Administrator thinks I, an IT volunteer student, am hacking the school network

Question

I'm a high school student volunteering with the school administrator, and he is somehow sure that I am always trying to hack the school server and put viruses on the computers.

A group of us spent a week helping him repair laptops, and since then we have been his team. So we do work for him, in a way. He did also say that we should be good examples, so it annoys him doubly that I "hacked into the server".

I must stay on good terms with him, because he is also in charge of all the other technical stuff, and I'm in the team who help him with things like that. (e.g. setting up microphones for school events, fixing laptops, etc.)

I used to boot up the school PCs with a live CD now and then to show Linux to my friends, but after the administrator asked me not to, I didn't anymore. Then, half a year later, after the anti-virus program found some virus while I was logged on to a machine, he insisted I booted in Linux to install the virus (as it was found in a folder for which I didn't have read or write permission on Windows).

And now, after I changed $PS1 on my laptop to 'admin@MNSSERVER:\W# ', just to fool my friends, the admin really thought I had hacked into the school server (which runs Windows, by the way).

Whenever I try to explain that I just changed my command prompt, he just insists I was hacking the server. What is a good way to convince him that I am not doing anything I shouldn't?

UPDATE: I was told by the admin to explain the whole thing to an IT teacher, and he understood it (and laughed), but told me not to pick stupid $PS1s like that again. No harm done, I think.

Answer 1

So... unfortunately you have gotten into a bad pattern and developed a bad reputation and that's going to take a while to change. The point that @Terence_Eden makes is totally valid - these are not your machines, and they are not yours to do with as you please. You've violated a few basic conventions that may not have been well-enunciated and now you've got an image in the sys admin's eyes as a potential internal threat. This is a trust thing - once you lose trust, regaining it is much, much harder.

Here's some thoughts both for now and the next time you are the new guy on a system at work or school or any other organization that you don't control.

1 - Know the rules

In a workplace, most users are given a usage policy on the first day. Read it, and ask questions. If your school doesn't have one, schedule a time to talk with the system administrator about his basic expectations of how people should be using the system and what the prohibitions are. Taking the active step to ask and try to learn marks you as someone who actually tries to care.

You're clearly interested in computers and doing cool stuff with them, that's great! But you're into the realm where you want to mess with stuff that is outside the range of what a normal user does. Those who don't care to get creative in their use of their computer access can blithely sign the stupid usage form and move on with their lives. But if you're thinking of things like booting off a different OS, then you need to know the rules and take responsibility for following them.

2 - Acceptable Use

Even if the rules aren't written, acceptable use in an organization will always center around users being able to achieve the primary objective of the organization. In your case, that's learning stuff at your school, and as a side benefit learning team skills and communication skills in working with class mates. The school may provide some resources that are not strictly linked to these goals (like having the free Solitaire game on your desktop), but anything that achieves the school objective is more likely to be permitted, than anything that poses a threat to the objective.

This means that if you end up in a grey area - for example, downloading new software for a class to demonstrate something cool for a project - you need to get it clear with the sys admin what's OK and what's not OK. Downloading software is a risk to EVERYONE, since a virus could take down the network and kill everyone's ability to work on projects. So the tradeoff needs to go through someone responsible for the health of the network.

3 - Security

You've wandered into two of the danger areas from a security perspective - booting off your own image is an absolutely great way to hack a network, and simulating the admin in any way is a good way to get in trouble for faking credentials (no matter how benign). The only difference between what you've done and what a legitimate hacker would do is the follow on actions.

So, you've demonstrated knowledge of and willingness to perform hacking techniques - this means that you're miles beyond all the people who don't know and don't care how to do this stuff. It also means, you are difficult to rule out when there's a potential threat on the system.

So... thing #1 to do here is - stop. Don't demo stuff just because it's cool. Don't change configuration settings to impress your friends. It's not necessary for your success at school. If you like doing this stuff, do it on a home computer, or if you don't have access to one, ask the system administrator for resources you can use safely. Let's face it, some of the coolness of changing the $PS1 value to a string containing "admin" is that it makes it look like you have access you're not supposed to have. That's a good test in an of itself - "does it look like I have access that I shouldn't have? ==> if yes, then don't do it" is a pretty good rule of thumb.

4 - Recovery

OK, so your image needs some recovery here.

First, honestly apologize. If you can't without sounding insincere then skip it.

Second, ask the system admin if he can spare some time and review with you his expectations for user behavior on his systems. Ask him to explain, and start asking questions about what the options are for going farther with doing legitimate work and study on these machines? This is not a "what can I get away with?" talk, this is a "if I honestly want to make stuff with computers, what are my options?" talk.

Third, cover what you should do if you see something that isn't right - it's much better for you to report weird behavior than for you to not notice, or not report and for the weird behavior to be linked to your account.

Lastly, follow the rules. If you hit something strange or want to do something more than you discussed with the admin, check in with him.

Summary/Reality Check

For the record, I do my own version of this summary on any work system I am a part of. I work as a manager in software development and information security, so I and my team tend to stretch the limits of what we are allowed to do. Meeting my admins and my information security team are on the to do list for my first week at any institution, because I'd much rather meet them when I have a clean slate than when I or my team has gotten into trouble.

As a result, I've generally had a good relationship with these folks, and I've learned a lot of great stuff from them. I also rarely have problems with broken configurations and equipment, because they take my problems seriously.

Answer 2

You've learned two very valuable lessons.

1. Don't play with other people's toys.
2. It's dangerous to be right when those in power are wrong.

These are not your computers. They are owned and run by someone else. If that person doesn't want you to play Minecraft on there - that's tough. Their house, their rules.

I would absolutely encourage you to explore, innovate, and hack - but only on machines where you have permission to do so. Otherwise, you face the very real risk of being punished.

Whether you're at work or school, doesn't matter.

Ok, now, how do we deal with a network administrator who is an idiot.

Well, first, is he? Are you sure that the Linux ISO you downloaded wasn't corrupted in some way? Did you check the MD5 sums against the download page? Did you make sure the machine you used to burn the disc didn't have a virus? Was anyone else using the machine but you?

Can you prove it?

It is never a smart idea to tell someone they are wrong. People can react badly when you demonstrate that they are idiots. So, here's what I think you should do.

• Document every step you took. Show that it is innocuous.
• Ask an outside expert to help you prove that what you've done isn't malicious.
• Talk to the administrator and see if you can allay his fears.
• If it comes to a confrontation, you need to remain calm and simply ask how he thinks you've harmed the network and what identifiable damage he thinks has been done.

This isn't strictly a workplace issue - but the crux of the answer is clear. Don't do it again. Ask forgiveness. Be prepared to respectfully demonstrate your innocence.

Answer 3

You changed the command prompt so that at first glance or to someone without much training it would appear you had hacked the machine. Now you're dealing with the consequences of someone thinking you hacked the machine. You can connect these dots, right?

You can try to prove that changing the command prompt isn't hacking the server, but it won't do you any good. You're definitely messing around with the server for your own entertainment. You've been asked not to, and each time you've just stopped doing the one thing that was asked or denied that you did it. This is like "please don't kick the back of my seat," "Ok." "Hey, I asked you not to kick the back of my seat!" "I'm not, that's my knee not my foot so it isn't kicking."

There used to be places that found the kids who couldn't stop messing around with the computers for fun, and gave them a chance to do some good with it. It was never all the places, and you admin is under no obligation to try to channel your energies for good. Whether you're genuinely hacking the system (perhaps to enable changing marks, invading privacy, or destroying records) or just goofing around to see what you can do and to show off a little does not matter. These servers aren't yours. Use them only in the way you're allowed to.

Then take that energy and use it to find a place where you can channel that investigative spirit. Maybe a users group or "computer club" in your town, where you can find kindred spirits and learn more about things that interest you. Or look around to buy a very cheap used computer and mess around with it at home. Just stop mis-using the school's equipment, especially after you've been specifically asked to stop.

Answer 4

Work with him.

That's it. And:

• Do it on friendly terms (approach him with the idea of learning from him).
• Make it open (always, always tell him what you want to do, and never ever let your classmates use you to their advantage).
• Make it clear that you want to help.
• Keep it for yourself, as long as possible. Otherwise you'll become tech support for every teacher in the building. And blamed when things don't work.

I'm sure there are gazillions of ways you can actually help him that would make him feel better about you, will make you look like the good person you are (deep down, otherwise you wouldn't be asking here, but on "hackers" websites), and maybe earn you some extra credits.

Plus, you will learn a lot more when you understand the power that certain tools can give you, and the responsibility that they come with.

Why do you think this person reacted like that?

I think this poor administrator is likely overworked, underpaid and with a lot of issues to deal with. Imagine being the only person in a school who is responsible for all content of the network with parents accusing you when their kids watch questionable material on their mobile without even using the school network.

How would you react at the first sign of trouble, e.g. a kid that seems knowledgeable than others? You over-react, and lose your marbles.

So approach him friendly. Prove yourself worthy of his time. This might include un-cluttering a big bunch of spaghetti in the switch closet, but it will get better.

Answer 5

You may want your parents to politely ask him to please stop making accusations based on mis-information. Inform him that making baseless accusations without facts is slander and if he continues they will have to take legal action to stop this.

He is obviously upset about the viruses and is going after the easy target. You may want to be cautious about how you use the schools computer assets and what "jokes" you play on your friends. You have drawn the administrators attention so now you need to play at a little higher maturity level so he doesn't have anything to accuse you of.

Answer 6

On some level, you threaten him because you're demonstrating knowledge that he lacks, and possibly demonstrating that there are loopholes in whatever security he may think he has installed in the environment.

This is regardless of your intentions. Even if your intentions are purely noble, you represent a threat to how he's seen by the people he answers to ("how did you let that kid get around your system lockdown?"), and possibly to the integrity network. You may be showing people with less-noble intentions how to bypass his security and not even realize it.

Chances are that you can't convince him that you're harmless. The fact that he can't discern a changed command prompt from an actual threat indicates that he either lacks the knowledge or the inclination to have his mind changed. He's likely under-funded and over-worked, and it's easy to jump to a conclusion via correlation = causation or post hoc ergo propter hoc, even if it's completely wrong.

If you're violating any school policies in doing what you're doing (and booting off a LiveCD may qualify), then there's nothing you can do - schools often take policy issues as binary decisions, either you're in the wrong or you're not.

Best course of action: just stop what you're doing, and let it go. If there's a safe environment with someone "in power" who trusts you to tinker with things (computer class/lab with a like-minded instructor), keep your experiments contained to that environment and/or have that instructor go to the network admin on your behalf.

Answer 7

Okay, you say this:

I used to boot up the school PCs with a live CD now and then to show Linux to my friends, but after the administrator asked me not to, I didn't anymore. Then, half a year later, after the anti-virus program found some virus while I was logged on to a machine, he insisted I booted in Linux to install the virus (as it was found in a folder for which I didn't have read or write permission on Windows).

There is the forest. And then there are the trees. Meaning there are specifics, but then there is the broader issue.

And in this case, while your playing around with a live CD is not a risk in any way, the fact you are simply doing that is making you a target. You simply cannot play around with someone else’s equipment like that and not be called out on it.

Now that said, maybe the best way to handle this is to find some neutral third party in the school—such as an assistant principal or guidance counsellor—and ask if they could mediate the issue.

And by mediate the issue, I mean you will sit down while you calmly, clearly & rationally explain the issue to the system administrator.

Now that said, I don’t think you can expect the administrator’s opinion of who you are & what you have done to change. So the best bet is to really lay off on showing off your “133t skills” in that environment.

You also say this:

And now, after I changed $PS1 on my laptop to 'admin@MNSSERVER:\W# ', just to fool my friends, the admin really thought I had hacked into the school server (which runs Windows, by the way).

You basically are playing games with the administrator & showing off to your friends. You need to stop it. Even if it is your own laptop, you are willfully causing confusion in this case. And the administrator has a right to be concerned when someone brings their own equipment into their environment & flirts with system penetration/exploration like that.

Yes, the school’s network is Windows & your laptop is running Linux. That doesn’t mean you can’t login remotely via your laptop to do something on a Windows machine.

Basically at this point the best you can do is to attempt to mediate an explanation with a third party but a key part of this is quiet simple: You need to stop showing off on other people’s equipment or flirting with the idea of doing that.

Answer 8

Kudos to you for knowing your stuff. Boo on him for not.

Now, further up and further in. You have 2 issues here:

One, you have played with fire before and he knows it.

Two, you have demonstrated a superior knowledge to his. First things first, go to him and directly address the issue. Don't defend yourself, but tell him that you did not do this and enjoy working with him and ask what it would take to continue to do so. Let him be the alpha. It sucks, but if you go with humility, most people respond well. Open your technique and resources to him. Be open source and have no secrets. The other posters are right, you are playing in his sandbox and you have to respect his rules. Also, remember he is under scrutiny because a virus got onto the system while HIS volunteers were working on it.

As for the hacking, keep at it! GNS3 and VirtualBox are my best friends and on my personal laptop I keep a lap of 15 systems that I use and abuse for various purposes. Learn, hack, do, teach! Find a local hackerspace, subscribe to linux mailing lists, go to securitytube.net, listen to info sec podcasts! LEARN AND TEACH! We are a strange but loving community so ask us anything!

Keep hacking.

Answer 9

You don't really indicate what the current situation is. Is he just grumbling about this or is this going higher?

I seem to be one of the few people who think you've done nothing wrong. Schools usually have ridiculously overbearing IT rules they copy-paste from other districts but in your words, you were asked to stop doing something and you did. There's nothing wrong in that. As other have suggested, in court or a formal tribunal you might find the burden of evidence on your side but while a child at school, you can be dealing with people who might naturally assume you've done something wrong.

If this is heading onto a disciplinary level —or a point that could negatively affect you— you need to act now to insulate yourself from any past incidents and to make sure other people know what's going on. This is largely a simple process that just involves talking to people in the right order:

• Talk to a parent or guardian. It might sound really lame and you might think your parents will take no interest but explain that this is really important. And then explain what you did (and why that might be construed poorly). Educate them and demonstrate.

  If you can't get a parent to do this, try talking to whoever is in charge of your pastoral care at the school. I've no idea how your school works but I had people available who were there to help.

  This is an important step because if later on nothing can be proven, your freshly-educated, extra-IT guardian can swiftly cut through the bullshit and say "Why are you penalising my child? They've done nothing wrong."

• Organise a meeting between whoever's involved at this point. The admin, your confidant from above and yourself. If it's getting out of control by this point, get the principal or another teacher involved. At that meeting go through what you have already with your confidant.

  • Explain what happened and what it technically meant.
  • Explain that you listened, haven't repeated that behaviour.
  • If they can directly link damage to you, listen and ask how you can atone for it
  • Explain that you're doing all of this so that you can remain on good terms.

The aim being that by the end of this process everybody involved knows exactly what happened, what that means and what needs to be done to get you back doing whatever it is you do.

There should be no animosity between you and your admin. It's at this point you can suggest they disable CD/USB booting and password-lock BIOS. Don't pants them in front of the principal or you'll find yourself kicked out of the technical "team".

---

But before any of that, you might also want to make sure the admin isn't just playing. It doesn't seem particularly odd to jokingly accuse somebody of being an elite hacker because they've changed $PS1. Sounds like the sort of thing I'd say to a pupil.

Answer 10

Your problem is social, not technical, so requires a social solution

From his point of view, you used a CD you brought in to make the computer run a different OS, and you had a network administrator's prompt on your laptop. If you appear to bypass his security, it's going to break his trust in you.

You can't solve this problem by trying to convince him there's no technical problem.

(Plenty of folk have been told by proprietary manufacturers that open-source software is a security risk, and they may well interpret the heartbleed bug as confirmation.)

Avoid winning the argument

What is a good way to convince him that I am not doing anything I shouldn't?

(Of course, first permanently stop doing anything he could possibly mistake for improper use of the IT facilities. This is step 0. If it's not necessary work that's done in the usual way, it's not what he feels the equipment is for.)

Unfortunately, it's very important to realise that proving you were harmless will involve him learning something from you during his disagreement with you, and he can't enjoy that, so proof will make the interpersonal situation worse not better.

Involving any authority figures (your parents, other staff) or any technical experts (web pages, any friends who also understand) will make him feel attacked or humiliated and you will provoke hatred - avoid!

Show you're a help not a hindrance

Change your aim to "What is a good way to convince him to trust me?"

You need to convince him by your actions and attitude that you're on his side and that you'll never be "a problem" again, then much later on once he trusts you, he'll be able to interpret your actions as having positive motivation, and will be able at some point in the future to believe that you never intended or caused harm.

It sounds like you used technical arguments to try to prove you didn't install malware, and as you see, he found places to perceive loopholes in your argument, because of your current role in his life: "smartass hacker".

You see innocent fun where he can only see problem behaviour.

How do you switch his perception from "smartass hacker" to "trusted helper"?

People have an opportunity to forgive when you apologise - apology is a powerful social tool.

First you need to apologise and show that you understand you've been a problem to him. You don't need to say you hacked anything to admit you've been a pain. Try something along the lines of

I've been doing a lot of thinking since you thought I'd deliberately put a virus on the computer, and I've realised I've been a pain showing off and messing around on the computers, and I wanted to say sorry and try and make things up. Is there some annoying, boring or long job that I could help out with so I can show you I want to help, not be a problem?

You might need to allow him, without interrupting and especially without disagreeing, to tell you what he thinks about what you did. This can be an important step in him expressing his emotions about it. Experienced couples learn to separate the feeling from the facts, using phrases like "When you ......., I felt .........". Don't expect this guy to be as careful, but giving him the chance to tell you off without you saying it was OK can really help him see you in a different light. Once he's done, you can say "I realise now how irritating the whole thing must have been - sorry again." Do not say at this stage that it didn't matter or didn't cause harm - it mattered to him, and you're apologising for the effect you've had on him.

It takes a while to win people round, and you'll need to be a good, reliable, endlessly supportive team member without any further unnecessary IT fun for a sustained period until he'll see you as reformed. Once he sees your motivation as good, he'll be able to doubt whether he was right to think you installed the virus and hacked the network.

What if he challenges you to admit to the virus?

Virus: "I can't see how anything I did on that computer could have installed a virus, but I admit I don't know as much as I like to say in front of my friends, and I totally see now why you don't trust me and so I'm not sure I can convince you I never meant any harm and didn't try to install a virus." - good because it positions you out of know-more-than-you land yet doesn't lie that you intended harm.

Can he ever want to believe it wasn't a problem?

[Much further ahead: Once you're at the point that the two of you can laugh about something together, you could share times you've played jokes on your friends, which may help him see that you were pranking them with the shell prompt, but lay off raising this event again explicitly. This is an already-thawed-relationship card to play without bringing up the unpleasant memories for him, but it won't work if you try to convince him - it just helps him put you in the prankster box instead of the hacker box. Crucially you can only go there once you're out of the problem box and into the fun-company box. If you never end up in the fun company box, don't try to move to the prankster box, because you'll just move back into the irritating-waste-of-time box instead!]

Life skills

Most managers have to manage people in a wider sphere of expertise than the route that they took to being a manager, so have to deal with people who know more than them. Very few people find this easy to deal with, and people-smart employees know not to slap managers in the face with lack of knowledge.

Learning how to make people feel that you value and respect them when you who know more than them is a crucial workspace skill, and being on good working terms with everyone from the chief exec to the cleaner is tremendously helpful and has solved many many problems for me quickly and easily.

See it from the other person's point of view, and be nice. People will want to help you out because you'll be grateful.

Answer 11

Consider why you're volunteering: does he actually finds your work helpful and would prefer that you continue it, or is it simply that he's letting you do something you like to do out of being nice? Who's doing the favor here?

From here on I'm assuming (from the fact that you called this "volunteering") that there is no tangible benefit that you're receiving from volunteering, and that you're doing it simply out of a sense of helpfulness. If that's not the case, then please clarify in your question, because it really matters who is helping who in this situation.

---

Next time he accuses you of hacking into the server, tell him that while you're usually a chill persons, you take accusations seriously.
Let it sink in for him for a moment that you do, in fact, take it seriously.

Then tell him you'll be happy to demonstrate to him exactly what you were doing step by step while explaining it in detail, to make sure he understands what you were doing.
If he's not the kind of person to be able to make simple "game-theoretic" deductions in his head from that statement (not sure if you've heard of that term?), then tell him explicitly that if you were really hacking into the server, it wouldn't make any sense for you to ask him to let you demonstrate it in front of him! Let that sink in for him.

If he accepts, then demo it clearly in front of him, and see if he still accuses you of hacking.
If he says no, then ask him when is a better time (realize he might be very busy, let him know you can do this after school or whenever might be convenient for him), and do it then.
If he still brushes it off, then tell him his accusation is completely unfair because he's not letting you give a chance to explain your side, and ask him again if he's willing to give you a chance to explain what's happened before making another accusation.

If he still isn't willing to sit down, then tell him you're only volunteering because [whatever your reason is for volunteering, such as being helpful to him], not because you're using it as an opportunity to hack into servers. Ask him if he believes you're telling the truth, and if he says yes, then ask him why he's still accusing you. And if he says no, then tell him you can't continue working in an environment where you're viewed as a liar, and then stop working for him.

Be (and appear) serious, but be respectful as well. He needs to understand that you don't take accusations lightly but that you're willing to do anything that he would find convincing (ask him what this is, if need be) to show that you weren't hacking into servers. Being willing to cooperate should be enough to convince him you weren't hacking.

Answer 12

There are a few lessons you can learn here:

1. Ill informed people with power over you are a fact of life. This will almost always be the case, even if they aren't total jobsworths like your IT administrator. Managers are a good example of this: they are paid to manage you, not to know every bit about what you do.

2. Negative reputations are hard to shake. Prevention is waaaay better than the cure here due to the herculean amount of effort it can take to shake a bad rep.

3. Do not poke the goddamn bear. It is bad enough that you have a reputation (no matter how well deserved in reality it is), using security flaws like the lack of boot protection and the $PS1 prank is doing you no favours with the people you need on your side. What you did here is about as smart as buying a white van, painting the words 'free candy' on it and driving round a primary school upon hearing a rumour that you may be a kiddy fiddler.