http://www.palmbeachpost.com/pbcsouth/content/local_news/epaper/2006/04/21/m1a_HACKER_0421.html By Rani Gupta Palm Beach Post Staff Writer April 21, 2006 An 18-year-old student known as a "technological genius" has been charged with felony computer fraud after police say he used employee passwords to change his friends' grades, erase suspensions from their records and give himself credit for classes he didn't take. Jeff Yorston, until recently a student at the Dreyfoos School of the Arts, allegedly changed eight students' grades over the past two years, using computer IDs and passwords from four school district employees, according to an arrest report. The eight students, including Yorston and his brother, attended Dreyfoos, Spanish River, Olympic Heights and Forest Hill high schools. Yorston, now a senior at West Boca Raton, allegedly accessed the school district's computer system to delete records of suspensions of two students, along with related school absences. School police say Yorston gave himself an A in a French class he never took and gave himself credits usually reserved for varsity athletes to miss gym class. While under suspicion, he tried to monitor the investigation by obtaining the passwords of employees looking into the grade changes and asked a friend to read their e-mails, the report states. Yorston, who lives in Boca Raton, was booked into the Palm Beach County Jail Wednesday on a charge of offense against intellectual property, a second-degree felony. He was released later that day on $5,000 bond. Yorston wanted to attend the Massachusetts Institute of Technology and, according to one teacher, was to interview with philanthropist Alex Dreyfoos Jr. to get his help. Yorston's involvement surprised Dreyfoos junior Sam Natale, who described Yorston as "very hard-working, smart, very nice, with a good sense of humor." "The interesting thing is that he got such good grades on his own," he said. "I don't know why he'd change his own grades." Natale said he doesn't believe Yorston should be tried as an adult because he was a minor at the time of his alleged crimes, and said classmates are pulling for Yorston. "We all care a whole lot about Jeff," he said. Yorston isn't the first student accused of gaining access to supposedly secure records on the school district's computer network. The police report is unclear on how Yorston got the passwords of the workers, including an information technology employee with high-level computer privileges, two data processors and a Dreyfoos assistant principal. Information Technology Security Director Bob LaRocca declined comment. Last year, a student complained to a teacher that she had not been accepted to the University of Florida while her ex-boyfriend, a Spanish River student, had been accepted, the report states. She said she knew his grades were worse and suggested they had been changed. The teacher checked the computer grades against the printed grades and found they didn't match, the report states. When questioned, the student told a school police officer that Yorston had changed his grades and those of other students. Shortly before police came to interview Yorston, Dreyfoos teacher Laurie Cohen said she saw Yorston crying at school, the report states. Cohen told police Yorston told her that he and other students got into the computer system. Yorston told her "he did not mean to harm anybody but could not stop" and that "when he was able to crack one thing, he went on to another," the report states. Cohen told Yorston to go home and talk to his parents. Assistant Principal George Miller told police Cohen waited several days to tell him about Yorston. Cohen told police she informed administrators the next day. Miller also said that last school year, Cohen gave her password to a student to work on the yearbook, according to the police report. The student, who obtained the passwords of two other teachers, accessed final exams through the school district's network. Cohen also told investigators that Yorston was a "technological genius" and that Principal Ellen VanArsdale had arranged an interview with Dreyfoos, the school's namesake, to see whether he could help Yorston gain admission to MIT, according to the report. In March, information technology specialist Shawn Brinkman told police that a user was accessing the e-mail accounts of school district officials investigating the grade changes, using Brinkman's ID and password. They traced the breaches to another Spanish River student, who told detectives that Yorston had given him the employee passwords and told him to read the e-mails. The report states that changes were made under the ID and passwords of Spanish River data processor Joanne Tarantino, Dreyfoos data processor Suzanne Urso, Dreyfoos Assistant Principal Tanya Daniel and information technology security programmer Anne Matson. Matson noticed in June that her access had been changed so that she had the ability to update grades. She told LaRocca but did not change her password, the report said. Matson's daughter had recently graduated from Dreyfoos. Matson said she had logged on from home to check on her daughter's attendance, but said she did not give her daughter her password, though she told police she and her daughter used the same password to access their bank account. Police also interviewed four students whose grades had been changed, and three admitted they asked Yorston to raise their grades. One student told police Yorston had told him he had the ability to change grades, and proved it by e-mailing the student a copy of a test he obtained from the district computer system. Last year, another student was arrested and accused of accessing the school district's system nine times. The student, Inlet Grove High senior Ryan Duncan, did not appear to have changed any records. School board member Debra Robinson said Yorston's apparent access to confidential records was "frightening" and said school officials should make necessary improvements to the computer security system and retrain employees about securing their passwords. "I want to find out how this student got the passwords," she said, "or was it just a masterful hacking job?" _________________________________ InfoSec News v2.0 - Coming Soon! http://www.infosecnews.org
This archive was generated by hypermail 2.1.3 : Fri Apr 21 2006 - 02:54:32 PDT