Students "Hacking" each other

[Sammidge]

Happy Friday everyone!

 

We are having an issue on site with students being hacked and having all of their folders changed to "Gay" their work is left alone but this is bullying and we need to put a stop to it, I don't have a clue how they are doing it as of yet, but we have ruled out a simple case of the Machine's being left unattended and tampered with.

 

The machine's run Python which is the only code related/script related program they could be using to do this, Am I being stupid? is it something you guys have heard of before?

 

Cheers for your input

Sam

[plexer]

Double check your permission on the folders?

 

Ben

[SovietRussia]

Check your python script (Or even post it here)? Or even just check Permissions to their home areas? Its worth a try

[rush_tech]

I love it when they come in here saying that 'I've been hacked sir all my files are gone and the folders have been renamed!'

 

What you really mean is that you left yourself logged on and some mean year 11 has sat down after you and decided to make a few changes to you user area!

[Geoff]

The only time I was hacked was at Uni, and that was the point of the exercise. We had an SGI Indie network and the first one to 0wn the rest won.

[FN-GM]

Double check your permission on the folders?

 

Ben

 

I would check this first.

 

Are the students using weak passwords?

[Sammidge]

The student's are using Passwords that must be changed after 4 weeks and also we have a rotating system so that the default password is never the same.

 

The Folder for this particular students are has "Special Permissions" ticket for other users of the same year, I cannot believe I missed this at first.

 

Could it be that glaringly simple? Although I'm convinced there is a simple script being run by a student as all the Folders where modified at exactly the same time, is there a way to check who last made changes to the folders?

 

Cheers

Sam

[plexer]

If the permission permit access to other users then that is most definitely your problem.

 

Ben

[jamesfed]

This should fix your permissions problems in no time - NTFSFix

[Geoff]

is there a way to check who last made changes to the folders?

 

Only if you turned auditing on.

[plexer]

Only if you turned auditing on.

 

Before the event

 

Ben

[Sheridan]

I'm always amazed how many students let other students know their passwords - its the first port of call when we look into stuff like this.

[Sammidge]

They Aren't the smartest of beasts, but we confirmed its not them account/password sharing.

 

I'm looking into the Special Permission's on the account and it seems like a loophole that is so glaringly obvious I can't believe it was ever a problem

 

I've inherited this network (i'm just a lowly Junior engineer at the moment) and A whole set of problem

 

Thanks, for the help so far

Sam

[pete]

Do members of staff have access to pupil folders to drop in / pickup work?

 

Have you audited your security logs for logins when they couldn't (or shouldn't) have been at the machine the login appears to be from?

 

Have you checked the membership of privileged domain groups?

 

Is there a script on a shared drive called "Cool games" that when run changes the current directory to the homedir and runs a mass-rename of files?

[RJohnson91]

If you're running windows 7, which judging by the forum you posted this in you are.

 

Remember that they can go up folders, it could be as easy as them finding their mates folders via such things as going up from their folder, and having the rights to change stuff.

 

We had that problem here, we have a network shared folder for the kids, they would click on it, and on the top bar where it said '//network/Server1/shared' They would just click the word network and lovely windows 7 would display all of our servers on the network, half hour later they found all of the student areas, so we changed permissions pretty quickly!

 

On windows 7 you cant stop kids finding the 'network' in my experience but you can stop them viewing anything when they are there!

 

Ryan

[cogrady84]

 

On windows 7 you cant stop kids finding the 'network' in my experience but you can stop them viewing anything when they are there!

 

 

I use a GPP registry key to hide the network: (full key path = CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\ShellFolder)

 

 

Also, even if students could find users home folders, ACL's really should already be locked up tight since creation surely? (automated home creation via AD will apply the correct permissions to individual folders)

 

Edited June 14, 2013 by cogrady84

[psydii]

It's 2013. Why are people still relying on the UI to obscure access to stuff as their Standard Operating Procedures. Windows has had proper Access Control since '93. It really isn't acceptable.

 

The OP's case excluded, since they clearly recognize it as a mis-configuration rather than SOP.

[cogrady84]

It's 2013. Why are people still relying on the UI to obscure access to stuff as their Standard Operating Procedures. Windows has had proper Access Control since '93. It really isn't acceptable.

 

The OP's case excluded, since they clearly recognize it as a mis-configuration rather than SOP.

 

+1, as vaguely explained in my post, however I like to hide the network just in case a share is incorrectly hosted by someone, somewhere I don't know about. I am not the only administrator on my domain.

Edited June 17, 2013 by cogrady84