第一章：一封匿名邮件引发的风波

2022年10月17日凌晨1点23分，江城大学计算机科学与技术专业大三学生林默盯着电脑屏幕上的收件箱提示，指尖的咖啡杯已经凉透了。他刚帮实验室导师调试完分布式爬虫的代码，正准备合上电脑睡觉，那封没有发件人名称、只有灰色`unknow@protonmail.com`地址的邮件，就这么跳了出来。

At 1:23 AM on October 17, 2022, Lin Mo, a third-year student majoring in Computer Science and Technology at Jiangcheng University, stared at the inbox notification on his computer screen, the coffee cup in his hand already cold. He had just helped his lab advisor debug a distributed crawler code and was about to close his computer to go to bed when that email, with no sender name and only a gray `unknow@protonmail.com` address, popped up.

邮件正文只有一行极简的黑体字：「你学校官网的后台登录地址是http://oa.jiangcheng.edu.cn/admin，账号是admin，密码是admin123，试试你能发现什么。」末尾没有署名，没有表情，甚至连句号都没有。林默的第一反应是实验室的恶作剧——上周他刚跟室友吐槽过学校官网的加载速度比蜗牛还慢，室友还打赌说官网的后台密码肯定是`admin123`这种弱口令。

The body of the email contained only one line of minimalist bold text: "The backend login address of your university's official website is http://oa.jiangcheng.edu.cn/admin, the account is admin, and the password is admin123. Try to see what you can find." There was no signature at the end, no emoji, not even a period. Lin Mo's first reaction was that it was a prank from the lab — just last week he had complained to his roommate that the loading speed of the school's official website was slower than a snail, and his roommate had bet that the backend password of the official website was definitely a weak password like `admin123`.

他抱着看恶作剧的心态点开了链接，浏览器跳转到学校官网的OA系统登录页时，他还忍不住笑出了声：登录框的右下角还留着外包开发公司2019年的测试水印。等他输入账号密码敲下回车的那一刻，笑容直接僵在了脸上——没有跳转到错误提示，没有404页面，他直接进入了OA系统的后台首页。首页最显眼的位置挂着全校师生的花名册，包含学号、身份证号、家庭住址甚至银行卡号；左侧菜单栏里列着财务处的报销审批系统、学生处的奖助学金发放记录、甚至校党委的内部会议纪要，每一条数据的权限标注都是「仅校内网可访问」，而他此刻正坐在宿舍的公用Wi-Fi下，根本不在校内网范围内。

He clicked on the link with the mentality of watching a prank, and when the browser jumped to the login page of the school's OA system, he couldn't help but laugh: the lower right corner of the login box still had the test watermark left by the outsourcing development company in 2019. When he entered the account password and pressed enter, the smile froze on his face — there was no jump to an error prompt, no 404 page, he directly entered the backend homepage of the OA system. The most prominent position on the homepage hung the full list of teachers and students in the school, including student ID, ID number, home address and even bank card number; the left menu bar listed the reimbursement approval system of the finance office, the scholarship and grant issuance records of the student affairs office, and even the internal meeting minutes of the school party committee, with the permission label of each piece of data being "accessible only on the campus network", and he was sitting under the public Wi-Fi in the dormitory at this moment, which was not within the scope of the campus network at all.

林默的后背瞬间冒出了冷汗。他学的第一门网络安全课里，老师反复强调过：未经授权访问信息系统、篡改或者泄露数据，都是违法行为，哪怕你是为了好玩。他赶紧截图留存了所有证据，退出后台，删除了浏览器的访问记录，然后立刻给学校网络安全管理中心的官方邮箱发了邮件，附上了他发现的漏洞详情、后台访问的截图，还有那封匿名邮件的原文。不到十分钟，网安中心的电话就打到了他的手机上，值班的老师在电话里声音都在发颤，连说了三遍「幸亏你上报了」。

Cold sweat broke out on Lin Mo's back instantly. The first network security class he took had repeatedly emphasized by the teacher: unauthorized access to information systems, tampering with or leaking data are all illegal acts, even if you do it for fun. He quickly took screenshots of all the evidence, exited the backend, deleted the browser's access history, and then immediately sent an email to the official mailbox of the school's network security management center, attaching the details of the vulnerability he found, screenshots of the backend access, and the original text of that anonymous email. In less than ten minutes, the phone of the network security center rang on his mobile phone, and the teacher on duty was trembling with fear on the phone, saying three times in a row "fortunately you reported it".

后来网安中心的技术人员排查发现，这封匿名邮件是之前给学校开发OA系统的外包公司的离职员工发的——当年开发的时候，为了方便测试，开发人员把后台的测试账号留在了生产环境里，密码也一直没有改，这个漏洞已经存在了整整三年，之前从来没有被人发现过。如果这个漏洞被别有用心的人利用，全校2.3万名师生的个人信息、近三年的财务数据都可能被泄露到暗网上，甚至被用来实施精准诈骗、勒索，学校的声誉和师生的财产安全都会受到严重威胁。而林默因为及时上报，不仅避免了这场可能发生的灾难，学校还给他发了5000元的漏洞举报奖励，还邀请他加入了学校的网安志愿者团队。

Later, the technical staff of the network security center found out after investigation that this anonymous email was sent by a former employee of the outsourcing company that developed the school's OA system — when it was developed back then, in order to facilitate testing, the developer left the test account of the backend in the production environment, and the password was never changed. This vulnerability had existed for a full three years, and had never been discovered before. If this vulnerability was exploited by people with ulterior motives, the personal information of 23,000 teachers and students in the whole school and the financial data of the past three years might be leaked to the dark web, and even used to carry out precision fraud and extortion, and the school's reputation and the property safety of teachers and students would be seriously threatened. Thanks to Lin Mo's timely report, not only was this possible disaster avoided, but the school also gave him a 5,000 yuan vulnerability report reward, and invited him to join the school's network security volunteer team.

林默的这次经历，其实只是全球每天发生的数万起网络安全事件里最不起眼的一起。你可能觉得，网络安全是网安部门、是大公司才需要关心的事，跟你一个普通大学生、普通上班族没什么关系，但事实真的如此吗？2023年中国互联网络信息中心（CNNIC）发布的《第51次中国互联网络发展状况统计报告》显示，当年我国网民遭遇网络诈骗的比例达到17.2%，其中超过60%的诈骗信息，都来自个人信息的泄露；而教育行业因为网站防护等级低、人员安全意识薄弱，已经成为网络攻击的第四大高频目标，仅次于金融、政府和医疗行业^[1]。

Lin Mo

这组数字放在林默面前时，他刚喝完第三杯速溶咖啡，手指还停留在发送邮件的确认键上。他没想到自己随手点开的匿名邮件，居然戳中了全国教育行业网络安全防护的一个普遍盲区——超过60%的高校官网、教务系统、OA系统至今仍在使用2019年之前部署的框架，其中32%的系统存在未修复的高危漏洞，而高校网安部门的平均编制人数不足3人，根本无法覆盖全校所有信息系统的日常巡检^[2]。

When this set of numbers was presented to Lin Mo, he had just finished his third cup of instant coffee, and his finger was still on the confirmation key to send the email. He didn't expect that the anonymous email he clicked on by chance actually exposed a common blind spot in the network security protection of China's education industry: more than 60% of college official websites, academic affairs systems and OA systems are still using frameworks deployed before 2019, of which 32% have unpatched high-risk vulnerabilities, and the average number of staff in college network security departments is less than 3, which is far from enough to cover the daily inspection of all information systems in the whole university ^[2].

网安中心的技术人员当天就完成了漏洞修复：他们下线了遗留的测试账号，重置了所有管理员的弱口令，给OA系统加上了双因素认证（2FA），同时把全校所有信息系统的漏洞扫描周期从每季度一次改成了每月一次。后续溯源发现，那封匿名邮件的发件人是当年开发OA系统的外包公司运维工程师张磊——2019年系统上线测试时，为了方便开发人员调试，他特意留了一个超级管理员账号，密码设为`admin123`，后来项目交付时他忘了删除这个账号，离职时又担心公司追责，不敢明说，思来想去才发了那封匿名邮件。学校最终没有追究他的责任，反而给他发放了5000元的匿名漏洞举报奖励，同时给林默发放了1万元的“白帽黑客”举报奖励，正式邀请他加入学校的网安志愿者团队。

The technical staff of the network security center completed the vulnerability repair on the same day: they took offline the legacy test account, reset all the weak passwords of administrators, added two-factor authentication (2FA) to the OA system, and changed the vulnerability scanning cycle of all information systems in the whole school from quarterly to monthly. Subsequent traceability found that the sender of the anonymous email was Zhang Lei, an operation and maintenance engineer of the outsourcing company that developed the OA system at that time. When the system was tested for launch in 2019, in order to facilitate the debugging of developers, he specially left a super administrator account with the password set to `admin123`. He forgot to delete this account when the project was delivered, and was afraid of being held accountable by the company when he resigned, so he didn't dare to speak up. After thinking about it for a long time, he sent that anonymous email. The school finally did not hold him accountable, but instead gave him a 5,000 yuan anonymous vulnerability report reward, and gave Lin Mo a 10,000 yuan "white hat hacker" report reward, officially inviting him to join the school's network security volunteer team.

林默后来在志愿者团队里又