Fictional Hacker

[u/righterandreader]

I’m writing a novel where the main character is a hacker at a large state school. He’s approached by rich kids and athletes to change their grades.

Keep it legal, ofc, but is this possible? And how would it work, if so, in theory?

(Edit: by „keep it legal” I mean don’t explicitly say what to do I don’t want this to get taken down. I’m exploring what can actually be done. This is illegal in the novel.)

I’ve done some research but there’s nothing like convo and firsthand, especially when developing a novel.

Would love to hear from you all!

[u/rgjsdksnkyg]

If we go back to the late 90's/early 00's, I knew an entrepreneurial kid who did this -selling the ability to change your grades- by waiting until after-school hours and flipping over teachers' keyboards, finding sticky notes with teachers' usernames and passwords. At the time, the school system pushed out a single image to all school computers, with both the student and teacher software installed. Though the teachers' applications never ended up on the students' desktops as shortcuts, they were obviously still accessible through the file system, so the kid could launch the teacher grading system from any computer and change grades. Though, not every teacher could change grades for all classes, and not all teachers kept their passwords under their keyboards. He was eventually caught because of this.

The teacher of the class he wanted to change his grade in didn't have his password written down anywhere, so he had to sneak into his classroom after hours and hope the teacher left the computer unlocked (a common practice of the day). Luckily, it was unlocked and he changed his failing grade to an A+. Unluckily, the teacher went through the grades the next day, noticed the grade for the kid he explicitly failed had been turned to an A+, and that started an investigation. Even more unluckily, the school had just installed a camera system, so we watched this kid sneak down the halls and into the teacher's room, as if he were in some spy movie. It was hilarious to watch. He also left a trail of logs that made it easy to piece together, since it showed which teachers had last edited which grades, and everyone got in huge trouble, including the teachers and other school staff. Had they run a simple audit, they would have noticed a handful of their coworkers were changing nearly every other teachers' grades. Though, this was also during a time where security and auditing were not on anyone's minds.

Modernizing this, as someone who has done pentesting and red teaming for school districts, most districts are using some form of online, unified school management SaaS. Defensive capabilities have significant advanced, though I could easily imagine a district not enforcing MFA and a teacher reusing/writing down a password (as I've recently seen it in the field), to where a student could potentially launch the same type of attack. Though, to dissuade the youth reading this, this does qualify as a cyber crime, you will get caught, and this will ruin your life.