BOFH: Arrr, I smell piracy ... and it's comin' from a machine with executive privileges
- Reference: 1777024815
- News link: https://www.theregister.co.uk/2026/04/24/bofh_2026_episode_8/
- Source link:
"Yes, I thought I should pass it onto you when I heard about it."
"Oh yes," the PFY nods, "We need to keep on top of this sort of thing before it gets out of hand!"
[1]
"And there's the legal aspect to consider," the Boss points out.
[2]
[3]
"Leave it with us," I say, quelling his panic.
"How will you find them?" the Boss asks.
[4]
"Torrenting is simple to track down with modern firewall technology."
"Unless they're using a VPN, of course," the PFY says.
"But even then I think we'd be able to find them," I assure the Boss.
[5]
"Okay, so how do you do it?"
"The firewall separates different types of traffic, and highlights anything which might be considered unusual. It'll then raise a flag with us."
"And... why hasn't it raised a flag before now?" the Boss asks.
"A good question. Maybe the traffic is at such a low level that it's not considered significant."
"OR, it may have always been at a high level and the firewall has 'learned' that it's normal," the PFY adds.
"They said they were downloading entire TV series - and movies," he adds.
"Hmmm." I say.
...
The Boss is concerned about a conversation overheard in the Gents at the pub across the road and wants to be sure we're not a hotbed of piracy.
...
"Well?" he asks.
"We'll just take a look at the firewall," the PFY says.
>tapity< >click< >tap< >tap< >clickety< >click<
"Hmm. No torrenting going on that I can see. Lots of web activity, but no torrenting."
"Could you stop the web activity?"
"Let's just take a breath and consider that question..."
"What?"
"You'd be 'turning off the internet' for most of our users - a move that'd be as well received as a chilli oil enema."
"Can't you turn off part of the internet?" the Boss suggests.
"Which part would you like?"
"I don't know, the piracy part?"
"Hang on, I'll just see if the firewall has a checkbox for that with a PIRACY ALARM sound preconfigured. >clicky< No, it looks like they missed that out when they were writing the software. A real oversight..."
"What are all those red items?" the Boss asks, pointing at the Firewall settings page.
"They're the firewall modules that you can subscribe to, but which we don't subscribe to."
"And what do they do?"
"Oh, well this one here, it generates a bit of additional revenue for the firewall company. The one below it generates a LOT of additional revenue for the firewall company AND also provides the firewall company with data about our networks and how they work. The next option is a cloud management option where we can expose parts of our firewall management interface to the internet in a currently secure way so that when their security is compromised we'll be toast. Great feature."
"Shouldn't we be... subscribing to some of those?"
"We did the math, and we're on the fence as to whether it's cheaper to just buy a new firewall each year than to subscribe to all the services. That said, even with our base subscription we should still be able to see torrenting."
"So why can't you?" the Boss asks.
"Probably because no one's torrenting at the moment."
"So how would you know?"
"Oh, we'll just look through the logs."
"And what will you do when you see something?"
"We track any machines down by their IP addresses and investigate."
"Which means?"
"Find the machine, uplift it and take a copy of the data - for 'evidential purposes'."
"Or possibly two copies," the PFY says. "Just to be safe."
"But only if the piracy is really bad," I add.
"And the shows are particularly good," the PFY chips in.
"Sometimes we actually let the machines run, particularly if they're part way through a download of a pre-release movie," I say, just to clarify.
"Why?"
"I... Uh... to catch the person... uhm.. when they come to uplift the movies?"
"And then what happens?"
"We could report it to HR, I guess."
"You guess?"
"We could exercise discretion..."
"It's piracy!" the Boss snaps heading off to HR to update them to DEFCON 1. "The company is exposed. HR should be the first people you call!"
>Sigh<
... half an hour later...
"There he is!" I say to the Head of HR, pointing to the Boss. "The PIRACY ALARM sounded the moment he entered his office!"
"What?!" the Boss gasps.
"Yes, we were alerted about a pre-release copy of Silo season 3 coming from this room," the PFY says
"I've not plugged my laptop in yet!" the Boss gasps. "It's still in my bag!"
"The traffic is coming from this room!" I say, as the PFY examines the data outlets on the wall.
"There!" the PFY says, pointing to a NUC nestled on the floor behind a filing cabinet. "And it seems to be powered from the light switch somehow."
[6]BOFH : If the meatbags can't agree on aircon, AI will decide for them
[7]BOFH : Are you ready to raise our expense account limits now?
[8]BOFH : What physics defines as impossible, sales calls a challenge
[9]BOFH : Nobody would be stupid enough to go live with the mirror system, surely
"That's not mine!" the Boss insists.
"Isn't that... the machine we reported stolen last week?" I ask.
"I've never seen it before!" the Boss gasps.
"That sounds like a familiar excuse," I say to HR.
"I'm not sure how we'd actually proceed with this," the Head of HR says.
"Well, we do have a bottle of chilli oil in the office we could let you have?" I suggest.
[10]BOFH: Previous episodes on The Register
[11]The Compleat BOFH Archives 95-99
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/bofh&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aeuTrQBGbh4Uptlhzahy6gAAA0U&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/bofh&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeuTrQBGbh4Uptlhzahy6gAAA0U&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/bofh&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aeuTrQBGbh4Uptlhzahy6gAAA0U&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/bofh&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aeuTrQBGbh4Uptlhzahy6gAAA0U&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/bofh&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aeuTrQBGbh4Uptlhzahy6gAAA0U&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2026/04/10/bofh_2026_episode_7/
[7] https://www.theregister.com/2026/03/27/bofh_2026_episode_6/
[8] https://www.theregister.com/2026/03/13/bofh_2026_episode_5/
[9] https://www.theregister.com/2026/02/27/bofh_2026_episode_4/
[10] https://www.theregister.com/data_centre/bofh/
[11] http://www.bofharchive.com/
[12] https://whitepapers.theregister.com/
"as well received as a chilli oil enema."
As one who once (and only once) forgot to use gloves and didn't wash his † hands adequately after processing some rather hot chillis before taking a slash, just the mention of said enema brings tears to the eyes. († "His" advisedly; "her" doesn't bear thinking about.)
Doubtless it would be exceptionally effective when not actually fatal,
The difference between a chemist and a physicist is that a chemist washes his hands before using a toilet, the physicist after.
Re: "as well received as a chilli oil enema."
This is exactly why I am always extremely careful about using rubber gloves when handling the likes of Madame Jeanette peppers, and even then wash my hands very thoroughly, and still take a lot of care not to touch any sensitive bits of the anatomy, to avoid any, let's say, eye-watering results.
Re: "as well received as a chilli oil enema."
And yet you plan to take said chilli internally?
Re: "as well received as a chilli oil enema."
Certainly. Quite tasty, I find. Half a teaspoon of the sambal setan (or devil sauce) I make with Madame Jeanette peppers on a full plate of food suffices, as a rule.
Re: "as well received as a chilli oil enema."
As a fine of the spicy myself might I suggest Habaneros or scotch bonnets?
Habaneros are usually slightly less hot than the good Mme, but a bit sweeter.
Scotch Bonnets are another good choice if you prefer the color to be lively like the taste.
On something like pulled pork, or mixed into a gravy poured across a roast both are amazing. With Stewed Okra, or Eggplant they make you forget you're either a slimy squishy veggie.
Re: "as well received as a chilli oil enema."
I also use Habaneros. A bit sweeter indeed. Haven't used Scotch Bonnets yet
Re: "as well received as a chilli oil enema."
A standard bleach solution, check the bottle for instructions, alters the capsaicin to make it water soluble so it'll come off easily with soap & water
Re: "as well received as a chilli oil enema."
Or, less harsh on the skin, wash your hands with cooking oil, followed by washing-up-liquid, followed by soap and water. Capsaicin is fat-soluble, the oil dissolves it, the washing-up-liquid solubilises the oil, the soap and water removes it.
Better than putting bleach on your skin, which is arguably worse for it than chilli.
Re: "as well received as a chilli oil enema."
That's my recipe as well oil -> washing-up-liquid -> soap -> water.
Re: "didn't wash his† hands adequately after processing some rather hot chillis"
Heh, amateur hour! I've done that multiple times and only experienced an uncomfortable warm burning sensation for a while. It wasn't that bad :-) I've also then thrown the large handfuls of mixed chopped bird's-eye, scotch bonnet and jalapeño that resulted into an excessively hot wok, which led to my discovery of how to fill your own house with clouds of homemade tear gas! My red Thai curry was so hot that I had that Hans Blix knocking on my door looking for WMDs!
I've also eaten a drop of pure capsaicin extract that was about 1.5x the strength of CS gas. That literally incapacitated me for about 45 minutes.
I think that all this exposure therapy might have helped me last year when I was (illegally, I might add, but it's a long story) pepper-sprayed point-blank in the face by the local police, and I was able to pretty much shrug it off.
Bloody hell, I haven't half been through some wacky shit in my life :-D
Re: "didn't wash his† hands adequately after processing some rather hot chillis"
At university, one guy in our flats used to make a curry he named "Wallpaper stripper." And that was from the steam while it was cooking....
There was an antidote ---->
Re: "didn't wash his† hands adequately after processing some rather hot chillis"
I used to work with a guy who liked very spicy food. He bought into the office a bottle of his home made extra strong sauce.
After warning the office that a tiny amount could numb your tongue one person decided he would have a heaped tablespoon. He was advised to not do it but did it anyway
About 10 minutes later you could have used him as a navigation beacon and he was sweating so much it was visible going down his face. We had no choice but to bundle him into a car and send someone to drive him home.
We next saw him 5 days later…..
Re: "as well received as a chilli oil enema."
I once prepped about a half pound (220 grams or roughly 70 cents US) of habaneros without wearing gloves and the tips of my fingers tingled for days.
Re: "as well received as a chilli oil enema."
"The difference between a chemist and a physicist is that a chemist washes his hands before using a toilet, the physicist after."
I don't know about physicists, but biologists for sure.
I think most people who torrent use
VPNs nowadays.
Of course it may be odd to see a VPN connection initiated from inside the network when they probably have no legit reason to do that.
External torrent boxes are probably better.
With that said, it's always a good idea to take copies of whatever is torrented for evidence - especially if it's something interesting ;)
Re: I think most people who torrent use
I've occasionally needed to VPN out of my company's network, albeit into other company or partner networks. You could detect which VPN I've connected to and identify whether it's a trusted one relatively easily, but it's more complex than all VPNs being unexpected.
Re: I think most people who torrent use
Ii thought that once when a couple of us from the UK went to a European site to do a data centre migration while they were closed for summer.
We saw some data traffic via the firealls when everyone should have gone home. We waited and it was still going. Said IT boss of the site went around and cofirmed only us 3 were there.
We traced the taffic, go the IP, accessed the machine with our creds and saw a "torrents" folder. Happy days, portable HDD now being removed from the bag in preperation.
Looked at the users folder and said the user was the IT bosses deputy with a huge HDD for those days.
So, we sorted the machine, went into the folder to "gather evidence" for later viewing....... lets just say the names of the folders stopped us dead in our tracks !
Said IT deputy kept their job, but I wouild love to have been a fly on the wall for that meeting.
Re: I think most people who torrent use
Unless you're using AWS or connecting to a partner company or a maintained remote site or an number of other reasons why you'd need a VPN
Re: I think most people who torrent use
Back in the day when bandwidth was limited and expensive but $BIG_COMPANY where I worked had a bunch of T1s, I soon found out that it was nearly impossible to distinguish legitimate SFTP file transfers from less legitimate transfers running over an SSH tunnel. And guess what - it still is.
A few years ago, a colleague got a stern email from IT saying they'd found MP3s on her computer and that they needed to be deleted ASAP or her manager/HR would be informed...
The selfsame IT guy then came to her desk and told her to leave them there until the next day before deleting them "in case she had anything good"
This actually happened to me!
Well, not the chilli oil enema bit, and it wasn't the boss, it was $SMARTARSE_CONTRACTOR, but anyway, this was quite a few years ago, and I was working for a startup in the short-lived UWB/Wireless USB field. I was mostly a developer, but I was also assistant admin - not a PFY; I had been the only admin when the headcount was only a dozen employees, and we took on a full-time admin as we expanded.
Anyway, the hardware boys in the testing lab had been constantly complaining about having to log in to their testing PCs - apparently passwords are a software thing that hardware guys just can’t comprehend - and management wanted us to do something to keep them happy. So, against our better instincts, we gave them a shared, passwordless login for the lab PCs just to shut them up. (We also cordoned off the lab PCs in an isolated subnet separated from the main network - we weren’t mental!)
Not that much later, we had an afternoon when the entire office network and internet access were running really slowly and everyone was complaining. It only took a few minutes rummaging through the firewall logs for the head admin guy to identify the problem: one of the lab PCs was hogging every bit of bandwidth we had with BitTorrent traffic. I marched on over to the lab, yanked the network and power cables from the offending PC and seized it. The network immediately recovered.
After that, I took the hard drive out and set it up - read-only of course - as a secondary in my own PC. $SMARTARSE_CONTRACTOR probably thought he was being pretty slick by using a shared login for plausible deniability, but he had reckoned without the browser cache and history. The sequence of events was plainly recorded. He had been logged into his Yahoo email in his own real name; he received an email with a torrent link to the brand new Narnia movie that had literally just been released in cinemas that day; he searched up the uTorrent client, went to the download page and downloaded the installer; he ran the installer (timestamps on the Program files directories were consistent); went back to his Yahoo email for the torrent link again; and then the torrent chunk files started getting created at around the same time everyone noticed the network getting congested.
Anyway, we presented all the forensics to management, and I think HR got involved; we deleted the torrent client and data files and restored the lab PC, and then… nothing much happened. Management wouldn't go back on their insistence that logging in was too onerous for the precious hardware snowflakes, and $SMARTARSE_CONTRACTOR didn’t get insta-fired, although I think his contract might not have been renewed when it was up. Me and full-time admin guy spent the rest of the day face-palming, but overall, not a single lesson was learned.
People, eh? What a bunch of bastards! :-/
Re: This actually happened to me!
Not a single lesson learned?
You didn't learn to bandwidth-limit untrusted lab computers?
Torrent Backups
"I'll just get this for you," said the BofH, blocking others' view of the NUC with his body, powering it down, and palming the USB thumbdrive with a pre-release copy of Silo season 3 which was attached to the NUC.
Fortunately the thumbdrive contained only backup copies of the torrented material stored on the NUC's internal drive.
Torrent backups / replication
I use Resilo Sync which is torrent based. Surprisingly, never had anyone complain when I have taken my laptop to a client and logged onto their guest network. Once site I was in almost every day for 18months and not a thing (we had a guest wifi account which had to have a valid email address and a valid internal sponser address [my own client provided account sufficed as the sponsor], so a double check that my laptop torrenting was me !)
Chilli Enema
Burns on the way in, burns on the way out.
Is that why they call it a firewall?
Re: Chilli Enema
If you follow the Web Comic Grrl Power, the main character whose surname coincidently is Scoville*.
TLDR she gets stranded a deep space trading post eats Grakz (The spiciest/hottest food in the galaxy) with ease proclaiming it to be no big deal.
Her superhero name is Halo, but has a different ring of fire when she later discovers it's 10x hotter on the way out, than it is going in, not only that but tends to turn the air red with little "motes of plasma" that float around the person in the act of voiding their bowel.
Pages #686, #711 & #712 the comic is occasionally NSFW.
Quite a while ago, I became the defacto network administrator for a remote office of a client location for the project I was working on for a short while. There were direct network links to the main client office, but general internet access for corporate mail was provided by an ADSL link, just normal consumer grade ADSL.
For a few days, people started getting dropped VPN connections to the corporate network going via the ADSL link. They would not stay up long enough to synchronise the Notes database copies.
I was asked to investigate, so I turned on monitoring access to my desk from the managed switch connected to the ADSL router, and fired up Etherape to identify the traffic.
But there was a strange thing. Total download traffic was below the inbound speed of the ADSL link, but TCP sessions were still breaking down. Looking at the traffic for a while, I identified that someone was using the eMule protocols to download media, and as this is a peer-to-peer filesharing protocol, it was also generating significant outbound traffic. We found that the transmission of the data to the gestalt was saturating the uplink of the ADSL connection ( Asymmetric Digital Subscriber Line), and we were getting timeouts on the outbound TCP ACK packets, leading to the far end repeatedly re-transmitting packets that had actually been received correctly.
From the manual DHCP address allocation I was able to work out who had the guilty system with the registered MAC address.
Senior manager took a quiet walk down the corridor to find the culprit, who didn't contest the evidence, and they were given a stern warning not t do it again. Sanity returned to the network straight away, and I never had the problem again.
combined efforts
I feel that Simon should work to combine the new chilli enema with proximity to open windows.
Re: combined efforts
Pants: You mean you crap out of the window?
Blackadder: Yes.
Mrs. Pants: Well in that case we'll definitely take it. I can't stand those dirty indoor things Well in that case we'll definitely take it. I can't stand those dirty indoor things
Re: combined efforts
So the victim patient dives head first out of the window?
New boss -> ex-boss.
No wonder he didn't last long. Far too inquisitive.