Why should I pay for that security option? Hijacking only happens to planes
- Reference: 1642753809
- News link: https://www.theregister.co.uk/2022/01/21/on_call/
- Source link:
Our tale comes from a reader Regomised as "Ed" and is set earlier this century. Ed was working as a developer in a biotech lab. He rarely spoke to the director, but did speak to the director's personal assistant a lot.
This PA was very much a jack of all trades (and master of... well, you get the drift). HR? He was in charge of that. Ops? That too. Anything technical? Of course. Heck, even though the firm had its very own bean counter, one had to go through the PA to get anything paid or budgets approved.
[2]
"He was also kind of a Know-It-All who didn't like to be shown wrong," muttered Ed, darkly.
[3]
[4]
One project the team was working on required a website so a domain name was needed. This was a first for the lab, and while the skills were in place to code up the site, actually registering a domain name was an entirely new experience for the department.
"So the PA came to me and asked if I knew how to do that. It happened that I was very familiar with the process, since I had registered myself multiple domain names."
[5]
Excellent. Ed trotted off the PA's office and went through the procedure. "Since I knew I would not be the one managing the domain name ( he would, of course), I was careful to suggest a registrar offering a very user-friendly dashboard for DNS configuration," he told us.
Back then, such wizardry was not standard. "I remember actually having to call to change my DNS settings with my first registrar in the mid '90s," Ed said. Luckily for the PA, things had moved on in the years since.
Ed went through the steps up until an option was reached to lock the domain name. The cost was a dollar ("this option was not always free at the time," recalled Ed) and the PA grumpily complained about it. Why should he pay for it? Ed patiently explained that it was a safety measure against domain name theft and, frankly, a small price to pay when one considered the consequences of a hijack.
[6]Planning for power cuts? That's strictly for the birds
[7]To err is human. To really screw things up requires a wayward screwdriver
[8]A time when cabling was not so much 'structured' than 'survival of the fittest'
[9]It's the day before the grand opening but we need a firmware update. It'll be fine
Harrumph. The PA reluctantly agreed and checked the box. Sorted.
"He hushed me away," said Ed, "looking excited to be what apparently felt to him like being the captain of a new spaceship within the interwebs space."
[10]
Bless.
Sadly, the voyages of Starship Interweb were short-lived, and a few months later Ed got The Call. The PA was very unhappy – he'd received an instruction for an urgent procedure regarding the domain name, but couldn't execute it. And it was all Ed's fault.
Ed rushed to his aid. "At first, looking at his screen," he said, "I had no idea what he was trying to do."
He asked to see the instructions. Ah
What the PA had received was a scam message. It requested he make a change, the upshot of which would be to transfer control of the domain to the scammers. All that had stopped him from executing it had been that domain lock. The option that he had complained about selecting.
As a seasoned professional, Ed was able to maintain composure and conceal his glee as he explained how close the PA had come to transferring the domain to the scammers.
"As understanding dawned on him," said Ed, "the blood drained from his face before he turned around and told me I could leave, which I did promptly, in awkward silence."
Nothing was spoken about the incident ever again. Not the angry call for help, nor the scammer's request. While the fiction that nothing had happened was maintained for years, we'd like to think that the taste of humble pie remains.
Ever helped out and received an angry call that nothing was working and it was all your fault? Or extracted a boss from some potentially hot water with your sole reward being the knowledge that only you and he know the muppetry that almost happened? Share your moment with an email to [11]On Call . ®
Get our [12]Tech Resources
[1] https://www.theregister.com/Tag/on-call
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YeqScLz9mBvSe8o5x7YDTwAAABc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeqScLz9mBvSe8o5x7YDTwAAABc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeqScLz9mBvSe8o5x7YDTwAAABc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeqScLz9mBvSe8o5x7YDTwAAABc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2022/01/17/who_me/
[7] https://www.theregister.com/2022/01/10/who_me/
[8] https://www.theregister.com/2022/01/03/who_me/
[9] https://www.theregister.com/2021/12/27/who_me/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeqScLz9mBvSe8o5x7YDTwAAABc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] mailto:oncall@theregister.com
[12] https://whitepapers.theregister.com/
Ah, yes. The dreaded "fix it NOW!" call ...
The magnitude 6.9 Loma Prieta earthquake hit us on October 17th 1989, at 5:04 PM-ish Pacific time. It was centered approximately 30 miles SSE of my home. PG&E power and Ma Bell landlines were out over almost all of the Bay Area. My acting boss called my obsolete and due to be replaced DynaTAC at 5:10 PM & screamed that he would fire me if I didn't fix it immediately. I told him that he needn't have wasted money on the phone call, he could have just opened the window and bellowed. And then I hung up.
I have hated cellular telephones ever since ... not because of what they are, nor what they can do, but rather for how they are actually (ab)used.
Comeuppance!
Ed was able to maintain composure and conceal his glee. I remember letting a situation like this simmer for a few days... finally the cocky Know-it-All's boss had to intervene. I remember asking myself how could mgmt go forward, and objecting, only to be told in polite terms to shut up. The silence when the boss came to me was sweet, I just glared back... no words, no change of expression, just my glaring back poker face.
Not me, but and older guy in my early days
A humble worker bee, who was a wiz at all things inductive, was tasked with winding a transformer for the R&D dept.. He took one look at the details, and said it wouldn't work. Whereupon he was haughtily told to just do as directed - which he did. There was a major inquiry when the thing went up in smoke, with our man accused of all sorts of nasties by R&D. The real boss decided to get an independent expert opinion who did a few calculations and confirmed R&D were wrong - the ratio in the spec was an order of magnitude out.
Our man suddenly disappeared from the factory floor, and for a while we all thought he had been made a scapegoat, until some weeks later he was seen in a suit. It took a while for the whole story to filter down, but apparently he'd been transferred to R&D
"the blood drained from his face before he turned around and told me I could leave"
I would not have left promptly.
I would have stalled just a few seconds, looking him straight in the eyes, before slowly turning and exiting the room.
The silence might have been awkward, but not for me.