Re: HIT: Re: Student aides and "Passwords"

["Marlys E. Bacon"]

My son is one of several "techie" kids who serve as computer aides in
their high school.  They have access to all the passwords used on the
school's network--students' AND administrators'! If passwords are changed,
they know the new ones as soon as they are implemented.

One of the boys noticed a command in the system's CMOS instructing the
computer to "mask" passwords on the screen by inserting only asterisks. So
they simply inserted another command line into CMOS instructing the
computer to copy all passwords into a file that they created and named.
The computer does this now, of course. No one else knows that this command
line and file exists.  Their teachers are aware of the boys' knowledge of
the passwords (they've never abused this as far as I know....), but they
haven't a clue as to how they did it, so they can't protect against it.
That should be fairly easy, I think...  These seventeen-year-olds are just
delighted to have their teachers be so dependent on them, and so
mystified.  But the potential for real mischief is certainly there....  As
usual, teachers have to keep a step ahead of these wonderfully inventive
youthful minds.
--