In 2000-2002 I managed security and infrastructure for a high school in Maine. This was a school with many very talented and diligent students. And some were learning to program in Turbo Pascal.
Someone either decided to, or did not notice the risks of, included the network libraries, something that was optional. I asked the publisher, and they confirmed, most school systems did not ask for that.
Sure enough, some students succeeded in writing a new GINA, intercepting attempted logins, and boom - they got a teacher's signon credentials to the NetWare server etc. And wasted no time rewriting some rows in the school grading and scheduling app. Much hilarity ensued.
It took while, but I was able to write a script to readily identify a non-student login, coloring the screen background bright red (it was NetWare, after all), and exposing the perp. The second part of this was a pair of cable scissors for the lab monitor or teacher in attendance. And the script dumped keystrokes to the equivalent of /dev/null for 10, later 15 seconds, trapping the perp at the screen. Some students power cycled, but most were a little stumped.
Instructions to the staff were simple. If a red screen appeared, take the scissors over. If a teacher or staff was not near that station, find the blue cable at the back and cut it. Took me about 30 seconds to re-terminate ethernet cables back than, and I had ago kit to do so, happily if we caught a perp. Most I passed in the hall, and they knew who I was, giving me some mean looks.
Solved in a few days. We left in the goodies, and I was tasked with giving a class on NetWare basics, oh fun. Which led to a much more devious intrusion, and a student being threatened with expulsion from they computer lab for the remainder... Their parents were outraged, this student needed those courses to get into the Ivy League school he was accepted at, early, (Legacy), and this was intolerable. My complaint was capturing data form backups to restore data that had been changed. And a brief discussion, which I led, pointing out that if such unethical if not illegal activity did not disqualify their son from entering that fine institution, well, my esteem for that institution was diminished somewhat. They curbed their child, and we got through the year. with no further detected breaches.
This isn't new, and this sort of behavior predates personal computers. But it is fun. They got to learn somehow.