@ui3oJul 18
Lesley Carhart 

The absolute funniest shit is the cybersecurity consultants who are trying to advertise they would have stopped a startup CEO from going to a sold out show with a side piece

My sibling in Cthulhu, you wouldn’t stop them hiring an escort on their work laptop with admin rights and AV removed

Jul 18 at 1:41amWeb
Show threadLesley Carhart Jul 18
I was at this one startup once and the industrial network had a nice clean hole through all the firewalls just so the CEO could change the ac temp from her iPad.
Show threadF3715HJul 18
@hacks4pancakes WTF!?
Show threadKevin Karhan Jul 18
@F3715H @hacks4pancakes yeah, I had the same thought.
Show threadAlan Miller  🇺🇦Jul 18
@hacks4pancakes was it going to a control system running on an XP box?
Show threadBen RushJul 18
@hacks4pancakes I've seen similar and worse from my MSP days, would that I could tell those stories in the open… It was all just so… dumb
Show threadJoe Cooper 🇺🇦 🍉Jul 18
@hacks4pancakes I've had management folks give out our domain registrar administrative password to random contractors, including a spammer they hired to send marketing emails. I've had to explain on a couple of occasions that that's very close to the most dangerous thing they could do (management doesn't have access to do more directly dangerous things, but a patient and smart attacker with registrar access could escalate to owning everything in time).
Show threadSebastian FourierJul 18
@swelljoe @hacks4pancakes lmao amazing
Show threadfraggLe!Jul 18

@hacks4pancakes I gotta gloat about where I work for a minute... when we first started locking things down I gingerly brought up that *maybe* the CEO didn't need the Owner access to all the things he'd had since the company was a four-person squad?

"Ahh yeah that sounds reasonable" just like that, no fight or anything. Almost surreal. It was completely unexpected.

Show threadAlun JonesJul 18
@fwaggle @hacks4pancakes over twenty years ago, I tried to start a campaign to get Microsoft to rename the Administrator account / group to "Janitor". This is how CEOs should view that kind of access.
Show threadargv minus oneJul 18

@ftp_alun

Relevant trope: Almighty Janitor
https://tvtropes.org/pmwiki/pmwiki.php/Main/AlmightyJanitor

@fwaggle @hacks4pancakes

Almighty Janitor - TV Tropes

Some works of fiction live and die on rankings. The characters have their own power hierarchy, but usually you'll find that each character's power level is consistent with their rank. Then there's the Almighty Janitor. The Almighty Janitor is …

TV Tropes
Show threadRaven667Jul 18

@fwaggle @hacks4pancakes I've probably told this story Mastodon before but the one time our lead sysadmin wanted to see what `rm - rf /` would do (on a desktop the CEO was returning which was being wiped for reinstall) we were waiting a long time with no HDD blinky light so they jumped on another terminal to strace the rm and the other bystander Alex said "hey, those are my mp3 files!". Turns out the CEO had set up the automounter to mount everyones home directories with `norootsquash` (why??) so the delete process started traversing into the first users home directory it found alphabetically.

Thankfully nothing was permanently lost, we were able to restore from backup and/or he was able to resync his files but that was a learning moment for everyone involved (except the CEO, I'm not sure we told him that we knew he backdoored our homedirs instead of using his admin access over ssh which would have left an audit trail, he already had a legit way to access someone's personal work files if necessary)

Show threadsaxnotJul 18
@hacks4pancakes every enterprise firewall ever
Show threadred sixJul 18
When I worked for TIS, it was common practice to review the full log on a Gauntlet firewall to diagnose problems. Our logs always rotated at 2AM. Back then it was likely to be 2AM local. Guaranteed someone was surfing porn in the first few log entries…
Show threadLesley Carhart Jul 18
@moonbase.shado.info oh, the amount of porn we saw before pervasive ssl
Show threadRichard JohnsonJul 18

@hacks4pancakes @moonbase.shado.info

Thinking back to EtherPEG [1] displaying pics captured live from wifi on a conference session backdrop screen.

Attendees could certainly tell when the presentation became boring.

[1] http://www.etherpeg.org/

EtherPEG

Show threadKee HinckleyJul 18
@tab2space @hacks4pancakes @moonbase.shado.info I ran that once during a work meeting. Fun guessing who wasn't paying attention.
Show threadRaven667Jul 18
@hacks4pancakes @moonbase.shado.info one of the first things I advocated after we started deploying Snort was disabling the "Kickass Porn" rule category after it hit a few times for customers, we were contracted to monitor for actionable evidence of compromise, not trolling for HR issues and I didn't really want to know what flavor of erotic stories our customers preferred 🤮
Show threadducksauz 🦆Jul 18

@moonbase.shado.info

Gauntlet! Oh the memories... 😁
One of the companies I did a staff augmentation gig c. 1997 ran it. It was great for the time.

Show threadJulianCalabyJul 18

@moonbase.shado.info IT at a place I worked for had the bright idea of showing images downloaded through the corporate internet connection on a small screen over the cube farm to try to shame the people who were viewing porn.

It took me a day or two to build a clock image generator to spam it with.

It didn't last the week.

Show threadBJ Swope ➖1d ago
@moonbase.shado.info Gauntlet firewall…have you had your annual prostate exam this year 😜
Show threadAnilJul 18
@hacks4pancakes very cool 😎
Show threadTurnipCannonJul 18

@hacks4pancakes reminds me of the one port without NAC at an office I was red teaming, because a VP wanted THEIR printer (that didn't support 802.1X).

So that's where I plugged in my implant

Show threadargv minus oneJul 18

@TurnipCannon

I mean, it's a printer. Even with 802.1x and whatnot, there's probably a dozen vulnerabilities in the damn thing that'll never ever be patched.

@hacks4pancakes

Show threadAlun JonesJul 18
@hacks4pancakes the same CEOs will read an article about RowHammer or Spectre, and ask what your team is doing to prevent these urgent and important security issues.
Gee, Bob, I don't know, maybe when I stop having to open up the firewall to your day trading app, or shorten the mobile unlock PIN length to 4 because you're concerned you'll have an accident typing an 8 digit PIN while driving, or any of a hundred other stupid things your C-Suite and EVPs insist on (AI, NFTs, Cryptocurrency...)
Show threadBöotesVoidJul 18
@hacks4pancakes I'm IT adjacent and the stuff executives do that increases company risk to astronomical levels and can get away with in general is very depressing
Show threadKallisti1d ago
@hacks4pancakes Many such cases
Show threadjaKa Močnik1d ago
@hacks4pancakes technology should serve the people! 🤪
Show threadNullstring 🏴‍☠️Jul 18
@hacks4pancakes i dont understand why the whole story cant just be about this dude being a dipshit
Show threadLesley Carhart Jul 18
@0x00string the lady is a dipshit too
Show threadNullstring 🏴‍☠️Jul 18
@hacks4pancakes did she do an apology letter and if so... was it the dippest shit thing ive ever read? mf really said "i was tryna have a private moment at the sold out stadium show with the kiss cam" like that made it other peoples fault some how
Show threadNullstring 🏴‍☠️Jul 18
@hacks4pancakes what a pair of dipshits
Show threadzaicurityJul 18
@hacks4pancakes @0x00string maybe all she wanted was to see Coldplay.
Show threadRyan FinnieJul 18

@hacks4pancakes I saw everyone start posting about this at the same time, and was like "am I supposed to know who he is or who she is or what the company is?"

(As it turns out, no, no and no, respectively.)

(I am vaguely aware of what Coldplay is, at least.)

Show threadLesley Carhart Jul 18
@ryan it’s just schadenfreude; we Stan an AI CEO getting caught
Show threadAgas Ramirez 🎙️Jul 18
@ryan @hacks4pancakes it's absolutely hilarious because I'm required to log into LinkedIn every single day and this is the first time that website has been even remotely interesting to me 😂
Show threadAlan Miller  🇺🇦Jul 18
@hacks4pancakes "sorry, this isn't a technical issue, this is just bog standard poor management decision making"
Show threadKim ScheinbergJul 18

@hacks4pancakes
I knew of an affair between a very high profile CEO and an employee

To have been discovered would have blown up his life & multibillion dollar company (it was a different time, when these sorts of things had consequences)

When I tell you that the harder she worked to keep them from being discovered, the harder he worked to "carelessly" leave evidence for wife & employees to find...

It's not just that they're spoiled. It's that the thrill of getting caught is part of the draw

Show threadrtificialJul 18
@hacks4pancakes or the ceo saving xhamster porn to the company 365 cloud storage.
Show threadColinJul 18

@hacks4pancakes Many years ago company I worked for had told people there was a porn filter in the Internet connection, which was a blatant lie. I knew it was a lie as I sometimes helped with some infrastructure stuff. Mentioned that it wasn’t real at a staff event to the General Manager who I assumed knew this. Who immediately yelled “WHAT! I HAVEN‘T HAD ANY PORN IN SIX MONTHS.”

So anecdotally lying might work for a while if you remember who is being lied to, but it’s not a strategy I’d endorse. Somewhat relies on no one checking.

Show threadPaul_IPv6Jul 18

@hacks4pancakes

the absolute worst for insisting on opening holes in security/firewall for their BYOD that is probably more infected than the runoff from a sewage treatment plant are C-suite execs.

Show thread4dw@r3  🦬Jul 18
@hacks4pancakes how in the world is someone so self involved that they think they could have stopped this? Unless obviously it's yourself then they could stop it easy by just not having a side piece.
Show threadBird WainerJul 18
@hacks4pancakes I know it's not the point, but "My sibling in Cthulhu" is my new favorite phrase and I will be shamelessly stealing it (with proper attribution)
Show threadPhillip Jul 18
@hacks4pancakes Brb, stealing “my sibling in Cthulhu”