Schoolboy Hacker facing 38 years for upping his grades

[elsiegee40]

Schoolboy hacker Omar Khan who upped his grades faces 38 years in jail - Times Online

 

 

Perhaps this one should be in the security forum?

[localzuk]

The thing is, it seems he didn't actually have any real skills here either - he stole a key, watched teachers enter passwords and, it seems, installed something like logmein on a machine or 2. None of it is really skill.

 

Now if he'd actually hacked in, using exploits etc... then he'd have probably set himself up for life as a security advisor. Instead, he's simply going to be a criminal. Shame.

[elsiegee40]

The thing is, it seems he didn't actually have any real skills here either - he stole a key, watched teachers enter passwords and, it seems, installed something like logmein on a machine or 2. None of it is really skill.

 

Now if he'd actually hacked in, using exploits etc... then he'd have probably set himself up for life as a security advisor. Instead, he's simply going to be a criminal. Shame.

 

The question is why did the teachers have admin privileges in the first place?

 

If it was their NM's password they obtained... the NM was clearly not the best person to be in post anyway. I would imagine that the majority of us are paranoid about our admin passwords!

[localzuk]

It doesn't mention admin privileges really. The only issue it mentions is the installation of software, which I suppose, would require local admin privileges. But then, our staff here have them on their laptops so they can install software.

[PEO]

This is the sort of thing the IT security industry bang on about all the time. There luck no one has picked up the server and walked out with it.

 

clearly who ever is in charge of the IT in the school is in-confident.

[Gatt]

Also brings up concerns about their firewall - surely any decent firewall setup would only have necessary ports open on it?

 

As well as Anti-Virus, etc

[localzuk]

My question is why the school didn't have alarms. Every room with computers in in our school has an alarm sensor. My server room has a light sensor, and soon (once I finally manage to get the door back on the cabinet), the cabinet and room will have it's contact sensors enabled, so opening the door of the cabinet will alert me also.

 

How can you have expensive equipment in rooms, especially equipment with access to confidential data, without alarms? It is just asking for trouble.

[pallen]

lol, I cant get access to the article as its blocked by county:rolleyes:

 

But if our school is anything to go by, all the security that needs to be put in place can be overruled by the SMT. It doesn't matter if the NM can do a good job or not if the head only wants someone to do what the teachers tell them to do. As a result security is limited.

 

Only yesterday I found someones password stuck to the computer, and when I asked them to remove it I was asked why.

[Gatt]

@pallen:

 

It could be a long time before Omar Khan goes to college: as long as 38 years, according to Orange County prosecutors, who have arrested and charged the 18-year-old student with breaking into his prestigious high school and hacking into computers to change his test grades from Fs to As.

 

If convicted on all 69 counts, including altering and stealing public records, computer fraud, burglary, identity theft, receiving stolen property and conspiracy, Mr Khan could spend almost four decades in prison.

 

He is currently being held on $50,000 (£25,500) bail and is scheduled to appear in court today.

 

Mr Khan’s defence lawyer, Carol Lavacol, described her client as “a really nice kid” and said: “There’s a lot more going on than meets the eye.”

 

Prosecutors claim that between January and May, Mr Khan, who lives in Coto de Caza, one of Orange County’s oldest and most expensive gated communities, repeatedly broke into Tesoro High School, which was made famous by the reality TV series Real Housewives of Orange County.

 

In an alleged plot that resembles the script to the 1986 high school comedy Ferris Bueller’s Day Off, prosecutors claim that he then used teachers’ passwords to hack into computers and change his test scores. In at least one test, an English exam, Mr Khan had been given an F grade because he was caught cheating.

 

Prosecutors claim that the teenager, who is alleged to have broken into the school late at night with a stolen master key, also changed the grades of 12 other students, and that he installed spyware on school hard drives that allowed him to access the computers from remote locations.

 

Tesoro High has 2,800 pupils and often appears in Newsweek magazine’s annual list of best high schools.

 

Mr Khan’s plan, the prosecution argues, was to get a place at one of the colleges within the University of California system. After his application was rejected, he requested copies of his student records, known as “transcripts” in the US educational system, so he could appeal. But when teachers looked at his files and noticed all the A grades that had magically appeared next to all the courses he had taken they realised something was wrong.

 

“School administrators alerted law enforcement after noticing a discrepancy in Mr Khan’s grades,” the Orange County District Attorney’s office said. “Subsequent investigation revealed that Mr Khan was in possession of original tests, test questions and answers, and copies of his altered grades. Khan is accused of stealing master copies of tests, some of which were e-mailed to dozens of students.”

 

The case has once again raised the question of whether technology, in particular mobile phones that can access the internet, has resulted in an epidemic of cheating in the high-school system. The Orange County Register, a local newspaper, asked its readers yesterday to respond to a poll asking if “technology is giving [students] an advantage”, or whether it is just “the same stuff using new tools”.

 

Another student, Tanvir Singh, also 18, is accused of conspiring with Mr Khan and faces up to three years in prison. The pair allegedly exchanged text messages last month while organising a break-in.

 

Jim Amormino, of the local sheriff’s department, said that he was astonished by the sophistication of the scheme, especially given the age of the defendants. “I think they [now] wish they would have put their talents into studying,” he said.

 

[Polski]

Localzuk made a good point. "Social Engineering" is the only 'hacking' he did.

 

No mention of using readily available tools to sniff the wireless network from the school grounds.

[pallen]

Thanks Gatt..

Gave you rep as I couldn't find thanks

[Gatt]

Cheers - Thanks button only appears in forums where thanks is "deserved" or something

[ZeroHour]

Gatt: Thanks is more for other things. Rep gives more to a user then thanks anyway generally.

 

Localzuk: Local admin rights, naughty naughty. We dont do it here ever really. It simply is too risky. We also here dont have any real alarms at all and its not been a problem so far. It depends on the area I guess.

 

As for the kid he broke the law and should go down regardless but 38 years is rather excessive. If you had complete accountability (ideal world stuff) you would not need security as the person would be found out and thus punished diminishing any point in committing the crime. They should have prevented it from working though with firewalls and no local admin though.

[Gatt]

Ah, cheers ZH - can never remember what the deal is with Thanks and Rep