[ISN] 18-year-old 'tech genius' accused of changing grades in school computers

[InfoSec News]

http://www.palmbeachpost.com/pbcsouth/content/local_news/epaper/2006/04/21/m1a_HACKER_0421.html

By Rani Gupta
Palm Beach Post Staff Writer
April 21, 2006

An 18-year-old student known as a "technological genius" has been
charged with felony computer fraud after police say he used employee
passwords to change his friends' grades, erase suspensions from their
records and give himself credit for classes he didn't take.

Jeff Yorston, until recently a student at the Dreyfoos School of the
Arts, allegedly changed eight students' grades over the past two
years, using computer IDs and passwords from four school district
employees, according to an arrest report.

The eight students, including Yorston and his brother, attended
Dreyfoos, Spanish River, Olympic Heights and Forest Hill high schools.

Yorston, now a senior at West Boca Raton, allegedly accessed the
school district's computer system to delete records of suspensions of
two students, along with related school absences.

School police say Yorston gave himself an A in a French class he never
took and gave himself credits usually reserved for varsity athletes to
miss gym class.

While under suspicion, he tried to monitor the investigation by
obtaining the passwords of employees looking into the grade changes
and asked a friend to read their e-mails, the report states.

Yorston, who lives in Boca Raton, was booked into the Palm Beach
County Jail Wednesday on a charge of offense against intellectual
property, a second-degree felony. He was released later that day on
$5,000 bond.

Yorston wanted to attend the Massachusetts Institute of Technology
and, according to one teacher, was to interview with philanthropist
Alex Dreyfoos Jr. to get his help.

Yorston's involvement surprised Dreyfoos junior Sam Natale, who
described Yorston as "very hard-working, smart, very nice, with a good
sense of humor."

"The interesting thing is that he got such good grades on his own," he
said. "I don't know why he'd change his own grades."

Natale said he doesn't believe Yorston should be tried as an adult
because he was a minor at the time of his alleged crimes, and said
classmates are pulling for Yorston.

"We all care a whole lot about Jeff," he said.

Yorston isn't the first student accused of gaining access to
supposedly secure records on the school district's computer network.

The police report is unclear on how Yorston got the passwords of the
workers, including an information technology employee with high-level
computer privileges, two data processors and a Dreyfoos assistant
principal. Information Technology Security Director Bob LaRocca
declined comment.

Last year, a student complained to a teacher that she had not been
accepted to the University of Florida while her ex-boyfriend, a
Spanish River student, had been accepted, the report states. She said
she knew his grades were worse and suggested they had been changed.

The teacher checked the computer grades against the printed grades and
found they didn't match, the report states. When questioned, the
student told a school police officer that Yorston had changed his
grades and those of other students.

Shortly before police came to interview Yorston, Dreyfoos teacher
Laurie Cohen said she saw Yorston crying at school, the report states.  
Cohen told police Yorston told her that he and other students got into
the computer system.

Yorston told her "he did not mean to harm anybody but could not stop"  
and that "when he was able to crack one thing, he went on to another,"  
the report states. Cohen told Yorston to go home and talk to his
parents.

Assistant Principal George Miller told police Cohen waited several
days to tell him about Yorston. Cohen told police she informed
administrators the next day.

Miller also said that last school year, Cohen gave her password to a
student to work on the yearbook, according to the police report. The
student, who obtained the passwords of two other teachers, accessed
final exams through the school district's network.

Cohen also told investigators that Yorston was a "technological
genius" and that Principal Ellen VanArsdale had arranged an interview
with Dreyfoos, the school's namesake, to see whether he could help
Yorston gain admission to MIT, according to the report.

In March, information technology specialist Shawn Brinkman told police
that a user was accessing the e-mail accounts of school district
officials investigating the grade changes, using Brinkman's ID and
password.

They traced the breaches to another Spanish River student, who told
detectives that Yorston had given him the employee passwords and told
him to read the e-mails.

The report states that changes were made under the ID and passwords of
Spanish River data processor Joanne Tarantino, Dreyfoos data processor
Suzanne Urso, Dreyfoos Assistant Principal Tanya Daniel and
information technology security programmer Anne Matson.

Matson noticed in June that her access had been changed so that she
had the ability to update grades. She told LaRocca but did not change
her password, the report said.

Matson's daughter had recently graduated from Dreyfoos. Matson said
she had logged on from home to check on her daughter's attendance, but
said she did not give her daughter her password, though she told
police she and her daughter used the same password to access their
bank account.

Police also interviewed four students whose grades had been changed,
and three admitted they asked Yorston to raise their grades.

One student told police Yorston had told him he had the ability to
change grades, and proved it by e-mailing the student a copy of a test
he obtained from the district computer system.

Last year, another student was arrested and accused of accessing the
school district's system nine times. The student, Inlet Grove High
senior Ryan Duncan, did not appear to have changed any records.

School board member Debra Robinson said Yorston's apparent access to
confidential records was "frightening" and said school officials
should make necessary improvements to the computer security system and
retrain employees about securing their passwords.

"I want to find out how this student got the passwords," she said, "or
was it just a masterful hacking job?"