Your security failure was so bad we have to close the company .... NOT!
- Reference: 1682926274
- News link: https://www.theregister.co.uk/2023/05/01/who_me/
- Source link:
Or will they?
This week meed a man we'll Regomize as "Thaddeus". Thaddeus was the chief technical officer of an organization a decade or so back – a position of some authority, with employees who looked up to him with trusting eyes.
[1]
Reporting to Thaddeus was a head of operations, who we'll Regomize as "Max".
[2]
[3]
As was appropriate, Max had access to all of the firm's computers and systems. Also, Max's younger brother was living with him at the time, which Thaddeus knew about. All of this background is important, trust me.
One morning, Max called in to work to say he would be late. It seemed that his brother had enrolled in an online course about "ethical hacking" and some of his activities connected to the course had attracted the attention of the constabulary.
[4]
The result was the cyber crime squad arrived and, with sirens blaring and battering rams held high, raided Max's home, literally breaking down the door, shouting "POLICE POLICE" and confiscating every bit of computer equipment in the house.
You have to wonder what they thought he'd done. Thaddeus, tragically, provided no detail about the alleged hacking.
Max therefore told Thaddeus that he would be late, and also that one of the computers confiscated was a laptop that belonged to the company – an innocent bystander caught up in the maelstrom.
[5]
Thaddeus was understanding, and set off to explain the situation to management.
At which point an imp whispered mischief into his ear. He went to see the HR manager, "Susan", and asked her to play along with him.
[6]Support chap put PC into 'drying mode' and users believed it was real
[7]Student requested access to research data. And waited. And waited. And then hacked to get root
[8]Pager hack faxed things up properly, again, and again, and again
[9]Defunct comms link connected to nothing at a fire station – for 15 years
When Max arrived, Susan called him into her office, where Thaddeus was waiting.
"Max," he deadpanned, "our legal department has had a request from the police to provide them with all computers and systems to which you have access. Essentially this means we have to turn over our entire production system, so the firm is going to have to fold …"
Max, in Thaddeus's words, "went dead white and collapsed in a chair." Like he hadn't already had a rough day.
Thankfully Susan didn't quite have Thaddeus's composure and cracked up laughing, at which point Max realized a joke was afoot. He fixed Thaddeus with a look and muttered "I will get you back."
And fair enough too. We get lots of stories about employees pranking bosses here at the Who, Me? desk, but a boss pranking an underling? Are there no rules?
As a postscript, Thaddeus says the police eventually realized that Max's brother wasn't actually up to any ill, and returned all the computer equipment. They even fixed the door and apologized.
Max, however, is yet to get his revenge on Thaddeus.
So "Max" if you're out there and this story sounds familiar, here's your reminder. Thaddeus has it coming.
If you've ever got away with something at work that maybe you ought not to have got away with, tell us about it in an [10]email to Who, Me? and we'll ease the burden of your conscience.
Get our [11]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZE@Nw9JYeC2SPq6q3dfRUgAAAIQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZE@Nw9JYeC2SPq6q3dfRUgAAAIQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZE@Nw9JYeC2SPq6q3dfRUgAAAIQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZE@Nw9JYeC2SPq6q3dfRUgAAAIQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZE@Nw9JYeC2SPq6q3dfRUgAAAIQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2023/04/24/who_me/
[7] https://www.theregister.com/2023/04/17/who_me/
[8] https://www.theregister.com/2023/04/10/who_me/
[9] https://www.theregister.com/2023/04/03/who_me/
[10] mailto:whome@theregister.com
[11] https://whitepapers.theregister.com/
We know you exaggerate these stories but please...
> Thaddeus says the police eventually realized that Max's brother wasn't actually up to any ill, and returned all the computer equipment. They even fixed the door and apologized.
... don't just straight-up lie.
Upside down images
Many, many (really many) moons ago...
One day my boss went on a ski holiday. I, as the sysop and netadmin, went about to install a transparent squid proxy and configured the network to route any and all web request through the proxy. But only his computer's request were run through the proxy.
Squid was configured to intercept all image request (jpg and png), which would be retrieved using a special script. The script would mirror some images so they appeared upside-down. Not all images were altered, but progressively more were altered and mirrored.
The boss returned and started to show images of his ski performance.
Day one would change 10% images. Not many, but noticeable. The errors are dismissed as "I uploaded them wrong"
Day two saw 30% images mirrored. The boss started to have problems and thought some computer issue was at hand
Day three has 50% of all images mirrored and the boss started to doubt his sanity. Nothing he did could solve the problem. And, of course, neither could the support crew find any problems (me and my colleagues).
Day four and 75% of all images got mirrored. We finally cracked up after the boss started to pull out his hair. The entire support crew was on the floor trying to breath in between the laughter.
Success :-)
BTW, the boss said it was a great joke.
Refuelling
Our boss inadvertently filled his (company) car with the wrong fuel. He tried to keep it secret but we were too clever for that. We were also impish so he didn't know that we knew.....
Smallish office and it was my turn to make the teas and coffee. The boss always had coffee.....
I 'inadvertently' made him a cup of hot chocolate and when he stepped out of his office to query the mistake I replied: "Oh no! I haven't poured the wrong drink have I?"
His eyes rose towards the ceiling as he realised he had fallen for the ruse and the resultant laughter all round only served to compound his embarrassment. He was a good sport and although he threatened a reprisal he became very wary of stepping into another trap. But that's another story.