Wikipedia contains some information about the computer systems which control the ISS. Short version is: it is a mess.
Apparently, some modules have their own systems and communication frameworks. Internally, WiFi is used. The "key systems" are documented to run Debian Linux, while they previously used Windows -- which means that these systems are basically PC, and run common operating systems. As such, they must also have the same vulnerabilities. I also expect that they don't get patched for security fixes on a regular basis. So the bottom-line is that the ISS should be highly "hackable" -- provided that the attacker gains some access to the communication network of the ISS. Hacking into the ISS from the ground would imply penetrating one of the two communication networks which link the ISS to the external world (the American TDRSS and the Russian Lira).
On-board astronauts should find it easy to take full control of the ISS systems, because it is highly improbable that these PC are physically shielded (shielding is weight, and weight is very expensive when talking about orbital things). Also there is a big Tradition in human space exploration (and human exploration in general) to keep the local human in control of things -- that's the reason why we send humans and not chimpanzees in orbit. In that sense, the ISS crew cannot "hack into" the ISS computers because they already have full control.
Gaining control of the ISS system would not buy much to any attacker. At best, they could spread some local mayhem, probably kill the crew or threaten to do so if some ransom is not paid (e.g. by swinging the robotic arm into the hull, or sabotaging the oxygen inflow, or using the the ISS orbital control engines to precipitate it down to the atmosphere, or playing some Britney Spears at full volume in the audio system). Though an atmospheric reentry may fail to burn the complete station, targeting a precise area with the debris seems overly difficult, and the impact energy would not be high, so a subverted ISS would not account for a plausible orbital bombardment weapon.
To summarize: hack into the ISS, yeah, but what for ? It is not a boat; it cannot be made to land anywhere. Its strategic military value is nil. The ISS is good for Science and Public Relations, but very useless otherwise.