iGeneration

Charlie Osborne
Home / News & Blogs / iGeneration

4chan students hack district schools; Changed grades and $9,000 meals

By | March 9, 2011, 9:18am PST

Summary: 4chan hackers accessed a New Jersey school district’s student data system, and changed grades and meal prices to $9,000, all in aid of a good laugh.

Students managed to gain access to their school data system and change their grades, after the username and password of the school data system was published on 4chan.

The username “admin” along with the password, now changed, “poopnugget”, allowed students to access the data system in the New Jersey school district to change their grades and other district wide settings.

One user took advantage by changing the school lunch prices to $9,000 and another changed the grading system so it only took 1 credit to graduate.

One of the hackers also accessed the emergency notification system, designed to send out text messages to students, staff and parents.

It didn’t take long before what is presumed someone with a moral conscience contacted the school or changed the password to prevent any further harm.

But with dozens of schools connected to the same system, havoc could have easily been wreaked across the entire district.

It wouldn’t surprise me to find the day after being classified as a ’snow day’.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “iGeneration”

Topics

School Data System, Zack Whittaker

Zack Whittaker, a criminologist who studied at the University of Kent, Canterbury, is a journalist, writer and broadcaster.

Disclosure

Zack Whittaker

I worked briefly with Microsoft UK in 2006 but no longer have any connection with the company. Regardless, I remain impartial and unbiased in my views.

I don't hold any stock or shares, investments or industrial secrets in any company, but have signed confidentiality agreements with a number of UK and U.S. organisations, whose names I am not at liberty to disclose.

I was involved with Kent Union, the University of Kent's student union, undertaking voluntary, non-salaried, elected positions between early 2009 and mid-2010.

No other company, body, government department, non-governmental organisation or third sector organisation employs me or pays me a salary in any capacity whatsoever.

As a freelance journalist, whenever expenses are given and taken by a company that is not CBS Interactive, these will be disclosed in each relevant post to ensure transparency.

I currently work with a UK law enforcement unit, but this is an entirely separate position which bears no connection to other work.

(Updated: 23rd October 2011)

Biography

Zack Whittaker

Zack Whittaker, criminologist who studied at the University of Kent, UK, is a journalist, writer and broadcaster.

After studying criminology at university, though still in his early-20's, he has already had a series unconventional work and voluntary positions. He has worked with researchers studying neurological illnesses like Tourette's syndrome (which he suffers from), has given lectures on the nature of disabilities in the public community, and occasionally ends up speaking on television and radio discussing the events of the day.

He first had academic work published at the age of 22, then still an undergraduate, and has been cited by a wide range of publications: from the Huffington Post, Business Insider, AllThingsDigital, The Atlantic Wire and CBS News.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
Ask a Question Start a Discussion
30
Comments
Add Your Opinion

Join the conversation!

Just In

RE: 4chan students hack district schools; Changed grades and $9,000 meals
bsltiger 10th Mar 2011
I am disappointed that 4chan users weren't smart enough to make it $9,001...
View in thread
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
Real World 9th Mar 2011
I wouldn't call this "hacking". Depending on how the credentials were obtained, it could be social engineering, but there was no skill required to pull this off.
0 Votes
+ -
Contributr
RE: 4chan students hack district schools; Changed grades and $9,000 meals
zwhittaker 9th Mar 2011
@Real World Hacking is the unauthorised access of a computer system. Hacking is hacking.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
Aerowind 9th Mar 2011
@zwhittaker By your definition, sitting down at someone's computer with their facebook logged in is hacking their facebook.
0 Votes
+ -
Contributr
RE: 4chan students hack district schools; Changed grades and $9,000 meals
zwhittaker 9th Mar 2011
@Aerowind I'd say so.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
Joe_Wulf@... 9th Mar 2011
@zwhittaker 'Hacking' is a term for those revered for their good deeds in being technically computer saavy and ethical in their adept application to solve real-world problems. CRIMINALS act without authorization in their access, theft and maliciousness on OUR computers and/or OUR data.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
Real World 9th Mar 2011
@zwhittaker
That's just sad. That term has been watered down to be almost meaningless if that is the case.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
tom@... 9th Mar 2011
@zwhittaker

http://www.wisegeek.com/what-is-computer-hacking.htm

According the the Geek.com technical dictionary:

"Cracker - This is the common term used to describe a malicious hacker. Crackers get into all kinds of mischief, including breaking or "cracking" copy protection on software programs, breaking into systems and causing harm, changing data, or stealing. Hackers regard crackers as a less educated group of individuals that cannot truly create their own work, and simply steal other people's work to cause mischief, or for personal gain."

"Hacker - This is someone that seeks to understand computer, phone or other systems strictly for the satisfaction of having that knowledge. Hackers wonder how things work, and have an incredible curiosity. Hackers will sometimes do questionable legal things, such as breaking into systems, but they generally will not cause harm once they break in. Contrast a hacker to the term cracker."


A hacker is a person who is proficient with computers and/or programming to an elite level where they know all of the in's and out's of a system. There is NO illegality involved with being a hacker.

A cracker is a hacker who uses their proficiency for personal gains outside of the law. EX: stealing data, changing bank accounts, distributing viruses etc.

What the hacker does with their knowledge of systems within the definition of the law is what defines them as a hacker vs a cracker. It's then safe to say that all crackers are hackers, but not all hackers are crackers. This is an important distinction.

The term cracker and hacker are used interchangeably (albeit incorrectly) largely due to the ignorance of the general populace, especially the media.


Note: There are comments associated with this question. See the discussion page to add to the conversation
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
2WiReD Updated - 10th Mar 2011
@zwhittaker oh never mind
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
dfreeman@... 9th Mar 2011
@Real World,
Gaining knowledge of a password by social engineering and then accessing the computer would be hacking. Gaining knowledge of a password by having that first person (who did the social engineering) give it to you is NOT hacking. Social Engineering is one of the aspects of hacking.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
Real World 9th Mar 2011
@dfreeman@...
Agreed
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
phatkat 9th Mar 2011
@Real World
Remember this person changed the password from something else to poopnugget so I think this is a hack. Who hacked it is the question now.
These 3rd party school automation systems appear to be not that secure since this not the only hack that has occurred on these systems.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
Aerowind 9th Mar 2011
@phatkat Where in here does it say the password was changed?
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
Real World 9th Mar 2011
@phatkat
And that's what I'm saying. If I leave my password on a post-it, you log in as me, do something, then change my password, you're a hacker? It just doesn't seem right to classify someone who does that with the same people who discover and exploit SQL injections, buffer overflows, etc.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
Jimster480 10th Mar 2011
@Real World The kids at 4chan didnt exploit anything. They were given the login.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
DaveN_MVP 9th Mar 2011
Well meaning but curious adults will "poke around" in computer networks given the chance, so I don't find it at all surprising that kids with such access would get into a little mischief or worse. I'm constantly amazed at the failure of school districts and similarly appealing targets to implement simple 2-factor authentication and one-time passwords. It seems like a lot of these bureaucracies rely on a lower level of security than a typical mom-and-pop insurance or real estate office.
0 Votes
+ -
Nice...
Nsaf 9th Mar 2011
@DaveN_MVP Go right ahead...now blame it on the school system. I guess, these students responsible kids were just trying to show school district a lesson?!!!
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
DaveN_MVP 9th Mar 2011
@Nsaf

I don't care who you blame it on - I'm not trying to justify anyone's behavior, just that it's the school district who end up living with the consequences. You've got locks on your doors, right? What about the fact that people simply shouldn't rob you? Why put effort into protecting yourself from someone else's behavior, when they should just be well behaved to begin with?

I can't control the behavior of criminals or naughty children. What I can do is evaluate and mitigate the risks I'm exposed to from those individuals. And when I have an opportunity to lessen a risk, and I choose not to, being able to blame the bad guy is a lot less comfort than never having had the problem to begin with.
0 Votes
+ -
Funding... or lack there of.
shryko 9th Mar 2011
@DaveN_MVP With public dollars on the line, I've often heard of schools getting budget cuts, or squeezes on their budgets...

...There's not a lot of room to buy a fancy security system, or do all the training for a paradyme shift...

Oh, and remember... the bureaucrats have to obey the demands of the political masters, who generally are not aware of security implications.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
tom@... 9th Mar 2011
@DaveN_MVP ... Yeah, the kids did nothing wrong because the school had the data on a computer, right? Their malicious actions are OK and fine with you? The victim is always responsible, right? I don't THINK so!
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
DaveN_MVP 9th Mar 2011
@tom@...

Tom, can you point out where I said I approved of their actions? I apologize for not making my point with sufficient clarity for you to understand it, but your moral indignation is not going to clean up the giant mess on the school's network. All I'm trying to say is that if the network had been better protected, they would have avoided this whole thing.

Some people are in charge of security, and others are in charge of mayhem. The weaker the security, the better the opportunity for mayhem. Criminals commit crimes, and you and I are ill equipped to change that - hence the need to protect ourselves against it with, among other things, security devices.

I'm sure the people whose network is hosed are very comforted to know that you don't approve of those who did it. And when it happens again, they'll be good and mad that the bad guys didn't listen better and learn their lesson.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
mgaul 9th Mar 2011
From an outside network/systems admin this is hilarious. I mean seriously "poopnugget" was the admin password???? This is a weak password, it doesn't even have a capital letter. No matter how the password was acquired, they needed a lesson of basic password security. A strong password is 8+ characters that includes alpha-numeric, caps and special characters.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
snoop0x7b 9th Mar 2011
What's ridiculous is the systems that they rely on to deal with student grades. My highschool way back when relied on software called "Lettergrade" which is unfortunately still around in a lot of locations.

Lettergrade sucks because it does not use https for authentication by default and has known outstanding security issues (Such as potential XSS attacks), meaning an enterprising a student could steal login credentials simply by using something like ARP poisoning on a school switch or even by sniffing wireless packets, or even by using XSS to borrow a teacher's session!

Until schools get serious about IT and security, this will keep happening.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
tom@... 9th Mar 2011
@snoop0x7b ... And there you have it; EDUCATION & CERTIFCATION. Many schools will often take the word of anyone who stands up and says they know how to handle a system. But they don't bother to find out whether that person is completely ignorant and only THINKS he knows, or really does know!
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
Otto Yamamoto 9th Mar 2011
The meal price should've been $9001.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
SoreHead 9th Mar 2011
@aerowind it says it was changed near the end of the article.
0 Votes
+ -
Hackers, Crackers or Thieves
4msetr 9th Mar 2011
I take and jimmy open a persons locked door to their home, enter and poke around moving things and take what I like. Then I call and tell my friends about the open house and they in turn do the same thing...i would call it "breaking and entering and theft".
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
V.Rodrigues Updated - 10th Mar 2011
c below
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
V.Rodrigues 10th Mar 2011
Having the required credentials MAKES you authorised.
Obtaining the credentials/acess via unathorised means is HACKING...

Because these other students obtained the credentials from an authorised Person, they did not hack anything.
The person who origionaly got the password 'probably' hacked something, somewhere. But even that is not absolutely true.
there is something called No-tech hacking, which you should google, this covers social engineering or reading the password on a post-it.

The headline should have read, "Students take advantage of the 'Suspected Hacking' of a school districts computer system....."
funny story none-the less
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
BDonohue 10th Mar 2011
Sorry to break in on your argument about what Hacking is and isn't (I'm with you @zwhittaker), but why did you decide to report on this story now? It's kind of old news. I'm not judging, I'm just curious.
0 Votes
+ -
RE: 4chan students hack district schools; Changed grades and $9,000 meals
bsltiger 10th Mar 2011
I am disappointed that 4chan users weren't smart enough to make it $9,001...

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix