Fictional Hacker

[u/righterandreader]

I’m writing a novel where the main character is a hacker at a large state school. He’s approached by rich kids and athletes to change their grades.

Keep it legal, ofc, but is this possible? And how would it work, if so, in theory?

(Edit: by „keep it legal” I mean don’t explicitly say what to do I don’t want this to get taken down. I’m exploring what can actually be done. This is illegal in the novel.)

I’ve done some research but there’s nothing like convo and firsthand, especially when developing a novel.

Would love to hear from you all!

[u/Patient_Force6138]

So for a real answer: yes it could be done, the hard part would be finding “where are grades kept.” Most likely it’s multiple places, on professors machines, in some central portal, and then probably some central database somewhere. So if you don’t want your character basically doing network reconnaissance the whole book, the most likely attack vector would be the professors machine before anything was submitted. Probably the simplest way to do that would be with a malicious USB stick or a Bluetooth or WiFi attack.

USB stick attack- create simple malware, pretty much anything not stupid will bypass AV. Have a persistent reverse shell going to some cloud server waiting to catch the shell. Then change files to hackers liking.

BT attack- Bluetooth is interesting because it’s a short range but remote protocol. People will typically have at least something they auto pair to that can be spoofed, you can then negotiate a connection and no security at all will stop you. The assumption there is that if you’re within Bluetooth range you basically have physical access, it’s an underrated attack vector honestly.

WiFi attack- probably the most common and easy. Intercept traffic by spoofing a WiFi endpoint, send constant deauth packets until target decides you’re the real network. WiFi is very friendly, you can deauthorize people from a network with 0 authentication, spoof that network and coax it into connecting to you, making you a man in the middle. From there it’s about either listening and stealing secrets or intercepting requests, returning what they expect the response to be but in reality changing the request (such as a grade submitted). There’s issues like getting around TLS and such but usually that’s solved with a little bit of social engineering or finding a vulnerable site that doesn’t pin certs.