送交者: gentoo 于 2006-3-01, 19:18:50:
College Student Uses Brute Force PASSWD on School Computer to Change Grade
Tuesday, February 28 2006 @ 12:06 AM CST
Contributed by: Tommy
General NewsSALT LAKE CITY – You Li, age 21, a Chinese national living in Utah while pursuing an undergraduate degree in computer science at the University of Utah, has been indicted by a federal grand jury for hacking into a University of Utah computer in an attempt to change a grade in a math class. The indictment also alleges he accessed other personal information.
The indictment was announced last week by Acting U.S. Attorney Stephen Sorenson and FBI Special Agent in Charge Timothy J. Fuhrman of the Salt Lake City Office.
A federal grand jury returned a sealed two-count indictment last Wednesday afternoon charging Li with accessing a protected computer in attempted furtherance of fraud and obtaining information from a protected computer. Each count carries a potential maximum penalty of up to five years in prison and a $250,000 fine. According to SAC Fuhrman and Chief Scott Folsom of the University of Utah Public Safety Department, Li was arrested Friday morning by FBI special agents and officers of the University of Utah Public Safety Department. Li had an initial appearance in federal court Friday morning and was released on conditions, including surrendering his passport. The indictment was unsealed at the hearing. Defendants charged in indictments are presumed innocent unless or until proven guilty in court.
According to the indictment, the University's math department provided Li with an account on the math department computer system. The computer system hosted individual accounts for students and faculty which were private. One user could not see another's user files or read other's e-mail. The University kept the accounts private by restricting access to each account with individual secret passwords and authorized users to access their accounts only.
The indictment alleges that around October 2004, Li used a software hacking program to decrypt the password data on the math department computer system containing the password for a math department computer system user account owned by one of his professors. The indictment alleges Li accessed that professor's account using the professor's user name and password multiple times from a computer in Li's home. He used the professor's information to access the professor's account, read e-mails, and obtain passwords that the professor used for some websites and other personal information.
According to the indictment, with one of the passwords he obtained, he was able to gain access to the professor's personal account with Yahoo.com and, in addition to reading the professor's e-mail, was able to obtain financial information and other personal information about the professor.
According to the indictment, he also used the professor's password to the University's math department computer to access that system and a file on that system and to change one or more of his grades in the professor's class to better grades, including changing at least one grade from failing to passing. Li also wrote and installed, the indictment alleges, a program in the professor's math department computer account that would run when the professor logged in, falsely notifying the professor onscreen that the professor needed to enter his user ID and password for the University's administrative computer system, a separate network and computer system and thereby, the indictment alleges, surreptitiously capture the professor's user ID and password for the network and computer system. After Li had installed the program, the professor logged in and the program ran as it had been designed by Li to run, the indictment says.
Prosecutors don't believe Li was ultimately successful in altering his grade in the case. While he is alleged to have changed a grade file on the math department computer system, the file that Li allegedly changed was actually a backup file and the professor kept track of student grades in a primary file on a laptop computer.
The case is being prosecuted by Assistant U.S. Attorney Jonathan Boyd of the District of Utah and Scott L. Garland, Senior Counsel, and Josh Goldfoot, Trial Attorney, from the U.S. Department of Justice's Computer Crime and Intellectual Property Section.