Student arrested for breaking into school computer network

[InfoSec News <isn () c4i org>]

http://www.bayarea.com/mld/mercurynews/news/local/5209779.htm

Associated Press
Feb. 18, 2003

TURLOCK, Calif. - A Turlock High School senior has been arrested for
allegedly hacking into the school district computer network and taking
encrypted files.

Police believe the 17-year-old intended to prove that the system was
vulnerable. Police said the student had told his computer teacher
about the system's flaws, and the teacher told the network
administrator about them, but the administrator told the teacher that
exploiting that security flaw was not possible, said Sheriff's Sgt.  
Adam Christianson.

So police said the student, who was arrested Feb. 5, broke into the
network, which contains personnel records and grade reports, copied
encrypted files with user names and passwords for the district's 1,300
employees and took the data home. Police said that at home, the boy
decrypted the information using a free Web download.

Police said he then took the information to school and showed his
computer teacher.

"What he should have done is offer to sit down with the teacher and
the administrator and demonstrate the hole with their permission,"  
Christianson said.

The school district is in the process of securing the system, and has
sent out a letter to employees advising them on precautions to avoid
having their identities stolen, said Lars Christensen, an assistant
superintendent for the district.

Investigators are still trying to figure out how deeply into the
system the student went, how long he has had access to it and if
anyone else has hacked it.

The district has filed expulsion charges and will press criminal
charges against the student, Christensen said.

"We consider it very serious. One of the most difficult things is
we're depending on the perpetrator of the crime to tell us what he
did," he said. "He had the ability to see everything we have."



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.