Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

https://news.ycombinator.com/item?id=487773

by jsmoov • 17 years ago

28 70 17 years ago

news.ycombinator.com

My 13 year-old cousin hacked into his school's computer system. He didn't do any major damage, but I want to make sure he knows why what he did was wrong and show him ways in which he can use his talent to make a positive impact on the world. What is the best way to approach him? Are there any good articles / books I can recommend to him?

markup• 17 years ago

I'm guessing "war games" wouldn't help :-)

vaksel• 17 years ago

define "hacking", did he do anything complicated, or did he just guess a password?

utnick• 17 years ago

indeed, this could mean anything, i got sent to the principal one time for having a windows dos command prompt open, no joke

Apparently it was actually a rule in the rulebook that you arent allowed to use the command line because you can do 'great damage'. On most computers it was disabled, but this was computer science class and we wrote console applications in c++ (through visual studio ide) so it had to be enabled.

They called my mom, who isn't very computer savvy, and told her that I was 'hacking'. She was so mad at me. I got 1 detention and had to write a handwritten note of apology. It was a pretty bad experience overall.

tptacek3• 17 years ago

In fairness to your otherwise overly twitchy school administration, it is in fact possible for dumb people with just enough DOS knowledge to screw up a standard PC build from the command line, enough to require a rebuild.

Zev2• 17 years ago

I'll see your DOS prompt and match you a "changed the desktop background and inverted the screen colors" trip to the principles office.

They wanted to suspend me for two days for that one. Happily, I was able to get another teacher to talk to the principal and explain that computers is "his thing" and that just because it was possible that I knew how to do something doesn't mean that I did do it.

r11t• 17 years ago

The best reference I can recommend would be Eric Raymond's "How To Become A Hacker" : http://www.catb.org/~esr/faqs/hacker-howto.html The key point the article points out is that "The basic difference is this: hackers build things, crackers break them." The teenage thrill of breaking into computer systems is certainly exciting but perhaps he will be even more enthusiastic about learning to be curious about how things work under the hood, how to do clever things via programming and how to develop a true hacker mind set. Of course all this without the risk of getting into trouble like breaking into his school's computer system. I am glad to know that he did not choose to do any major damage but nevertheless I hope he grows up to become a fine hacker and understand the true meaning of being one. Good luck and great effort on your behalf to try to advise him in the correct path!

tptacek3• 17 years ago

Like most of ESR's aphorisms, this "building vs. breaking" thing misses the mark entirely, reflecting more about how ESR thinks about the world than how the world actually works.

There is lots of productive work to be done in "breaking" systems. Nobody thinks Arjen Lenstra or Paul Kocher are doing work of a lesser caliber than Alan Cox; it is (I think obviously) harder to break RSA than it is to build a new Linux virtual filesystem layer. It is only because people like ESR don't know about people like Paul Kocher that this "build vs. break" meme spreads. Let's try to kill it when it appears.

What teenagers need to have is a sense of ethics. This has nothing to do with whether you spend your time finding holes in things, and everything to do with respecting property, with not assuming that you know the impact of every action you take that invades someone else's property, and hopefully with having a productive goal.

Here's what you need to tell your cousin: nobody in the real world gives a shit about your ability to break into one computer system. Per-host network penetration testing is close to the bottom rung of the computer security career ladder. If he likes breaking things, what he should do is start picking up open source software, researching how it works, finding vulnerabilities, and reporting them.

He's going to find really quickly that knowing you could --- if you were a criminal and a moron --- break into tens of thousands of computer systems is a lot more fun than breaking into one badly-configured school computer. He's also going to learn real computer science, because really breaking systems involves really reading and understanding code, runtimes, layering, information modeling and representation, and any of a zillion other things.

Computer security is a really awesome tour of a lot of the fun stuff in a CS curricula. I've worked on compilers, crypto math, distributed commit protocols, filesystems, and language runtimes in just the last 12 months. If he likes this stuff, get him to stay with it.

You asked for books. How about:

* The Web Application Hacker's Handbook (bad title, great book).

* Eldad Eilam's "Reversing"

* The Art Of Software Security Assessment (our industry's bible)

* The Shellcoder's Handbook

* The last 10 years of Black Hat Briefings talks, which are all available online.

unalone6• 17 years ago

I have a problem with that essay. It makes good points, most of which I agree with, but Raymond states them as values to be learned without explaining why. He essentially states his own beliefs without giving reason for some of them or explaining why such mindsets are useful. (Or: he shows rather than tells.)

The phrase that stands out most upon first glance is this:

Similarly, to be a hacker you have to get a basic thrill from solving problems, sharpening your skills, and exercising your intelligence.

If you aren't the kind of person that feels this way naturally, you'll need to become one in order to make it as a hacker. Otherwise you'll find your hacking energy is sapped by distractions like sex, money, and social approval.

I've found this not to be the case. Wanting sex, money, and social approval is not necessarily detrimental. Similarly, I get no thrill from solving problems per se. I don't think that that thrill is a necessity for hackers. Raymond uses too broad a brush.

cschep• 17 years ago

What is your connection to the hacker culture, if not problem solving?

viraptor• 17 years ago

Books, articles... I'm afraid they're boring - they are cool to read if you're interested in the society, but that comes later on and you start to look for those things yourself. If he's interested in how things really work, then just make sure he knows the difference between exploration and breaking someone's work. The best learning material I have found are pages of people dealing with real security... stuff that you cannot find by googling "hacking".

That might both give him some new ideas, as well as show who is really considered important. For example, I always thought lcamtuf (http://lcamtuf.coredump.cx/) is a great example of a hacker of many skills (photography, network security, fuzzing, constructing robots with own 3d printer and many more random ideas). I guess you just don't have time to be a script kiddie if you have enough good ideas of your own...

Just make sure he finds securityfocus before he finds cDc :)

On the other hand you could let him know, that notifying the school officially about the security problem may be a bad idea. Typical teachers are as likely to say "thanks", as "OMG hacker! security audit to make sure you didn't change any data will cost X$/h - your parents are paying for it and you're suspended".

jacquesm14• 17 years ago

Why was it wrong ?

He shouldn't have been able to do it anyway. Compare it to a kid kicking against a fence and finding out that it swings open.

Simply explain that if you have no business in a system that you should not try to gain access, that should be plenty.

jacquesm14• 17 years ago

Up/down up/down, if you disagree say so.

Do you take offense at my suggestion this kid did nothing wrong ? Why is that ? Enlighten me, for all I have read above the sysadmin is the person in the wrong, if a 13 year old can walk all over your system you ought to be looking for a job (and one that does not include system administration).

xenophanes3• 17 years ago

You defended a child against an adult. Of course some people will irrationally downmod you. Don't worry about it.

kajecounterhack• 17 years ago

He didn't do any major damage

What do you mean he didn't do anything wrong? If all he did was find a way into their systems and report his findings of insecurity or something, certainly there would be nothing wrong with that (as long as he's following his terms of use for the school computers, also -- he's held to the rules of the school as a student). But it appears as if he's done something, maybe he didn't report what he discovered, that is indeed wrong.

And I agree, the sysadmin must be pretty incompetent, but that is still no reason to be doing that. It's like saying "the lock on this safe is weak and easily broken, so I will go ahead and break it to access the contents inside." It's still a safe, you're still not supposed to break it. If you do, you should immediately recommend to the owner that they get a stronger lock.

He's a typical (in a sense) 13 year old. This hardly warrants punishment. But he should indeed put his talents to better use, and that's what the author of this thread is asking. What would we recommend?

bmj3• 17 years ago

So does this mean that if I accidentally forget to lock my front door that it is legal for you to walk around inside my house?

nsrivast• 17 years ago

Show him this:

http://www.paulgraham.com/hs.html

jacquesm14• 17 years ago

I think that piece makes some assumptions about the attention span of 13 year olds that are not present in the samples available to me :)

xenophanes3• 17 years ago

I knew a 13 year old, diagnosed with ADHD for not sitting quietly in class, who could concentrate on a chess game for 4+ hours straight. And then play another one after a short break.

I could do the same. I also read SICP when I was 13.

carlosrr• 17 years ago

I thought of the same article.

Also, I greatly enjoyed reading iWoz and it is be very accessible for a teenager. Woz' passion is very contagious and it may help him discover how fun constructive hacking is.

xenophanes3• 17 years ago

he didn't do anything wrong. congratulate him, and offer him links to some things you think he may enjoy to learn more.

if you fear he will make mistakes, the best way to combat that is with knowledge, not by taking the school's side against him and calling his great success immoral.

grouchyOldGuy• 17 years ago

Just because you CAN screw around with someone else's property doesn't mean you SHOULD. Although it can be exciting (especially at that age) to do something forbidden, he can suffer the consequences if caught. He might inadvertently harm the system and could wind up in serious legal trouble. It's like walking up to someone's front door, twisting the knob and discovering that they forgot to lock it when they left. That doesn't give him the right to enter the house, even if all he wanted to do was "look around". Turn the situation around: would he want someone hacking into his home computer because he didn't have it properly secured? Would they have the right to do it to him?

sounddust• 17 years ago

When I was in high school, I guessed the administrator password of our computer lab (it was the administrator's daughter's first name) and basically maintained the computer lab for the rest of the semester. I never did any harm in the process. The administrator, upon finding out what I had done, recognized that I knew what I was doing, and supported my work. I fixed permissions that repaired apps that had been mysteriously broken for years, reset other students' passwords at their request, and lots of other helpful things..

Then one day my teacher switched places with the only other person who had the admin password, and she didn't know about what I had been doing. When she found out that I had administrator access, she was infuriated. She called me a "hacker" and reported me to the principal. The principal planned to give me a 0 in the class and possibly expel me from school. The only people who were allowed to be in the "hearing" which decided my fate was the pissed off teacher and the principal. The administrator, who vouched for me, was told that no one asked for his opinion and that it wasn't relevant. I almost failed to graduate because of this, and it was only through being persistent and involving every teacher I knew that I managed to not fail (the principal reduced my grade to 75/100 instead of failing me).

I would tell your son that most adults who have authority (including principals, teachers, judges and police officers) do not understand technology and computers very well, and therefore it's important to not only operate within the scope of the law and rules of his school, but to also not even appear to operate outside those rules. Computers are cheap, and in 2009 there's not much more interesting in his school's network than what he can set up on a $200 netbook.

jacquesm14• 17 years ago

Spot on. And I sympathize with what you went through at school, times sure have changed. The overreaction to this sort of thing is something that never ceases to amaze me, anybody that is half decent with a computer gets looked at as some kind of force of evil.

I see this as a response to some kind of inner fear that there are kids out there that are more competent with this stuff than the adults. Invariably it's the clueless that start these witch-hunts.

russell2• 17 years ago

A long time ago my son did a similar thing. He didn't get into trouble because he told me first. We had a long adult talk about professionalism in programming. Essentially, professionals dont crack, but also about writing good code, testing, comments and such, so that it didn't come across as an adult smacking a kid. It worked, because he started taking a more mature approach to what he was doing.

jacquesm14• 17 years ago

it's a pity there is only one 'up' arrow here :)

swombat2• 17 years ago

To be fair, there are many professions in IT. Programming is just one of them. Computer security and system administration are two other very different ones. They don't necessary involve much "good code, testing, comments and such". On the contrary, they can involve in-depth, hands-on knowledge and experience of the kind of tools that other people will use, to be able to protect systems from them.

jsmoov• 17 years ago

Thanks to everyone, I appreciate the participation so far. I asked this question so I could be better prepared in approaching him - so I haven't spoken to him and don't know any details beyond the fact that he is being brought into a meeting with the Principal for breaking into the system. I'll post more when I speak with him.

What worries me the most is that his parents and school are pretty much as described in some of these comments - scared of what they don't understand. I've spoken with the parents and done my best to let them know that this is bad, yes, but not something to be punished. This kid really has a gift. I can understand their concerns, however, when he (as a 13 year old) is so sure of his talent that he considers academics unimportant.

Now that I think of it, if there is any recommended reading for the PARENTS of budding hackers? If not, that might be a good idea for someone out there...

jimbokun• 17 years ago

"When I was in high school, I guessed the administrator password of our computer lab (it was the administrator's daughter's first name)"

Holy cow, so you mean this doesn't just work in the movies, but in real life, too?

Timothee• 17 years ago

Exactly. My first thought when reading the original question was: "Show him 'Wargames' and explain to him how it's not good to start a nuclear war!"

It's funny that this story starts with this similar point.

lpgauth• 17 years ago

lol, I had to bruteforce my high school administrator password using l0pthcrack... took 2 days using 3 computers.

Beanblabber• 17 years ago

When I was in elementary school around 4th , we always had to wait for the teachers/admins to come put there passwords in so we could log in. One day I just didn't want to wait. So I tried a simple password: The first letters of the schools name. Got on and did the work. The Administrator noticed she didn't have to put the password in and so later that night I got called from the school asking what I had done. I told them about it and what the password was. She was grateful since it was a password she hadn't known about, left by earlier Admins.

That was about five years ago. Today I am usually always at odds with the teachers. Either I can't sit still, I'm too quirky or snappy, or whatever the teachers want to make up. Then their computer acts up. Perfect opportunity. I go over and fix the simple problem and they now regard me as a demigod and no longer hate me.

That's how I fix my relationships with my teachers.

endtwist• 17 years ago

Whatever you do, do not punish him for this. While what he did was not right (though your use of "hacking" here is very broad), instead of telling him how wrong it was, simply try to push him in a more positive direction. My suggestion would be to ask him to work on some sort of project for or with you, perhaps even get him involved in something small and open source. Starting a website may even push him in the right direction.

An alternative would be to talk to the school and see if they could give him some sort of credit for helping administer the network, or work on a special project for the school.

To give you an anecdote: in high school (and this was only a few years ago), me and my friends consistently were cracking passwords and breaking into various parts of our school's network. We never did anything harmful, nor did we ever cheat, but we did it for the fun and the challenge. One day, we happened to find a file containing all the passwords to every user on the network -- teachers, guidance counselors, and principal included -- and we turned it into the principal. Instead of telling us we were wrong for "hacking the network" and questioning us, he thanked us profusely and got the file deleted from the network. No punishment.

In middle school, however, I got in minor trouble for "hacking" by using proxies to skirt around the school's filtering system. The "techs" in the computer lab quite literally pulled me out of class and angrily questioned me, telling me how I was wrong and what I did was bad. What happened? I continued doing it, and just made sure not to be caught.

My point is that telling him he is wrong will not stop him, and he will likely continue what he is doing because it stimulates him and he finds it exciting. By nurturing that excitement and funneling it into something constructive, such as an alternative project, he will learn what the better avenues are and likely forget about "hacking"/cracking almost (if not) completely.

noonespecial• 17 years ago

I'd try the "with great power comes great responsibility" angle. They did the best their muddled minds could do to secure their system. It was trivially easy to break into it using your l33t haxor skillz, but might does not make right. Have a little compassion.

Also, remember, embarrassing them in this way might cause them to use the great power they have over you to make your life miserable as well. It goes both ways. The luddites in charge of public schools are usually docile, slow moving creatures, but they can become suddenly fierce if poked in the eye with a sharp stick.

dylanz• 17 years ago

Just let him know what the potential consequences are, and your recommendation (which I'm assuming is to "not" continue).

See if there is any way you can spin this toward the "good", by possibly having a meeting with the schools principal and systems admin. This is obviously a crap shoot, but could possibly be beneficial to your son's education.

cabalamat2• 17 years ago

Don't get caught.

swombat2• 17 years ago

With the important addendum that operating on a network that's effectively in the hands of someone else, in a classroom that's in the hands of someone else, is a pretty sure-fire way to get caught.

Don't try to do funny stuff on a school's network from within the school. You are outgunned from the very start.

gamache• 17 years ago

Seconded. I cannot imagine any good will come of his getting caught. He should keep his head down -- not tell ANYONE about what he did, even his friends -- and hope no one notices.

Whether he gets caught or not, this strikes me as a good lesson to learn before he's 18.

cabalamat2• 17 years ago

> not tell ANYONE about what he did, even his friends

Indeed -- I suspect the proportion of criminals who were caught because they bragged to their friends is quite high.

thomasswift• 17 years ago

Tell him to stop before he gets caught. Even though he didn't do any damage, a school's administration will not take kindly to the potential threat that he is.

here's one example, a quick google search - 69 felonies for stealing tests and changing grades http://www.tgdaily.com/content/view/38012/118/

Also, even though he got in, I wouldn't attempt to notify them of their breach, because again the school will probably go ballistic on him, I think there was a news story about this, but what happened escapes me.

kirse• 17 years ago

Tell your cousin he gets about 3 more years of goofing around like that where he should use the "stupid kid" or "I dunno" defense and get off scott-free or with a slap on the wrist. Once he's an adult though, the kiddy stuff has to stop.

If he's messing with financial systems or other serious stuff, give him a thwock on the skull and remind him that it would be unfair and immoral to screw with the systems more than the CEOs and bankers already have. =)

Allocator2008• 17 years ago

Each man has a right to his own property, including his intellectual property. Therefore it is wrong to "hack" if this means breaking into somebody's system without their permission, because it is a violation of the right to property. A copy of 'Atlas Shrugged' could drive this point home I think. But there are great jobs in computer security, in which people can get payed to "break into" systems to smell out the security flaws. This might be a positive way of channeling this individual's skill set.

jollyjerry• 17 years ago

If your cousin is interested in doing that kind of work, why not suggest him to volunteer with the school? All the other responses seem to romanticize the rogue hacker. Instead, I think he should come clean, and do his work in the public. He could offer to audit the school's network. For a 13 year old, this would be a great opportunity to teach him to be professional and helpful.

tptacek3• 17 years ago

This is a fantastic way to get your cousin expelled from school, and to provide him with a shiny new juvenile criminal record.

theotherjimmy• 17 years ago

from my experince at 16, you are correct. volenteering with te school will get you into trouble. get the kid a computer of his own with an open source operating system on it. this is a) harder to break than windows and b) a more friendly platform for exploration. I did this at 13, but my parrents are hacker literate.

I cannot comment on ethics though, or parrenting. Both of my parrents were computer scientists at one time in there carreer, and I still bounce Ideas off of my father. Personaly, I think this is the best way to grow up with such a skill set. my only regret is that I have not had much motivation to hack when I can have a rely interesting discussion with my father.

pavel_lishin• 17 years ago

My only advice is to go for B's. A will be too suspicious.

andreyf• 17 years ago

Do what my parents did when I got suspended for "hacking":

1) Get him a new computer (but with a crappy video card, if he's into gaming)

2) Find him programming internships and introduce him to programmers you know

I would also add:

Tell him that he isn't a real programmer unless he understands Prolog, Haskell, C, and a flavor of Lisp (Scheme/Arc), although Python might be a good first language to start with. Be prepared to spend lots of $ on books - all of these topics have books which work for different people. I would recommend:

The Little Schemer series: http://www.ccs.neu.edu/home/matthias/BTLS/ and Programming in Haskell http://www.cs.nott.ac.uk/~gmh/book.html

These are solidly good books, there are others, but they really depend on personality.

whalesalad• 17 years ago

Just don't let him blog about it... my dumb ass did that and got expelled. Best thing that ever happened to me, looking back, but it caused a whole lot of turmoil.

teyc• 17 years ago

Firstly make sure he realizes if he gets caught, the government is going to ground him from coming near another computer for 20 years.

mburns• 17 years ago

Being smart is not an excuse to be lazy. Also, don't be stupid.

ErrantX• 17 years ago

Your approach depends on a lot of things really.

I often thing, personallly, that whilst reading books/articles is good it doesn't help instill a lot into a young hacker.

First I would buy him Kevin Mitnicks books. I recommend them to every new hacker because: a) some of the stories are unbelievably inspiring! b) it's all real life stuff c) he manages to tell the stories of these great hacks without glamourising the illegality. It does a lot to prove hacking can be great fun within legal bounds.

The next thing I would do is encourage him to get involved with a programming community. Get him to learn a language and start ot play with it. :)

in terms of cracking (as opposed to hacking) sometimes pushing the boundaries happens (either for personal reasons or professional). I would teach your cousin that breaking the law is wrong. Breaking into the schools system is (speaking technically) as bad as breaking into a microsoft server. But the impact of the 2 activities (assuming it was simply to look both times) is very different. Try to show him that experimenting with something like the school system is fairly harmless but still wrong and he should take it no further unless he has permission :) (offer the school a pen test :D)

Finally a lot of people are saying "teach him not to get caught" (essentially). This is a most important lesson. I crack for a living (White Hat I hasten to add) and one of the things that makes me good at that is paying attention to covering my actions :)

melvinram• 17 years ago

I'd tell him to set himself up for success. His activity was innocent this time but by creating situations where he has the opportunity to do so not-so-innocent things, he'll give in to the temptation someday. It's like working at McDonalds or KFC: there is a big chance that you'll gain 2-3 lbs ever month you work there because sooner or later, you'll eat there. He shouldn't put himself into such situations where he can screw up. Bad decisions snow-ball.

soulstoler• 17 years ago

World is full of hackers. Some hackers are good...some are bad. He needs to choice his site in this thing. If he is "good" hacker, i suggest continue, if he is "bad" hacker, he can hack into government networks without getting caught. But if he gets caught, he goes to jail for a long time, maybe less than 10 years.

Ask HN: My 13 year-old cousin hacked into his school's system. What advice would you give?

Related Stories