Obligatory this happened 9 years ago but I still think about it every day.
It's a long one so buckle up.
(Apologies about the grammar and such, writing is not my forte.)
Me: $D
Friend/Co-Conspirator: $F
This story starts with me, a 'quiet but well liked throughout the school' 17 year old in IT class at my High School in a large suburban, two city public school district. We had one of the best high school IT programs in the country at the time for many reasons. Part of our class (of about 35) involved us going around the school to do basic maintenance on school computers. Although with the exception of myself and $F, our class never touched staff computers.
Myself and $F were the two students always finishing our two week classwork cycle in about two days. So we were always tasked by our IT Teacher with helping the school IT guy (district employee stationed at the school in the IT lab) to go around and fix issues throughout the building while everyone else worked on their classwork. Often, we were loaned the IT guy's keys and district keycard to go around the school and take care of business. (This is important later) Over time, myself and $F became well known by staff around the school for being able to fix "anything" so we eventually gained a lot of trust from our IT Teacher and District IT guy. To the point that we knew passwords we ABOSOUTELY should not have known.
We knew everything from the password to the surveillance system to the master (domain admin) password district IT used to access everything from HR files to grades to mechanical systems. This password literally let us access anything on any computer in the entire district. And before you ask, yes all buildings in the district (including admin) were linked together and no they weren't firewalled off from each other. Now we never used our powers maliciously as we loved our school and never would've done anything to harm anyone or damage any systems.
One day I thought to myself "wow, Information Security (InfoSec) in this district is atrocious, I wonder how easy it would be to test it from a student perspective, then present my findings to the district IT guy". This, would be the beginning of the biggest fuck up of my life.
(I'll try to keep the technical stuff to a minimum)
My mission started one day when I was tasked to grab a computer from a classroom and bring it to the lab. Easy enough. I was given IT guy's 35+ keys and sent off. While walking to the room, I dropped the ring, it took me a minute to find the right key on the ring. When I found it, since I was looking bit harder than usual at each key, I noticed something peculiar about the key he used to open doors inside the school. It was stamped DGM and looked different than the usual *M stamp master key for this one high school building. Not seeing this abbreviation before, I thought, "ok this must be an important key since it works like a school master but looks different".
I opened the (empty) classroom, fired up a locksmithing app on my phone and took a digital impression of the key that gave me the bitting code so I could duplicate it later on, grabbed the computer, went back to the lab and gave the keys back. Curious about what this DGM stamp meant, I started googling on my phone, "DGM [Key Manufacturer]". It came up with GM as "Grand Master", the key above the master key. Nothing with DGM came up in the search. I thought "ok this is just the "grand master" key that opens all three buildings on the school property, NBD. (Main School, Theater, and Aux Gym buildings)
"Ok. but what does that D in DGM stand for? Nothing in the school district starts with a D, except... District. Holy shit, it must mean "District Grand Master. But they can't be stupid enough to make one key that opens doors in all 15 schools. Right?"
I get home and order a key duplicate on the website that built that locksmithing app. A week later it shows up and I bring it to school. Before gym class I tried it on one of the doors in the Aux gym and low and behold, it worked. Great! Part one of my test plan is complete. Someone with this key could cause a lot of damage if they wanted to, but how would they get past the alarm systems in each building? Because it would be difficult to discreetly do a lot of damage if the building was full of people. Naturally someone with ill intensions would carry out their act at night while the building alarms are armed.
I already knew that the alarm systems were controlled by keycards that every staff member in the district had. (It was an antiquated system with flaws known to the IT world) Their cards only worked for the buildings they worked in. So the cards, electric doors, and alarms must be controlled at the school level, not at the district admin office. Right?
So how was I going to get a hold of a keycard long enough to scan and duplicate it onto a new card? It required a laptop and a special piece of equipment that I couldn't just bring to school while everyone was there. I thought "I can't access the security system and lookup badge codes with the IT master password I know, that defeats the whole purpose of this test. Where's the next vulnerability in this system?" Then I realized, there's a gate to the staff parking lot that's opened with keycards, but not their district cards, they had separate cards for the gate. I scanned the entire network for this gate controller, but couldn't find it anywhere. "Good Job school district, leaving your gate system closed circuit. It's inconvenient to program, but definitely more secure."
Okay, so where is this gate controller located? I've got a district master key so when I find it, I can access it locally. I look at the gate itself and see a freshly paved line in the concrete leading from the gate motor to the Aux Gym. "Okay, its somewhere in the Aux Gym."
I wait until Saturday during Football practice, the Aux Gym is disarmed and the front door is open. Everyone's out on the field so no one will see me enter the building. "Hey there's a closet by the front door I'll try this one first." There it fucking is. The gate controller is mounted on the wall. I open up the panel and attach my laptop. "Fuck there's a password, what could it be? It's not going to be the master password, this isn't connected to the network." I look at the circuit board, there's a label with "admin - (name of city school is located in)". Unbelievable, that's the login. "District IT People are paid six-figures to make this shit up? Seriously?"
I accessed the swipe log and I noticed an interesting trend. Half the time someone swipes into the parking lot, there's an access denial that immediately precedes a valid gate card swipe. "They must be swiping their district cards first instead of the gate card!" Lucky for me, this system records badge numbers when access is denied. So I had access to several district keycard codes, protected by a password that is the name of our city. Wonderful. I sift through the logs and notice the names of three district janitors, all three with the preceding access denied messages and codes, followed by their valid gate cards. I remembered these people from my previous schools, so their district cards must open multiple buildings. (Remember when I mentioned that district buildings weren't firewalled off from each other on the network?)
I took one of the codes and encoded it onto a blank keycard with that special piece of equipment that cost me $20 on eBay, walked out the front door and scanned the card. I heard a loud click and the reader light turned green. Holy shit, I now have a DGM key and a keycard that disarms EVERY school alarm system in the district. Nothing is off limits to me. Part 2 complete.
I call up my friend $F who somewhat knew what I was doing, and once nighttime rolled around, we decided to visit almost every school in the district. Just to see if it actually worked. And boy it did. We easily swiped into each school, the alarm automatically disarmed, and the DGM key opened every door in every building we visited. I found myself thinking "Good Lord, security here is even more atrocious than I thought". We had the decency to rearm each building before we left and once we were done, we planned on telling the IT guy on monday when we went to class.
Well, my dumbass decided to try one more school the next day (Sunday Morning), I swiped in and within 10 seconds, the (middle school) principal walked through the door and asked "Who are you?" I could've bolted out the front door, but I wanted to be honest because they were gonna find out on monday anyways. So I told him who I was and what I was doing (very short version).
He took me to his office and had me sit down while he made a phone call. It was someone at the district office. All I heard him say was "I can't distinguish this from my own badge, its a perfect copy but it has his name and photo on it". He hangs up. Asks me more questions and it eventually leads to the DGM key. This especially panics him because he knew what it was but didn't know anyone other than the District Ops manager that had one. He makes another phone call, "This is (principal name) at (middle school) I need someone to come down here now." I'm thinking "Okay, someone from the district will be here to ask more questions, cool."
Boy was I wrong, within a few minutes about six police officers show up and start asking me questions. I'm honest, I tell them my plan and what I did. They all looked utterly confused by the end of my short explanation. They took the keycards and DGM key and asked me to call my parents to pick me up. They search my car and find pot in the trunk (oops). So there's a charge right there. They said they'll notify us later once they talk to the district and I was released into my dad's custody.
A few hours later, my mom gets a phone call from $VP saying I'm not to attend school monday and we will have a meeting that evening at the high school. "Okay, understandable. I haven't been able to explain myself. They're playing it safe."
Whoops wrong again!
IT Teacher: $ITT
District IT Director: $ITLady
Vice Principal: $VP
Cops: $PD
We arrive at the school for the meeting, my IT teacher is sitting in the school office with a disappointed yet very proud look on his face. As we arrived we were called into the conference room, I expected it to be just $VP, lmao no. It was $VP, two cops, and some random district official. My IT teacher was there just to translate the technical terms. I explain my whole plan, being interrupted many times by everyone to ask their questions. At one point $VP says "Jesus $ITT you're not supposed to be teaching this stuff!"
$ITT: $VP, Do you realize the amount of critical thinking and work that went into this project?"
Well, after he says this, there's a knock on the door. "$VP, $ITLady is here"
"Random district official" leaves and $ITLady enters and sits down in front of me"
$VP: $M this is $ITLady, the District Director of IT. She has some questions for you.
$M: Ok
She proceeds to tear into me, asking "WHAT DID YOU BREAK, WHAT DID YOU HACK?!" I could literally see the veins popping out of her head. She was pissed the fuck off.
She couldn't accept that a bored teenage kid that just wanted to see if this was possible, was able to compromise her systems in one week. At one point the officers asked her to leave the room and take a break because she was getting so worked up.
Fast forward to after the meeting, the police took myself, my mom, $VP, and $ITT to my house and seized all of my electronic equipment. Everything from my cell phone, to my laptop, to my WiFi adapter and everything in between. My favorite part was when they were searching my computer bag. The police officer opened it, rummaged around for a bit, taking everything electronic out, then gently and over dramatically pulling a strand of condom wrappers out in front of everybody.
$Mom: *Glares at me* Previously not knowing I was having sex at 17
$Mom's new BF: *Leaves room immediately*
$Cops: *Looks at $VP not sure what to do*
$ITT: *Gently facepalms*
$M: Thinking "Fuck, this is bad"
$VP: *staring at the cops for about five seconds* "Okay well let's move on"
They all leave after seizing basically everything I own.
Fast forward to a few days later, I get a letter from the district saying I have been suspended pending expulsion. Great.
We attend the expulsion hearing, I say exactly what I said in the first meeting with $VP and the cops.
Get another letter two days later, I'm expelled. We appeal to the school board and the district's lawyers. They don't want to hear any of it. Appeal denied. They're pressing full charges. Okay I didn't know what the charges were but they were pressing them. Cool, great.
Two months later I meet with county Juvenile, I again explain to them my story, they're just as confused as the district people but my Juvenile rep is taken back by my calm demeanor and willingness to share all the details. By this point the district has done a through investigation and found no evidence that I stole or caused damage to property or their computer networks. They then Inform me I'm being charged with:
-- 9 counts of Felony Burglary 2
-- 3 counts of Class A Misdemeanor Computer Crime
-- 3 Counts of Class A Identity Theft
-- 1 Count of Poss. Controlled Substance on School Grounds
I'm also ordered not to use any electronic devices until I see the judge. This included something as simple as a TV remote.
Fuck Me
I have a few more meetings with the County Juvenile rep, she was actually a very nice person and was surprised I was assigned to her in the first place because she usually got the murders and rapists. She got to know me and my true intensions with the entire plan over the next month.
Before my first hearing, she (the county) recommended to the school district not to press charges. They felt this could be remedied in-district, since while crimes were committed, I wasn't aware of the crimes and there was obviously no bad intent.
During the hearing, my Juvenile rep and shitty court appointed lawyer explained my side and the district lawyer explained theirs. The judge was extremely confused by the whole situation, saying "we've never seen a case like this before, at this point I don't know how to proceed" The DA also looked equally as confused.
Judge asked the district's lawyer: "How do you want to proceed?"
Lawyer: We'll take this under further review
Judge: $M expect a call from your Juvenile rep this week. Adjourned.
Three days later, we receive a call from Juvenile. The district is pursuing all charges and wants $80,000 in restitution for a new district security system. Wonderful news.
I live in a constant state of panic for the next three months while waiting for the next court date. I end up going to the district's alternate school for a while while attending twice weekly meetings at juvenile.
Went a few more times in front of the judge, my lawyer, Juvenile, and district lawyers doing all the talking, explaining the entire case to the judge. The district still insisting I stole and damaged district property even though I never did and they ever found any evidence.
About seven months into this, the Judge had enough. She didn't want to hear anything more and was going to issue my disposition (ruling) at the next hearing.
She explained that $80,000 in restitution was ludicrous and the district was going to pay for their own security upgrades if they chose to.
She then looked at me and asked me to rise.
Judge: "I have three options here Mr. $M"
"Option 1, I dismiss all of the charges and we'll be done here
Option 2: I drop the marijuana charge, reduce all other Charges to Attempted (Misdemeanors), and sentence you to one year bench probation
Option 3: I send you to jail right now"
I almost lost it right there.
Judge: "Based on what I've heard from our Juvenile rep and read in the police reports, I'd like to go with Option 1 and dismiss the charges. But because of the sheer severity of the crimes on paper, I am unable to do that. So I am going with Option 2. I hereby sentence you to one year of bench probation and order you to pay restitution in the amount of $3,200 for district staff overtime. Good luck Mr. $M."
I don't remember what was said after that because I was so relieved I almost passed out.
After three months of thinking I was going to prison for 20 years, it was all over. I was numb for the rest of the day.
All in all, The whole experience only left me with severe depression and anxiety for a few years but hey I'm not in prison. Great, right?
Actually it ended up better than I thought. I ended up graduating from the alternate school's accelerated graduation program shortly after that. (The district wanted me out of their hair ASAP)
I received a full diploma from my regular High School at the end of my junior year. I got to essentially skip most of my junior and all of my senior year of HS. Ended up working my ass off and got a great IT job at a company I still work for today. And now I have IT Director as my title.
And that is how I royally fucked up by shaming the fuck out of my school district
Shove it $ITLady!
TL;DR I exploited security flaws in my school district's security system. They got royally pissed and tried to send me to prison. Instead the judge gave me a slap on the wrist and I graduated a year an a half early. Now have a great job in IT.
Edit: Some amount of proof that this isn't fake because I forgot people on the internet are asses
Edit2: random internet people, while yes, this story is extremely dumb and sounds extremely false, I swear on my life this story is 100% true. For the techies, I intentionally left out some details because they're boring to most people. If you have a question just ask.
[link] [comments]
No comments:
Post a Comment