Device Security Analysis: the district print server

The third Device Security Analysis, and the one where the attack is slow enough to look like nothing.

The device is a district print server holding queued documents, including individual education plans. The password attack here does not hammer one account; it tries each of nine real accounts exactly once, three minutes apart, which is how an attacker stays under a lockout threshold. Then it teaches the setuid bit, and part E is the escalation that uses it.

If you have done the kiosk or the laptop set, watch the clock in the log rather than the count.

This one is self-scored. Nothing you write is collected, sent or stored, and no score reaches a gradebook.