Whoops I Accidentally Hacked ASU

Taaha Sayyed, a high school senior planning to study computer science at Arizona State University, describes how a frozen touchscreen directory kiosk at ASU's Mesa location led to an unplanned incident. After the kiosk crashed and exposed a Windows desktop, he used the on-screen keyboard to reach an elevated command prompt and launched a very long video of a Rick Astley song. He left without realizing the content was mirrored to signage at several campuses, including a large outdoor screen.

The middle of the talk covers the university's response: a summons from faculty, a review of camera footage, a note that a student in his position could face expulsion, a reflection process, and a written apology. Sayyed says the fix appeared to be disabling whatever input behavior he had triggered, and he questions whether that addresses deeper weaknesses. He also describes other things he noticed, including the scale of ASU's many locations, a site that appears thinly staffed, an exposed network switch, and room numbers visible in wireless traffic. He points out that there was no public bug bounty or clear reporting path for outside researchers.

His takeaways focus on kiosk hardening and disclosure. He argues for restricting kiosk accounts, closing off accessibility-based escapes, and giving finders a straightforward channel for reporting problems so that curiosity does not turn into a crisis.