IDG News Service - Users of the 4chan online message board managed to get access to the online student information system used by a New Jersey school district after the school's administrative password was posted to 4chan last week.
The problem started last Tuesday, according to the Plainfield Board of Education, which serves a small school district just west of Newark. That's when somebody posted a link to the login page and the administrative username ("admin") and password ("poopnugget") of the district's Genesis Student Information System to 4chan, a popular but anarchic message board best known as the place where David Kernell posted details of his break-in of former Alaska Governor Sarah Palin's Yahoo e-mail account.
The Web-based Genesis software is used by about 160 New Jersey schools to manage their student records and communicate with students and parents.
It's not clear how much damage was caused, but 4chan members soon started posting screenshots showing how they were able to mess with the school's system. One screenshot shows school lunch prices reset to $9,000 per meal. Another post claims that "every class is now an elective, and requires only 1 credit to graduate."
In another screenshot, it appears as though the 4chan intruder could have sent a message to students and parents using the school's emergency notification system, designed to send text messages and e-mails to parents in the event of a major disaster.
It's not clear whether the message went out, but if it did, parents in Plainfield would have received a technically accurate but tedious lecture on the difference between the Linux kernel and the GNU/Linux operating system.
The district's interim superintendent, Anna Belin-Pyles, confirmed the breach in a statement posted to the district's website on Saturday. There were "unauthorized breaches of one of the District's computer systems in an attempt to vandalize electronic data and to disrupt school district operations," she said.
Although some residents are worried that student records may have been tampered with, Belin-Pyles said that any damage to the system's data was, at worst, only temporary. "There has been no permanent damage to the electronic files and steps are being taken to remedy the situation and further secure the system," she wrote. The school district didn't return calls seeking comment for this story.
Genesis fixed the problem on Wednesday after discovering the stolen password, the company said. On Friday, Genesis posted a brief note offering customers some basic password protection tips.
A criminal investigation into the incident has been opened, Belin-Pyles said.
This pilot fish is a contractor at a military base, working on some very cool fire-control systems for tanks. But when he spots something obviously wrong during a live-fire test, he can't get the firing-range commander's attention.
- IT Certification Study Tips
- Register for this Computerworld Insider Study Tip guide and gain access to hundreds of premium content articles, cheat sheets, product reviews and more.
- Reduce federal infrastructure risk with compliance management and situational awareness
- IBM continuous monitoring and management solutions deliver real-time situational awareness to help federal agencies understand vulnerabilities, and protect the infrastructure.
- How Four Citrix Customers Solved the Enterprise Mobility Challenge
- Managing mobile devices, data and all types of apps-Windows, datacenter, web and native mobile- through a single solution.
- 8 Steps to Fill the Mobile Enterprise Application Gap
- Traveling executives and Millennials alike expect to communicate, collaborate and access their important work applications and data from anywhere on whatever device they...
- Seattle Children's Accelerates Citrix Login Times by 500% with Cross-Tier Insight
- Seattle Children's is a leading research hospital with a large and growing Citrix XenDesktop deployment. With ExtraHop, the IT team at Seattle Children's...
- McKesson Makes Application Hosting for Hospitals Faster, More Efficient
- With ExtraHop, McKesson identified the root cause of slow Citrix XenApp application launches and adopted a more intelligent, proactive IT operations model that... All Government IT White Papers
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily...
- On Demand: Mastering the Art of Mobile Content Management Mobile device usage in the enterprise has skyrocketed, and it continues to escalate. IT must answer to users who demand access to their...
- DevOps with PureApplication System: Reduce cost and speed delivery with an integrated IBM Cloud solution Join this webcast to hear what ING Netherlands has been able to achieve while deploying DevOps tools from IBM Rational. An ING executive...
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope...
- All Government IT Webcasts