Ruka: I don't think Lazarus did anything, but was merely notified (how, I don't know) of such lax security.
I believe it was UAC's mistake in allowing students to login, via particular timestamps (if I'm not mistaken). I tried to replicate it, but to no avail.
Lazarus was merely providing a means to access (legitimately, I might add
) UAC - which, under normal circumstances, users should not be given rights to (entering their UAC numbers and PINs, at an early stage).
I could be wrong, but that is what I think.