Coding Stories: Me vs. the VNC Guy
A few of my stories, back from the XP&#x2F;2000 days at school:<p>---<p>The internet webpage filter at the school would stop you from playing games (particularly flash games), something as kids we quite enjoyed doing. I noticed that sometimes the real page would flash up and then go to the block page. After a while, I found out it was simply serving a &quot;redirect&quot; if the page contained banned keywords.<p>My 14 year old brain figured that I could make use of iframes so that the top section of 1 pixel height got given all of the &quot;redirects&quot; whilst the bottom half opened up google.com, where we could merrily search for games and proxies. This worked until I got VNC&#x27;d one day, logged off, account banned and the blocking system updated to filter prior to connection.<p>---<p>Still wanting to play games, I went to a friend&#x27;s home (I didn&#x27;t have internet back then), downloaded the entirety of a games website using a crawler and then brought the flash games in on a memory stick. As some of the teaching software also used flash player, this method of playing games was good until the every end.<p>---<p>My friend was watching all of these little tricks and thought they were cool. I wanted to try some things that would require two people to pull off. One lunch time we go to the library (the only machines in the school I can actually use now) and start experimenting with emails. It turns out that we could set custom rules.<p>A few minutes later, he has a rule that emails &quot;Hi&quot; every time I send him an email, and mine in return says &quot;Hey&quot;. We trigger this snowball off... 500 emails... Haha. 5000 emails... Still funny. 50,000 emails - erm. 500,000 emails, the computers are grinding too a halt. Disk space on everybody&#x27;s accounts is evaporating.<p>Email system starts sending out &quot;Unable to send message, not enough space&quot;. Few, we thought. But each one of these messages was a few kilobytes, and each one triggered a new one (as there wasn&#x27;t any space for that either). Suddenly the number of emails starts growing again as each of our accounts gets an automated space message.<p>We undid the rules and held the delete key for 30 minutes, there was still 500k emails when we left for class, but it wasn&#x27;t growing any more. I assume an IT guy saw what we did, because the next time I logged on, the rules were disabled and the emails were gone.<p>---<p>Some of the kids in the school had started to give me a &quot;hacker&quot; status and then one kid started to claim he was much better than me. Challenge accepted. I wrote a simple javascript webpage that would keep opening itself up,m saying something like &quot;you think you&#x27;re a hacker?&quot; in every page. Crashed my machine - perfect I thought.<p>I email him this web page, he opens it, crashes his machine. He thinks this is as brilliant as I did. He emails it to all of his friends. Their machines also crash. They email it to their friends, etc, etc.<p>The next day I get pulled into the deputy-head&#x27;s office, complete with angry IT staff. Apparently all of the kids using computers that day decided that it was a perfect way to get out of working, claiming their work had been lost (Word even back then had recovery options). Two weeks ban from using any computer. I got asked where I got it from - at the time I said &quot;I downloaded it from some website&quot;, but I wish I had told them that I had learned javascript and created it from scratch.<p>---<p>&quot;Trolling&quot; had become a thing, where you would try to cause somebody an inconvenience and leave a troll face there to let them know it was on purpose. Some of our exploits included taping a troll face to the underside of a laser mouse, unplugging mice&#x2F;keyboards and taping troll faces over the USB ports, swapping people&#x27;s mice over so that they controlled each other&#x27;s computers, turning everything upside down in the settings when somebody left their computer unlocked and left the room, holding down sticky keys to crash the computer out whilst making an awful noise, etc. We got quite creative with this.<p>---<p>Printing was done by room, with printers automatically added to your account depending on where you log in. In one of our classes there was an &quot;expensive&quot; glossy colour A3 printer, where the teacher would monitor what it was used for. We figured it did no authentication and that we could copy the printer settings and print remotely. We could also pretend to be another user as it didn&#x27;t connect at all to the user database. In a class with a few friends in, we remotely printed large cartoon pictures. Apparently the teacher was frantically trying to find the person who was printing and they all had a good laugh. They then took that printer off the network.<p>---<p>File explorer back then was patched so that we couldn&#x27;t see network drives and even if we could, we couldn&#x27;t get onto them. A few teachers sharing their screens would leak the fact that they had a private staff share. Child mind: Challenge accepted.<p>After several failed attempts using browsers and explorer, we discovered that Microsoft Office wasn&#x27;t patched. Suddenly we could access other student&#x27;s work spaces and save files in there. We could access staff&#x27;s work spaces and save files in there. We could access IT work spaces and save files in there. We occasionally left a &quot;I&#x27;m watching you&quot; file (created at home so it didn&#x27;t have our user account metadata) in random staff accounts.<p>At this point I think we were on their radar, but they needed proof. One afternoon we access the headmasters work space, who apparently left files on his desktop with his various login details. A bunch of students could now pretend to be the headmaster (we didn&#x27;t as we knew this was suicide). (Turns out later that this headmaster was stealing school funds, so in retrospect I don&#x27;t feel bad.)<p>We then found the &quot;program&quot; drive. It was a literal jack pot. Installation binaries with site-wide licenses. Back then there was no IP checking, one of these licenses was golden. We could install thousands of dollars worth of software at home for free, including Adobe everything, Maya and other 3D packages, office and every other custom piece of software.<p>Stupidly I had shown other people how to do this and they were running through the network like a bull in a China shop, triggering lots of errors, and as it turned out - getting lots of attention. In bursts a network administrator and he shouts my username into the room. This was the &quot;oh shit&quot; moment. I was dragged into the headmasters office whilst my teach protested that I was a good pupil.<p>I sit there whilst being berated, the network admin wants to call the police - whilst he wafts a large document full of screenshots in his hand (50+ pages). (Apparently they kept screenshots for evidence as I caught them off guard and they didn&#x27;t have video capture.) They come to an agreement that I am indefinitely banned from using a school computer with no police involvement, as long as I give them all of my exploits. As a child I don&#x27;t see any way out and agree. They handed me single piece of A4 paper and said &quot;write everything you know on here&quot;. Before I put even a single word to paper, I replied: &quot;Can I have some more paper please?&quot;.