Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Security Education

Student Expelled After Using Hardware Keylogger to Hack School, Change Grades (bleepingcomputer.com) 136

Catalin Cimpanu, writing for BleepingComputer: Kansas University (KU) officials have expelled a student for installing a hardware keylogger and using the data acquired from the device to hack into the school's grading system and chang his grades. KU did not release the student's name to the public, but they said the keystroke logging device had been installed on one of the computers in its lecture halls. The student used data collected from the device to change F grades into A grades. Professors said the incident would not have been noticed if the student didn't get greedy about modifications. The hardware device the student used was a run-of-the-mill hardware keylogger that anyone can buy on Amazon or eBay for prices as low as $20. Speaking to local media, various KU professors said they hope not to see any copycats in the near future.
This discussion has been archived. No new comments can be posted.

Student Expelled After Using Hardware Keylogger to Hack School, Change Grades

Comments Filter:
  • by MountainLogic ( 92466 ) on Friday October 20, 2017 @02:23PM (#55405413) Homepage
    Is anyone surprised that a student tried this? Got caught? Got expelled?
    • Re:Surprised? (Score:5, Insightful)

      by networkBoy ( 774728 ) on Friday October 20, 2017 @02:27PM (#55405439) Journal

      nope, and he fits the stereotype of "stupid greedy crims get collared".
      what we didn't hear about is the other student that changed all his grades up by one point. He's passing now, and no one bats an eye because it doesn't stand out.

      • Re:Surprised? (Score:4, Interesting)

        by bluefoxlucid ( 723572 ) on Friday October 20, 2017 @02:42PM (#55405551) Homepage Journal

        Pretty much yes. It's like stealing a motorcycle: if you grab a unique sports bike and ride it like all hell to the chop shop, the police are coming to get you; if you grab a Kawasaki 650, there's thousands of them out on the street, and nobody notices unless you drive like a nut.

        I'm not worried about anyone stealing my Zero SR when I get it.

        • Re: (Score:1, Funny)

          by Anonymous Coward

          nobody asked how you're compensating for your sex life.

      • by gnick ( 1211984 ) on Friday October 20, 2017 @02:45PM (#55405565) Homepage

        Bart: Well, Dad, here's my report card. I think you'll be pleasantly surprised.
        Homer: 'A+'!? You don't think much of me, do you, boy?
        Bart: No, sir.
        Homer: You know a 'D' turns into a 'B' so easily. You just got greedy.

      • Re:Surprised? (Score:4, Interesting)

        by stephanruby ( 542433 ) on Friday October 20, 2017 @03:26PM (#55405895)

        Or what we didn't hear about is the other student who framed him. Changing your own grade is very risky. Changing someone's grades you don't like. That's not risky at all.

      • Changing your grades is so unoriginal. Did he think this was the 80's and he was hacking into WOPPER?

      • Re:Surprised? (Score:4, Insightful)

        by Mashiki ( 184564 ) <[mashiki] [at] [gmail.com]> on Friday October 20, 2017 @08:05PM (#55407277) Homepage

        what we didn't hear about is the other student that changed all his grades up by one point. He's passing now, and no one bats an eye because it doesn't stand out.

        That's because clever criminals usually don't get caught until they over-reach. Look at your local police force/service and you'll see how happy they are over social media. In my small community, clearences are up 30% because stupid criminals brag, get caught and sometimes will even claim to have done more. Which is good. There's a two fold effect to this though, the smarter criminals will cool it for a bit because they think they're more likely to get caught. And that actually does lower crime.

    • Re:Surprised? (Score:5, Insightful)

      by ShanghaiBill ( 739463 ) on Friday October 20, 2017 @02:45PM (#55405571)

      Is anyone surprised that a student tried this? Got caught? Got expelled?

      Not totally surprised, but he got caught because he got greedy, and in my experience most cheaters are not greedy, they just want a passing grade. When I was in college I earned money by writing programs for other students, and when I would ask them what grade they wanted on the assignment, the most common request was for a "B", and even "C" was more requested than "A". They may be dumb, but they are smart enough to know they are dumb, and an "A" will bring suspicion.

    • Considering how smart the people running schools are, the "got caught" part is the only one that really surprised me.

      • by tlhIngan ( 30335 )

        Considering how smart the people running schools are, the "got caught" part is the only one that really surprised me.

        Well, he only got caught because he got greedy. Had he just changed his grades by a few points, no one would've noticed.

        Every knows if the D student started getting As. But if you change it from D to D+ or C-, not so much. Even a B could be plausible if the kid has been getting some tutoring

  • by Anonymous Coward

    clearly wasn't paying attention in his statistics class....

  • Professors said the incident would not have been noticed if the student didn't get greedy about modifications.

    "And I'd have gotten away with it, too, if it weren't for that meddling me!"

  • Brilliant putting the ease and accessibility of the tool immediately before their plea for no copycats.
  • by Ranbot ( 2648297 ) on Friday October 20, 2017 @02:29PM (#55405457)

    ...are even lazy at hacking.

    • by Anonymous Coward on Friday October 20, 2017 @02:54PM (#55405625)

      I went to college in the late 1980's

      I was going for a CS degree but had to take electives. One elective class I took was chemistry. To make a long story short, I was going to school in the day and had a full time job in the evening. I let the chemistry class slide as I concentrated on programming classes.

      At the end of the semester 50% of the grade for the chemistry class was based off of the final exam which was to be taken on the schools computer in the computer lab, where I spent most of my weekends anyway. The test was on Commodore 64's.

      The test was 200 multiple choice questions and timed for only 2 hours. I fumbled around on the first 50 question for the first hour. Knowing I would never complete the test in time, I decided to cheat. I knew the break sequence of the commodore and set about to change the basic program. Well, in commodores you could lock the execution memory from any change.

      So, I found where the memory location was for the number correct and the number of the next question. I changed the memory location for number correct to 198 and the number of the next question to 200. I hung out reading my chemistry notes for the next 50 minutes and then typed in "run" and pressed enter.

      A screen popped up saying that I had completed the test in 1 hour and 50 some odd minutes with 198 correct out of 200.

      I passed the class with a 70.

      Armatures these days....

      Nathan

      • by Anonymous Coward

        What does an armature have to do with your story?

        • What does an armature have to do with your story?

          Judging by his post, I would say he was really tightly wound...

      • You guys all were way more involved than I was. My simple hack was to change the DOS prompt on one PC in a lab to some ANSI escape codes to save the current cursor position, move to the top of the screen, print out "You have been stoned", and return the cursor to its original location, and complete the prompt as normal. I then moved to another PC in the lab, watched a student boot up the "infected" PC, get concerned, talk to one of the sysadmins, a small team of admins come in and try to virus scan the hel

      • by SlaveToTheGrind ( 546262 ) on Friday October 20, 2017 @03:59PM (#55406103)

        I was right there with you until this part:

        Well, in commodores you could lock the execution memory from any change.

        Plausibility went rapidly downhill from there.

      • Armatures these days....

        Tell me about it. You'd think they'd never generated power from a changing magnetic flux before.

      • I call "bulshit".

        The test was on Commodore 64's.

        The test was on Commodore 64's.

        When the C-64 was around in significant numbers, all my exams were ink-on-paper in a supervised classroom. A couple of minutes before the start time, after everyone was seated, the papers were handed out ; if you left early you clear your desk and hand the completed paper to the invigilator. Same for essays or multiple choices.

        Computing changed slightly through the course from dumb terminals to the mainframe (initially paper tel

  • Sounds like an event that hardware keylogger manufacturer(s) were looking forward to.

  • by Anonymous Coward

    An A? You just got greedy boy.

  • hack into the school's grading system and chang his grades

    Positive discrimination against Asians is bad, mmmkay?

  • by foxalopex ( 522681 ) on Friday October 20, 2017 @02:39PM (#55405529)

    I'm wondering why professors / administrators would be using the public terminals to work on student records. In my small university, I eventually earned the privilege of being a student system administrator but I knew with all the viruses and issues that happen on a public access computer that I wouldn't trust sensitive data on it. Even the floppy drives of the day were so screwed up that they would randomly destroy disks because people misused them all the time.

    I have little sympathy for the student. If not caught this bad behaviour becomes a disaster in the workplace. It's like the expression play with fire, expect to get burned sometimes.

    • by dunkindave ( 1801608 ) on Friday October 20, 2017 @02:51PM (#55405605)
      I doubt the professor used a public terminal to work on student records. More likely, the professor logged into his account from a computer in a lecture hall to pull up a presentation, and with one username/password for all activities, that gave the student access to what the professor did in the grading system as well.
      • Then the security issue is in not sensibly shutting sensitive parts of their IT infrastructure off from public access.

      • Exactly right. At the university I attended for grad school, there was a single sign on that was used across virtually all university systems, including the public terminals in each classroom that were used to display slides. If a student had a professor's login info from that terminal, they'd be able to login to the grading system, time sheets, class registrations, room reservations, etc., depending on the parts of the system to which the professor had been granted access. And even if it hadn't been a sing

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Probably because they used the same usernames and passwords to access the class material as they did to access the grade system. Or they used different usernames and passwords but over time accidentally used the wrong set out of habit when logging in to the public system. It is not uncommon to accidentally type the password into a username field, either. Usernames frequently appear unobscured in system log files. Studying log files for a few weeks will reveal a few passwords mistakenly entered as a user

    • Even the floppy drives of the day were so screwed up that they would randomly destroy disks because people misused them all the time.

      I have little sympathy for the student.

      That takes me back... When I was in college the closest computer lab with a printer to my dorm was general access. Anyone with a school ID could access it. I would finish up a paper, throw it on a floppy disk, and walk a block to the lab to print it out. Every floppy drive was broken! I talked to one of the students in charge of the lab. He told me people kept putting disks in backwards or upside-down.

      After that, I started walking the extra two blocks to the engineering building. All of their flopp

  • by BLToday ( 1777712 ) on Friday October 20, 2017 @02:50PM (#55405593)

    Last I heard, cheating at Star Fleet Academy is rewarded.

  • by mysidia ( 191772 ) on Friday October 20, 2017 @02:50PM (#55405595)

    Students have a STRONG motivation to cheat and little in the way of consequences of getting caught.
    Expelled? So what? They didn't go to jail. Probably for every 1 expelled 1000 got away with it.

    I would suggest educators (1) Use a set of paper records (assignment grade journal) to keep track of
    student grades during term -- as the definitive record to fall back on, in addition to keeping a computer record,
    and (2) Reconcile any digital summary record at end of term against the paper records ---
    if two versions disagree for a student, then check individual papers..

    Finally, the grade reports from educator to school should be a signed scan or technology such as an Adobe AcroForm signed PDF using
    a signing device from an AATL listed [adobe.com] certificate authority.

    PDF Digital signature as an example requires Two-Factor Authentication to create: PIN + Physical token specific to a certain person.
    Thus keylogging doesn't allow a student to forge a PDF grade report document. The university's "Grade Entry" system,
    whatever it is, should then simply be designed to accept the signed PDF form and verify the digital signature before gathering data
    into a record together with the PDF attachment; Once data is in a record, there should be no means of editing it other than a professor submitting a signed PDF revising the report.

  • So being expelled was exactly the right thing to do. I mean changing Fs into As? Somebody has not thought things trough one bit. Bad at studying, bad at crime and unaware of both.

    What I do wonder, however, how many do this just a bit smarter and get away with it. Probably should check the grades of my students a few months after exams again to see if they are unchanged...

  • by OrangeTide ( 124937 ) on Friday October 20, 2017 @03:11PM (#55405787) Homepage Journal

    I changed all my A's into B's. I didn't want to seem cocky.

  • IIRC, Ferris Bueller found the password to the school's server hosting grades on the pull out board of a school secretary's desk. I use the word "server" advisedly as Ferris and the school used dial up connections. Maybe the grades were kept on a Tandy (aka, RadioShack) TRS80, though the movie came out in 1986, and the IBM PC was introduced August 12, 1981.
  • If you want to protect endpoints, you disabled USB and other external ports. There is no reason to have them enabled, as they just present an attack vector, so really the school allowed the attack and they should use it as a learning moment.
    • Umm... so if you disable all external ports, how do the keyboard and mouse work? Keyboard loggers work so well because they sit between the keyboard and the PC... They even still come in both PS/2 and USB formats...
      • You route the cables into the computer and use motherboard mounted ports that can't be accessed without disassembling the case. I've used this method countless times for servers and endpoints that weren't in proximity to me, as the first round of security. As a second round, test the latency of the keyboard or mouse and if you find strange readings, shut off the ports and go investigate, even a very good hardware keylogger will leave a latency in the signal.
  • by CaptainDork ( 3678879 ) on Friday October 20, 2017 @03:47PM (#55406025)

    ... was "pencil."

    • ... was "pencil."

      And was kept in a little pull-out tray above the top-most drawer of the skleketary's desk?

  • by sootman ( 158191 ) on Friday October 20, 2017 @04:00PM (#55406105) Homepage Journal

    "Professors said the incident would not have been noticed if the student didn't get greedy about modifications... Various KU professors said they hope not to see any copycats in the near future."

    Pro tio: If that's what you want, don't tell them how to avoid getting caught. The public statement should have been, "Our rigorous monitoring processes instantly detected the abnormal activity which was confirmed to be fraudulent after a thorough investigation."

  • And as he was hauled away to finish out the rest of his education in a local remedial school, he was heard to shout, "HACK THE PLANET! HACK THE PLANET!"

  • The future Captain Kirk has been expelled. Now he'll end up a mixed martial arts fighter, or maybe an actor.
  • WTH? (Score:5, Interesting)

    by sims 2 ( 994794 ) on Friday October 20, 2017 @04:42PM (#55406377)

    What is going on here? He was only expelled? A college student?!

    Didn't we have a middle school student charged with a felony for changing a desktop wallpaper a couple years ago?
    https://yro.slashdot.org/story... [slashdot.org]

    A college student pays $$$$$ for education and loses that for doing something he ought to have known better than do and was planned out ahead of time.

    A highschool student gets a felony destroying many of their job prospects for their entire life for a prank.

    How is this remotely fair? It's not even !@#$%^& consistent!

    • The difference is that colleges have incentive to try keeping students by not harshly punishing. A highschool guarantees the seat of the student you just expelled will be quickly filled.
  • by gravewax ( 4772409 ) on Friday October 20, 2017 @05:32PM (#55406647)
    Definitely deserving of the F, for fucks sake any person with half a brain would have only raised their score to just passing grades to avoid obvious detection. I can only assume you used the same genius to achieve the F in the first place.
  • ... if they noticed it. Then cheated so blatantly they were certain to notice.

    Sounds like somebody flunked cheating too.

  • In college they had a DEC PDP-11/70 that students could use. Now prior I learned RSTS/E from my aunt who had all the manuals. And I'm a voracious reader. I realize that allocate command is quite useful on RSTS/E - in essence you could take control of another terminal.

    So we wrote a chat program, a password snarfer etc. One night the process blew up. Next morning I'm in the I.T. Directors office. They revoked my access. I left the school. Went to another school and all was well.
  • KU is usually called the University of Kansas. They abbreviate it KU so as not to cause confusion with the United Kingdom.

The number of UNIX installations has grown to 10, with more expected. -- The Unix Programmer's Manual, 2nd Edition, June 1972

Working...