We were Hacked

It wasn't a virus.

I said on my last post that we had a computer virus in our school computers, but yesterday we found that was not the case.

I was pleasantly surprised to see our school system back up (well 80% of it anyway) yesterday morning when I got in at 7:30.  My estimate was in not really having a functional system until next week, because of the complexity of our system and because of the damage a virus can do.

By 2 pm, everything seemed to be working normally, so I went and had a chat with CH.  There had been a rumour floating around the school that a boy in Year 10 was responsible for the virus attack.  I know the boy concerned, and although he had been in a bit of trouble over misuse of the school computers, he wasn't malicious, and quite honestly I didn't think he had the knowledge.

CH now told me that although he had originally thought it was a virus, he had discovered while repairing the system, that we had been hacked.  Someone had logged onto our server remotely and changed many of the settings, causing the chaos of yesterday.  Whoever had done it had used an administrative logon and password.

I went and had a little chat with the year 10 suspect and his probable compatriot in crime, and while I discovered that he probably was involved in some way, he really hadn't done anything bad.  He wasn't the main culprit, although there was supporting evidence that he might have discovered the administrative logon and  password from a previous incident.  We sent him home (I use the word we here, as I had to get a DP to help in the interrogation questioning and sending home, as I don't have the authority to do so) to think what he had done, and to prepare a written statement for me on Monday.  I also told the boy that we had reported the incident to the Police (true) who would be investigating the incident (true) and who would be asking him questions next week (untrue) so he'd better get his story straight.

I went back to see CH to discuss the whole incident, and as he now knew it wasn't a virus, and as almost everything was back to normal, he had been investigating any changes to our system.  He then told me that he had found evidence linking one of our Year 11 pupils into the hacking attack.  This pupil is bright, very interested in computers, is in one of my computing classes and a bit devious.  He was a much stronger suspect than the original year 10 boy, and the evidence we now have is much more complete and objective than the rumours we had at the start.  I'm sure we've got him, and I've already banned him from the school network, and every member of staff has been sent an email with our suspect's name and picture, telling them not to let him near any school computer at any time.

The student involved is sitting an NZQA exam on Monday, so we'll pick him up when he finishes that.  He might even be reading this post, so here's a piece of advice to him. 

If you're going to logon to the school servers to change the security settings, don't use a school computer to do it, and don't use your real logon.  Every change is logged and we know who you are, where you logged on from, and when you did it.  Don't plan on gaining any more computer qualifications at our or any school, because you won't be touching a computer for the foreseeable future.

There's a good kiwi expression for what you now are.

Can you guess?

Here's a picture to help you.