hpr-knowledge-base/hpr_transcripts/hpr3602.txt

Episode: 3602
Title: HPR3602: Hacker Stories April 20 22
Source: https://hub.hackerpublicradio.org/ccdn.php?filename=/eps/hpr3602/hpr3602.mp3
Transcribed: 2025-10-25 02:03:43

---

This is Hacker Public Radio Episode 3,602 for Tuesday the 24th of May 2022.
Today's show is entitled Hacker Stories April 2022.
It is hosted by Operator and is about 26 minutes long.
It carries an explicit flag.
The summary is origin story and trouble in school.
Hello everyone and welcome to another episode of Hacker Public Radio with your host Operator.
I've got tons of topics, so I'm going to start going through them.
The feedback I've gotten is the Hacker stories are pretty popular, so I'm going to try
to do one of those followed by one of the other million topics that I have here.
I've got a list probably of, I don't know, maybe 50, 100, it's topics, so there's no
shortage of topics, just a shortage of people and time.
Anyways, this is going to be about kind of a high school origin story and also the other
one I picked for today is a mouse jacket and it is a human interface device kind of
sniffing tool.
So anyways, I'll kind of talk about origin story, sort of how I landed in information security
and having that background.
Pretty cut cookie cutter for my generation as it were, I was born in 80, started out
you know, my dad was in technology and typewriters and fixing speakers and stuff.
I started getting into, I guess once we got our first PC, started getting into the video
games, pretty standard stuff.
What starts to get interesting is I would have neighbors and friends across the street.
I think I would get viruses on their computer and I would help them get rid of them and
I could specifically remember a Bart Simpson virus with the logo was Bart Simpson and I would
like manually remove before antivirus was a thing, I would kind of manually remove viruses
for people's computers and do that kind of stuff.
I started getting more familiar with networking and interested in that.
I wasn't super interested in security, I just wanted video games to work, I wanted to
kind of cheat sometimes, never got into memory stuff, I wasn't smart enough or didn't
have the attention span or anybody to help me do any of the memory stuff for video games.
So a lot of it was just running pre-existing, you know, game, cheat engine stuff.
But I think in high school it started, you know, I was the guy that was at the computer
lab all the time and that's when computers were starting to get popular in type schools,
kind of had some friends to hang out with and we would do stuff like host Duke Nookum,
which is a platform or a 3D game like Doom.
And we would play a setup, I would set up host the game and say, okay at 12 o'clock
I'm going to host the game in the library, you join it wherever you are in your class
and we would play multiplayer in the middle of the day at school to Duke Nookum.
So that was kind of middle school, high school, whenever Duke Nookum was super popular.
And what I had had at the time is that, you know, they were kiosks at the lab, the student
lab.
So they had all the hockey's down and they had the desktop locked down and more or less
it was locked down just by GPO policies and stuff.
So there were kind of kiosks, but one thing they did forget, which I'm going to get out
of things now, if I were to do a Pint test for them, if you hit the F3 button in Windows,
back then at least, yeah, it's not a thing anymore now.
But you hit the F3 button in Windows and it would bring up a little quick search bar,
which would search for stuff, which I missed to this day that Windows searches is garbage,
but that's a different episode of the other.
So I would bring up the Windows search, which would allow you to browse around the network
and look for stuff.
So that ended up being a place, finding a place where I could read right to the network
shares.
So, you know, I realized that I could start putting stuff on there instead of bringing it
in on, you know, 15 floppies.
So I started bringing in things in different games like Grand Tentato, Duke Nukem, and
other games.
And these are, you know, ultra violent games that are sitting on school computers.
At the time, you just, you know, you just think it's fun and you want to, you know, mess
around.
So I started doing that.
Then people started realizing that that's what I was doing.
And of course, I showed them, because, you know, that's what people do.
And I showed them how to do it, sort of how to copy files on there.
And everything was kind of hunky-dory.
There were, you know, a couple of people copying stuff onto the shares and playing games.
And everything was happy.
Everybody was happy.
You know, the teacher's obviously didn't know what was going on.
You know, you know, at that time, they didn't really have ultra violent games until kind
of after Doom or Duke Nukem, you know, that's when parents and teachers kind of really
thought that this was going to be a problem.
Anyways, it came what actually happened, is at one point time somebody came to me and
they said, you know, took me to that principal's office.
I sat in there and, you know, they gave me the stack of paper that's like, I don't know,
how many sheets?
It's like 50 sheet of paper or something insane.
It's just a stack of paper about half an inch thick of all the files that were copied
onto the network.
And they're like, you know, did you do this, probably to blah, blah, blah.
And I'm like, no, you know, these are mine.
I copy these on here.
But I don't know who did the rest, no idea.
So what ended up happening is that one of the kids had brought in, I think it was Grand
Deft Auto on floppy disks.
And one of those floppy disks had had a virus on it for whatever reason.
And or maybe it was tag, I don't think they had here as to expect it.
But anyways, he had put a virus on the school, you know, network essentially with these
17 floppies.
And then I guess when they ran an antivirus or maybe they were scanning and looking for
stuff after they figured out about it, they used that to kind of say, oh, it's a bad
thing.
Not only are you copying stuff on here, there's a virus on here and things could go bad
for us, whatever.
So that came about.
And I think I got like suspended or something like that.
That was pretty much the end of that.
Nothing really.
It didn't, you didn't stop me from doing silly stuff like that.
You know, there's no well networks messing around.
So past that was near tech kind of fast forward till until I'm older near tech was previously
not a technical college.
But later after I left, they had a technical, technical college, you know, label or whatever.
They were officially a college.
But anyways, I was there.
I have no idea what years it was, but when I was there, there were some people that I
was friends with, I was friends with kind of the networking guy.
He was Russian dude or something kind of a language barrier there, but he appreciated
me and kind of respected me and knew that I knew what I was talking about.
And then we had this other girl who was, you know, she drove like a Range Rover and she
was, you know, kind of like a code and basic or whatever, physical basic, and I'm, you
know, I'm, I'm all that in a bag of chips or whatever.
And she was kind of the assistant to, you know, kind of the lab people at the, the
linear tech.
And she, you know, kind of tried to help me stuff and I kind of tried to help her with
stuff and we were kind of friends.
And one day I came into the library where the lab and which often, if I was bored or
whatever, before class or after class, I would go into that lab and she was there kind
of a lab, you know, lab chaperone or whatever.
And that was kind of her unofficial job and I thought to talking, you know, around and
saying, hey, you know, if y'all are looking for anybody to help you with all this gear,
this networking gear and, you know, manage the lab or manage the network, I can do that
or, you know, get paid or not get paid.
I don't care.
I just wanted to learn.
Like I saw a lab with computers.
And the funny thing was is that their firewall had one of those old style analog lamp
timers on it.
And I don't know if y'all have ever seen them, but it's a dial and you might have seen
them at your grandma's house.
It's a little dial and it makes a sound, a clicking sound.
And as it turns around each hour, you can pop the dip switches on this dial and it's
an analog relay.
So at six o'clock, you can have it reboot the firewall and what was happening from what
I understand.
The firewall was like, wags were filling up or something and then the firewall would
just die or whatever it is.
So their solution was to like reboot the firewall every night or something and that would
clear whatever the problem was that the systemic problem was that they hit heaven instead of
actually trying to figure out the problem was a bridge of firmware or whatever.
So anyways, that's how kind of the lab was set up.
It was like any educational network gets held together with glue and band-aids.
So that came across as wanting to learn more or whatever.
So she's in the library and as she's doing stuff, I go to log in and we don't think
we had a login process at the labs at linear tech because it was all new stuff and you
could just walk up and get on the computer.
So someone must have done something bad at some point in time causing this other program
to be installed.
In this program, it was just like a little silly pop up window and it said, you know, put
in your social security number, basically your student ID, which back then was not kosher
but everybody did it.
So you put in your social security number and then you log in and after I did that, I realized
that sounds sketchy, like I don't, it just didn't seem like it was super on the nose.
So usually you can see some branding, you know, blah, blah, blah, you know, kiosk by
and then a company name like, you know, edge safe or something.
You could some kind of indication that it's not some whack I do that coded it.
So I'm, you know, looking at it and you have no notice, it's an excess file and I kind
of can run a brute force around it and I pop it open and it's got not only social security,
it's got the name and address of the students and I think maybe their birth dates or something
even like that.
They just like straight up took the whole entire instead of like unique ID and then binding
that on the back into some secure file somewhere, they just like straight up put the student
database and just like in a CSV file or access database file with a weak password on it.
So I'm either poking around and I'm like, last things weird, I don't know, it's like,
who is this, where does it come from?
And the library is like, man, you know, you better, you better stop.
You know, you're going to get trouble, someone, you know, this is not right or whatever.
And I'm like, I was just curious to understand like this didn't seem on the up and up, it
seemed like, you know, it was not something that they bought.
It was like something, somebody made somewhere within the school.
So you know, days later, I go by and all of a sudden, I had no indication at all, I
was sitting in a glass and, you know, Mr., you know, the security guard or whatever picks
me up and pulls me out of the room and escorts me off of the site.
And later, I realized that what had happened is that she had actually written that program.
She was telling me she was going to, I was going to get in trouble because, you know,
I was calling her maybe ugly essentially.
She report that as me messing around.
And I don't think that was, that wasn't it.
It was actually kind of, that was extra cannon fodder to go along with what, what else
happened?
What, what happened prior to that, I think, was that the website had been compromised
by, oh my god, Microsoft Front Page, which is an old, Front Page vulnerability.
And the website was replaced with like some anime character and some weird like icon,
mouse over style, like tagging that was in the source code.
And I couldn't read any of it.
It was like in Spanish or French or something.
I was like, some weird language, it wasn't Spanish, it was like French or something else
that I couldn't look at and recognize.
And this was before like Google Translator or anything like that.
So I just assumed it was, you know, some, you know, drive by, try by Pinteresters or whatever
that would just, they scan the whole internet and then they tag.
All they do is they run, you know, skitties, they run tools and they scan the whole internet
and then they pop thousands of websites at once, replacing it with their whatever tag.
And then they can say that they hacked into, you know, 200 websites or whatever.
So this is one of these simple drive by things.
They popped it, replaced the, you know, homepage index.html with, you know, some anime character
and some weird tag.
And I let them know, you know, I think I told the girl or someone else.
And they were looking around for, for kind of someone to blame, I guess, I don't know.
But come to find out, they had written up this whole whack-a-doo thing.
And I'll, if I remember, I'll put it in the show notes.
But basically they said, I hacked, you know, at one point in time somebody asked me jokingly,
they're like, hey, you know, do you have the website to get a job?
I was like, oh, yeah, funny, whatever, okay.
And, you know, I jokingly kind of said that that's what I did when they asked me.
And somehow that got out, I don't know, but whatever ended up happening, they blamed
me for this.
And they said, you know, they had logs of me logging on to the computer and messing with
the software and whatever.
And I'm like, those two events are completely on different days.
The day I was in the lab was completely either way after, you know, the website got compromised.
So, had I had any kind of representation there or not, it would have been fine.
They said I was going to get kicked out for a semester and it ended up being, you know,
like a whole year, so I had to transfer and it was kind of a mess and I ended up dropping
out.
I don't even get an associate's in school.
So I think that's kind of mostly what happened.
My mom, of course, was a too happy.
She, you know, she kind of understood what was going on and she called it like a kangaroo
court.
And I'll remember that thing because she was like, this is all just stupid.
I know you're not malicious.
You know, you don't do things for bad, you know, and just because you like anime doesn't
mean that a website gets hacked with the anime on it doesn't mean that that's not causality.
Like that's nice enough to, you know, convict somebody.
So that's kind of when I learned, you know, if you're going to take a shit somebody's yard,
make sure you're doing it through a proxy or you're not actively doing something that's,
you know, going to upset somebody that can get upset at you or whatever.
You know, if you're going to mess around with somebody in computers or if you're going
to mess around with hacking, hack something that's already dark or black like card forms
or I wouldn't start card forms because they'll tear you apart.
But you know, some kind of weird, you know, you get these spam emails with like referral
links and you'll get some weird, you know, forwarded off to some weird spam website that
just all they do is spam, spam, spam.
But you still actually want to be careful with those sites because, you know, they get
a hold of you and they could dox you and make your life a living hell.
But at least with, with them, you're not like legally, you know, yeah, you might get doxed
and, you know, you lose all your grandma's money or something, but at least you're not
left with some kind of, oh my god, snooze this stuff.
Some kind of lasting, you know, record that you did something illegal.
Anyway, so that's not advice for kids to learn and hack, but that's just kind of one
way to keep away from getting essentially in trouble because what are they going to do
to call the cops?
Like they're not going to, if they're in a legal operation or run out of, you know, Russia,
they're not going to like call the feds on you because they're illegal themselves trying
to sell fake drugs or something.
That's pretty much it for the linear, linear tech thing.
I transferred, I automated my, my tests.
So one of them was a, well, I took a, a Windows course, like a Windows, you know, Active
Directory course or whatever, wasn't paying attention.
You know, at the end of the class, I turned to my grade and I got like 85 or something.
And the instructor was like, oh, I'm surprised, blah, blah, blah, you basically don't pay
attention in class, blah, blah, blah, blah.
I'm like, well, this is, you know, this is the only thing I can do.
Like I get this stuff that I don't have to study for anything.
I just do it and then I, you know, retain that because I physically did it.
That's just how my brain works.
So he was surprised and then another one had like a, a Cisco class and I ended up going
through the networking academy and they said I could pick it up and finish or I thought
I could pick it up and finish.
So it was four parts, four semesters and I took two semesters and then took a break for
two semesters and said, okay, next year when it comes back around, I'll finish the other
two and they said, oh, well, it's been, you know, it's been a year and we've changed
our curriculum, like four questions.
We changed our curriculum and you have to start over scratch.
I was like, that I'm not doing that, whatever.
But I had written scripts to automate the configuration of the, the routers for the class.
So if you had the test, you just go, boo, boo, boo, run your script and it was done like
an input script, basically.
I also, they had the networking academy, I don't think they had that anymore, it was
a long flash and it was got awful to search for, I essentially didn't learn, I didn't
memorize anything for the test.
What I did is I created a script that would go and pull all of the, it was like a generic
log in that I found, all of the log in, all of the content into a giant text document
and then I had it split up to each chapter.
And then when you had the test, all you had to do was alter four or control F4 and search
for, you know, keywords in the question and then just read that little snippet and answer
the question.
You know, I never really learned the layers of the OSI model because I copied and based
them my way through it strangely enough ended up helping someone incidentally and people
were printing out entire chapters in the printer, which was kind of wasteful.
That's the whole point of the digital stuff.
But people were printing out entire chapters and we had a vision and paired guy.
And if you, if any of you remember Flash, Flash was one of those things that was not
vision-impaired friendly.
I mean, the internet was not vision-impaired and it still is not vision-impaired friendly.
He used it to zoom in the text and he could actually see the text because in the actual
website, you couldn't really zoom in and everything was kind of broken.
So I inadvertently had helped somebody that had, you know, vision-impaired stuff.
And I thought that was kind of an interesting outcome to, you know, messing with something
or playing with something or finding a different way to do something with computers.
You create something that you think is interesting or useful.
And somebody else can take that and do something with it and blow your mind.
You know, it doesn't happen a lot but when it does, it's quite gratifying that somebody
could take your idea or take your work and use it for something you would never have
thought to use it for and, you know, combine it with something else and kind of go from
there.
But anyways, let's see.
The other one was my final and I switched to networking from the Cisco stuff.
So the Cisco stuff, I was like, done with it, their jackals, their, you know, just a bunch
of money grabbing, whatever it is.
Anyways, that was when CIS has P would guarantee you, like, you know, 85K or not CIS has
fee, but CCNA, CCNA would like guarantee you, you know, ridiculous amounts of money.
And that's what I was aiming for.
And since they, you know, did pull the red tape on me, I said, forget this.
I'm out.
I'm done.
I'm going to go figure something else out and they said, oh, you can, you can do, you
know, Linux and networking or something like that.
So I switched over to that, which was actually more interesting and I learned more there,
which kind of led down the track of me being Linux Unix kind of centric as far as services
go and security.
But for my final, it was dual boot, which means nobody dual boots anymore, but you would
have, you would boot up the computer and you'd have a menu.
And that would be like the bootloader menu, grab, grab to now and then Windows had its
own bootloader, which I think can do the dual boot to actually.
It's easier just to have grab to, you know, anyways, dual boot means you can have two
different operating systems installed on your computer.
And when it boots up, you can pick which one you want or have a default to like Windows.
So the idea back then is that, ooh, people don't have enough money for two computers.
And it's, you know, expensive to have two computers will show people how to dual boot so
that, you know, you can play around with Linux and then go back to Windows.
I mean, let's all be honest, 90% of people in school were Windows centric people.
So they would, you know, you would have a dual boot set up and so they can go boot
into Windows if you wanted to and boot into Linux if you wanted to play around with Linux,
you know, desktop environment, which to this day, Linux desktop is just a hot mess.
I'll argue that until the end of days.
Anyways, so what I did for my final is that my final was was to show a nifty drive, right?
And then to install, I guess it was Windows or Linux, the easy way to do it was to install
Linux and then install Windows on top of that.
No, it was to install Windows and not take up the whole disk and then leave some space
for Linux and then you would install Linux on top of that and Linux would install the
grew up bootloader and it would give you the choice between Windows and Linux to boot
up.
So for my final, you know, we had power over many hours a day to do the final.
So for my final, I knew that's what the requirements were and he's like, show me nifty drive and
then show me that it's dual boot, that's a cool.
I pre-set it all up.
I had the dual boot set up, I installed Windows and Linux, had it set working and then
I used the floppy drive, which that was what we were using back then.
I used the floppy drive to back up the bootloader or the MFT, the partitions.
So I backed up the partitions onto the floppy disk and then I erased the partition, just
the partition information on the hard drive.
So when it came down to do the, came down to do the, to the final, the guys like, all right,
he makes his rounds and he sees me and goes on my computer, he sees it, the drive's empty
and then like three minutes later, I restore the disk partition and he's like, what?
And he comes over and looks and he's genuinely confused as to how I was able to do it.
And then when I told him, oh, I just backed up the partition table and he was kind of like,
okay, well, this guy obviously knows what's going on.
He's learned enough and he kind of gave me a free pass for the final and I didn't actually
have to install it.
He just said, well, this is your requirement, this is what you said needed to be done and
I did it.
You didn't say I couldn't back up the partition table and just be done in like four minutes.
So that was kind of my exit out of a linear tech.
That was before I got ejected with the whole, the whole, you know, quote unquote, hacking
thing.
It's pretty much as far as school goes, that was after the linear tech, I didn't do a whole
lot of school.
I did some training and stuff, but that's our redacted story for today.
I've got a few other ones.
Good enterprises and Chrome, DGN, shenanigans, doing your job and get fired.
Soccer game, denial of service, scares, Best Buy, Automation, Job, Automation and Web
Inspect guys, way back web application scanners and kind of getting fired for just doing my
job and making sure things are secure type of deal.
But anyways, I hope you guys enjoyed it and I didn't ramble on too much, have a good
one.
You have been listening to Hacker Public Radio, as Hacker Public Radio doesn't work.
Today's show was contributed by a HBR listener like yourself.
If you ever thought of recording podcasts, you click on our contribute link to find out
how easy it really is.
Hosting for HBR has been kindly provided by Anonsthost.com, the Internet Archive and
R-Sync.net.
On the Sadois status, today's show is released under Creative Commons, Attribution, 4.0,
National License.