (and copying) a network share that had every student's school photo from that year before they could even purchase it.
Nevermind all the unsavory nonsense I did outside of school and was luckily never busted for.
If anyone else reading can learn vicariously, this line is almost universally true and manifests itself in a multitude of ways.
I had no idea what I had done, honestly, I just sent a large ping packet to some IRC-user. Turns out it killed some vital things in the network.
Also the admin leaving anonymous FTP enabled with write access. That was one weekend with an extreme amount of illegal stuff apparently uploaded via the schools FTP, but that was my classmate which was involved in and not me.
This was at the time when people had dial-up at home so the 256kBps connection at school was awesome.
If it were me, for the second time I would have considered adding a file to everyone’s FTP account (including the admins & professors themselves) explaining how they too can escalate to root.
Well, being at a DOS prompt was enough circumstantial evidence for me to get suspended for a week (no FBI record, AFAIK). My parents, despite being strict, were also fair and asked me point blank, "Did you have anything to do with what you're being accused of?". Told them no, I was just at a DOS prompt (probably to play either nibbles or gorillas - those classic BASIC games). To their credit, their opinion was if I was going to serve the time, I might as well know how to do the crime (know, not actually do). I had already been tagging along to continuing education computer classes my mom was attending, but my parents started buying me more and more computer books. It got me started down the programming path. I'd already been pretty friendly with our sysadmin at school and he knew I had nothing to do with what happened and hadn't accused me, but the school needed a scape goat, and I was it. He felt bad for me and choose to help me out with my learning, too, instead of continuing the punishment. He gave me a copy of the software he used for after hours remote access over direct dialup. Think it was called Carbon Copy? It was basically just telnet over dialup that allowed me direct access to his PC on the network after hours before I even knew what telnet was. So, I'd connect after dinner and play around for hours as network admin. It wasn't multiprocessed, so I had to be patient. Typically when I'd log in, he was running a nightly backup manually that he'd kick off before he left for the night. I just had to wait for it to complete, then I could do whatever I wanted. I had full access to the grading/attendance system. I could message teachers as other teachers, etc. I could have granted admin access to anyone, but I was smart enough to never touch my own account, instead, created fake admin users and used those, instead. I'd hide files in plain sight using the ALT+255 trick to embed a nonprintable character in file/directory names. You could see them, you just couldn't directly access them without renaming them for most programs. Fun times. I never did anything destructive, though I could have easily.
Security in the 90s was a joke. They were good times, indeed :)
I continued my shenanigans into college. College was my first encounter with Windows NT networks & l0phtcrack. I remember one night, walking into my dorm room with the SAM file from a lab PC on a floppy. I popped it into my own PC, started cracking the passwords, expecting it to run all night. As I got up from my PC to head down for dinner, I was surprised to see that I'd already cracked the administrator password. It was just a 5 character password that was the building code & room number for campus IT. I already knew better than to do anything from my own PC, only ever worked from different lab PCs in different buildings and under assumed accounts. Never reported anything, either, for fear of reprisal.
Yip, ego's and people talk are the downfall of many an innocent `self-education` in the area of IT security.
Post 80's and laws started to change, prior, in the UK it was theft of electricity being the only way to nail some people. Crazy fun times.
Though I do miss the old phone system per-say, outdials, wardialing, things like that, was common with many and just seemed more mysterious as you could only learn thru word of mouth or self-education as no books or internets and BBS's were not as cheap in the UK or common as we never had the official free local calls aspect as you fine folks had in the US.
Do recall a chap getting kicked out of college for doing something I'd done previously, just that he had a bigger ego and not as delicate with the power to steal the admin password. Which involved an ICL George 3 OS mainframe in the times of very large disc platters and admin console journaling that had no encryption. so they rotated discs without adding extra wear of zeroing the previous content, only the file table so you could end up with a user disc platter that had formally been used as a admin console jounal reposatory and could create files without zeroing and dump the previous contents of the disc of that way...which eventually got you the admin password.
Do recall few instances of work related cases in which I needed to do things so, kinda hacked what I needed (resourcefulness) like upon a DPS7 Honeywell mini computer in which needed the admin password to do something and nobody had it at hand at that time of night and the passowrds were kept in a file that was encrypted so I worked out the encryption key by looking at the file as was poor encryption and text files have lots of spaces so saw a pattern with the word OPERA in and tried and tada, got what I needed. The spooked admin next day wondered how I did it so I told him fully, he then went and redid the encryption and challenged me to see if that was secure, I looked at the encrypted file and kinda worked out by the patterning that it had been encrypted twice....yes with the same password OPERA only encrypted with that and then encrypted again with the same. Educational for all back then. Today, not as easy to do that, but still a great story of times of old.
My ego prevents anything else and was an ethical hacker and the 90's was an era in which, we white hats would and was the internet security, bringing down pedo's and bad actors like that that frequented some platforms with ease (looking at you AOL). So whilst illegal per-say, was case of no real official policing of such things as we do today.
But darn, some things learned and worked out, well zero day exploits back then were not as financially economical as they are today and heck, and some never really appreciated how long they would stay obscured from the wild.
I also liked hardware back then, was also fun and many a hidden switch to get a feature you would normally pay silly money for some engineer to `install` though was just some hidden switch was not that uncommon. Heck even today you get kit that is same inside with a model up just adding some small thing and example would be some Fluke multimeters that you effectively pay hundred for a small capacitor and another digit on the outer shell, is a good example current today.
Fun times indeed, but darn, goalposts always moving.
Very fancy, everyone was using elm and you got pine.
Could you please explain what this means? Googling didn't reveal much.
Eventually, shadow passwords were introduced to have the passwords themselves stored in another place with stricter access rights (readable only by the sysadmin or their group), so even the hashed versions were inaccessible to normal souls, whereas other information traditionally kept in /etc/passwd - e.g. the user's full name - could and can still be retrieved from that file by making it widely readable - just without the passwords, which were moved to the "shadows".
See also https://en.wikipedia.org/wiki/Passwd, section "Shadow file" for more details.
Maybe I read Plato around the same time as I heard of it and that biased my thinking.
An classic UNIX /etc/passwd file is readable by all local users and in the past used to contain the password hashes. One can download these hashes and crack the passwords offline. At some point the problem was recognized and password hashes were moved to special /etc/shadow file which is accessible only to root and members of shadow group making /etc/passwd useless for extracting passwords.
Oh well, 2 week suspension and kicked off the computers for less than a year. A nice conference with FBI, police, my parents, IT and school administration. Fun times.
I learned my lesson to not talk about such things because their egoes were too fragile.
When they decided to give students in their website design class ftp accounts on the district wide web/email server running an ancient version of Debian, they didn't disable the shell, just added a login script to a menu for pine, etc. for people who telnetted in, which I'm sure the sysadmin was proud of. However, a few fast CTRL-C's broke out of his script menu loop and got me a shell, and they didn't shadow protect their password files. Ran it through john the ripper and had half the district's e-mail passwords in a default dictionary file including the root pw in a few minutes. LOLed and never told anyone about that.
Good times, the 90s....