utterances-bot commented 2 years ago

IoT Hacking and Rickrolling My High School District | WhiteHoodHacker

This is the story of how I pulled off my senior prank: featuring an IPTV system, a paging system, and Rick Astley.

https://whitehoodhacker.net/posts/2021-10-04-the-big-rick

saucybo commented 2 years ago

first

colincabana commented 2 years ago

simply stunning 🥺 (on a real note, i wish i was in school to see this!! 😂 This was so funny to watch when the videos went on the internet!!)

foxler2010 commented 2 years ago

cool.

Sporkpuff commented 2 years ago

W

r3lity commented 2 years ago

coolz

robbie01 commented 2 years ago

Linux kids can't even awk '$1 == "inet" && $2 != "127.0.0.1" { print $2; }' On a more serious note, as a fellow CO21 graduate who thought hacking the AMS LED sign in the cafeteria was hot stuff, reading this was an extremely humbling experience, and the rickroll aficionado in me shed a tear by the end. You're the GOAT.

ramen-noodles144 commented 2 years ago

Hey Minh, this is Raman. I remember you showing me life footage from cameras while we were playing chess in the chemistry room freshman year. You’ve come really far, this was so elaborate and awesome! Can’t wait to see what you will think up of next. Wish you a great time in college!

STrRedWolf commented 2 years ago

Any chance we can see your debrief presentation? Just the slide looks like it would be a fun read. Maybe present at DefCon or C3?

arjvik commented 2 years ago

This is amazing! I'm pleasantly surprised that your district was so nice about not taking disciplinary action... a friend of mine reported a Powerschool vulnerability to my school district and they responded with disciplinary action and police involvement!

Diacius commented 2 years ago

Absolutely amazing!

Intrexa commented 2 years ago

bnVueWE6YnVzaW5lc3M=

top kek

TheColorman commented 2 years ago

amazing

drewkime commented 2 years ago

The actual hack was good enough. But the care you took to do your testing at night, verify schedules to make sure you didn't interrupt anything crucial, distribute the pen-test as the last step ... Really nice attention to detail.

haze commented 2 years ago

epic

esquitx commented 2 years ago

U r my idol. Any tips on how you learned to do all this? #1 on HN btw. Congrats!!

kickturn commented 2 years ago

I remember my cousin telling me this in April, never thought I would see this in HN haha.

Awesomeguys900 commented 2 years ago

thats rlly sick oml

JesseTG commented 2 years ago

God Damn, Rickrolling is durable. Just about all of the freshmen were born after people started doing it in 2007, and yet everyone seemed to get it!

sam1rm commented 2 years ago

Awesome!

sam1rm commented 2 years ago

Hacker news discussion here! Currently the top https://news.ycombinator.com/item?id=28844101

RicoToothless commented 2 years ago

what a champion LOL

LevitatingBusinessMan commented 2 years ago

This is some Mr.Robot level hacking. Awesome dude, keep it up.

maormagori commented 2 years ago

This was a great read! Keep up the good work👍

ajtazer commented 2 years ago

I wanna try this too, but i doubt the security team will appreciate it. ( ͡° ͜ʖ ͡°)

tonydoyle96 commented 2 years ago

Good work in getting this accomplished and tested prior to the "event" Kudos to the School in working with you and learning fro this, I can see a pentest career in store for you and the team. If you love what you do you'll never have to "work" a day in your life

Ke1lie commented 2 years ago

What a great read! Kuddos to you for not implicating the school.

Airpote commented 2 years ago

Dude please continue hacking the web need people like you to protect us from malicius hacker, white hacker and cryptographe are our shield against the rise of quantum computer that can bruteforce a pass within second.

kogeki commented 2 years ago

Not even joking, I read this in school and decided to try it myself. I was able to scan my entire schools /16 and found IP cameras with no password, printers, ID authentication systems and most importantly: Apple TV devices connected to projectors. I am now extremely tempted to try this.

WhiteHoodHacker commented 2 years ago

Not even joking, I read this in school and decided to try it myself. I was able to scan my entire schools /16 and found IP cameras with no password, printers, ID authentication systems and most importantly: Apple TV devices connected to projectors. I am now extremely tempted to try this.

@Kogeki Please don't try it unless you get permission or fully accept the consequences; my disclaimer is there for a reason.

kogeki commented 2 years ago

Not even joking, I read this in school and decided to try it myself. I was able to scan my entire schools /16 and found IP cameras with no password, printers, ID authentication systems and most importantly: Apple TV devices connected to projectors. I am now extremely tempted to try this.

@Kogeki Please don't try it unless you get permission or fully accept the consequences; my disclaimer is there for a reason.

@WhiteHoodHacker Thanks for the warning. Anyway, this was a really interesting read. Nice job.

kusuriya commented 2 years ago

This is awesome and a very very solid write up. You should submit this to a few security conferences and try to get in at defcon. As a security professional this is a very solid writeup and very good work, probably among the best I've seen in a while and if you're interested in work as a cybersecurity pro you'll go far.

FxllenCode commented 2 years ago

Not even joking, I read this in school and decided to try it myself. I was able to scan my entire schools /16 and found IP cameras with no password, printers, ID authentication systems and most importantly: Apple TV devices connected to projectors. I am now extremely tempted to try this.

That is a yikes! This sort of thing happens all the time at school districts, I suggest reading your district's code of conduct and many (like mine) will punish you even if you make good faith reports. Guess they have to wait for someone to do something much worse...

kickturn commented 2 years ago

Not even joking, I read this in school and decided to try it myself. I was able to scan my entire schools /16 and found IP cameras with no password, printers, ID authentication systems and most importantly: Apple TV devices connected to projectors. I am now extremely tempted to try this.

Well u shouldn't try as you probably already know but I would like to say is to NOT disclose it or at least anonymous somehow. There is countless of stories of people finding vulnerabilities in school and had the "good faith" to report but got almost expelled

nem64 commented 2 years ago

The amount of planning that went into this is simply impressive. Hopefully this will be a wake up call to the network engineers to AT LEAST segment the network with VLANs and most importantly isolate traffic on the switch level

duhhbzz commented 2 years ago

Good read. Congrats on the details and steps taken to achieve this. This was cool to read.

nhitze commented 2 years ago

Mad respect, this was amazing. Also very good postmortem, I'd wish our developers write on this level (sry pals, it's true)

Keep it up and if you ever come to munich, let me know, Beer is on me

thelibrariancat commented 2 years ago

This is an excellent prank and an excellent writeup. Congratulations on pulling it off!

xtuphe commented 2 years ago

牛逼哦👍🏽青出于蓝

kigiri commented 2 years ago

Very nice stuff, not only the hack but you are also an entertaining writer and your website is very well made !

I'm glad your school was understanding, I have 2 friend that got expelled from their respective schools for this kind of stuff...

dingyx99 commented 2 years ago

This is an excellent writeup, congratulations!

noother commented 2 years ago

Legend.

ghost commented 2 years ago

D214 was always so lenient on messing with tech. When I was there and got caught snooping in the teachers files all they did was put me on a lanschool watch-list. Not saying how I did it as I know the (configuration) vulnerability was still there my senior year and I doubt they fixed it.