[ISN] Hackers change grades at Fort Bend ISD high school

From: InfoSec News (alerts@private)
Date: Mon May 05 2008 - 00:48:18 PDT


Copyright 2008 Houston Chronicle
May 3, 2008

SUGAR LAND — Four high school students are being investigated on 
suspicion of breaking into the Fort Bend Independent School District's 
computer network and changing the grades of at least 60 students, 
according to court documents and school officials.

Investigators estimated the financial loss to the school district at 
more than $190,000, making the case a possible felony.

All four students under investigation are enrolled at Hightower High 
School, where all the grade changes occurred. School district officials 
said corrective actions have been taken.

"It is important to know that we have audited all student grades and the 
district is confident that all grades are accurate," school district 
spokeswoman Mary Ann Simpson said Friday.

School officials did not say if all the grades were improved or if the 
hackers gave some students lower grades. Investigators said the changed 
grades would have been recorded on report cards and other academic 
records. Two of the students at the center of the probe had grades 
changed to higher scores.

Investigators said in the court documents that data in the district's 
computer system were lost or altered at four other Fort Bend high 
schools, although grades were changed only at Hightower. Officials said 
all data had been recovered.

Three of the four students involved in the investigation are juveniles. 
No charges have been filed in connection with the case.

School officials declined to say if any disciplinary measures have been 
taken against the students.

"At the conclusion of the investigation, appropriate disciplinary and or 
legal action will be taken with any students involved," Simpson said in 
a statement.

Simpson said the district is reviewing computer security procedures and 
will take action to prevent future breaches, but she would not say what 
specific steps will be taken.

The case is the latest school hacking incident across the United States 
in recent years. Students from almost every corner of the country at 
high schools and universities have been caught, and in many cases 
charged, with crimes for tapping into computer systems and changing 

Probe began March 7 The Hightower investigation has been a major topic 
in the halls and cafeteria of the campus the past few days, students 
said Friday.

"I've heard they were changing student grades," said Leah Ramirez, a 

Court documents show the investigation began March 7, but officials 
first suspected computer tampering as early as December.

The investigation is being conducted by the district's police force in 
conjunction with the Fort Bend County District Attorney's Office.

The probe got under way when technology officials with the district told 
police there had been a breach in security of the district's computer 

"Fort Bend ISD has reported numerous unauthorized breaches of the 
network which have resulted in alteration and destruction of data 
including grade changes," the documents said.

School district technology officials also told investigators that 
malicious applications had been discovered on about 80 computers at 
Hightower High School.

A malicious application can be the introduction of a computer virus or 
the installation of key logger programs. A key logger records all the 
strokes on a computer keyboard and then sends a record of those strokes 
to another computer site.

That discovery launched police on a lengthy cyber trail involving the 
use of sophisticated detection programs and the issuing of low-tech 

Investigators systematically followed clues that led to four students, 
their computers, cell phones, monitors and numerous other electronic 

In addition to the grade changes, the investigation determined that 
between April 11 and April 14, student grade books were lost from 
Clements High School.

The probe also revealed that Dulles, Bush and Travis high schools also 
lost computer data, although the type of information was not disclosed.

Losses put at $191,400 According to court documents, two of the students 
who are the focus of the probe — one 15 years old and the other 16 — 
each had multiple changes to their grades.

"These changes went from a lower score to a higher score," the documents 

The investigation also estimates the financial loss to the school 
district at $191,400, but the documents do not explain how officials 
arrived at that figure.

Breach of computer security is an offense ranging in severity from a 
Class B misdemeanor to a first-degree felony, depending on the amount of 
the loss.

State law says if the loss is between $100,000 and $200,000, the crime 
is a second-degree felony.

A second-degree felony carries a penalty of two to 20 years in prison.

Attend Black Hat USA, August 2-7 in Las Vegas, 
the world's premier technical event for ICT security experts.
Featuring 40 hands-on training courses and 80 Briefings 
presentations with lots of new content and new tools.
Network with 4,000 delegates from 50 nations.  
Visit product displays by 30 top sponsors in 
a relaxed setting. http://www.blackhat.com

This archive was generated by hypermail 2.1.3 : Mon May 05 2008 - 00:56:09 PDT