Security

Ask something
Discussion Locked

Insider Hacking

0 helpful
53 replies

by cryo 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Boy this is a hard one to swallow.

While running an after hours audit of users systems we found a user machine that was running an application called LC3; which is a tool used for sniffing a network for account names and passwords then cracking said passwords with, up to, brute force ability.

Needless to say, I and the other member of the IT staff were floored at such a brass attempt to compromise internal security. What made it worse is that it was being done by an executive of the company (VP of Sales).

All of the IT department (all two of us) and the HR manager gathered as much information as we could. We read through the Company Security Policy (thankfully it was recently updated), we poured over the documentation for LC3 tomake sure it didn?t have any other uses. We found the logs from where he downloaded the application (from his son?s website, a known hacker), we documented when he installed it and how long it was running (three days on brute force mode). The CEO even involved the company attorney for this matter. And after a two week hiatus and another week sitting on the decision the CEO has decided to do nothing more than slap the hands of the VP, requiring him to sign papers ?claiming this is his last chance,? and tightening security on his workstation.

Here?s my dilemma: Is this right? From everything I?ve ever read in regards to situations like this the employee is terminated on the spot and walked out the building. Also, what?s the likelihood of the employee trying it again?

Any feedback would be greatly appreciated.

53 replies

by generalist

VP of Sales doing cyber-snooping?

I'd keep the evidence available and consider looking for a new VP of Sales. Given the apparent size of your organization, the person could be deadly if they are trying to steal company secrets.

You might check for other evidence of spying, especially if the VP has close ties to other countries. If you are a high tech niche company, there might be a chance that the person is trying to get technical secrets that could enable another country to duplicate your company and undercut your prices.

by admin

Instead of tightening security, what about some good monitoring and catching him immediately the second time? I'm not suggesting: "Honeypot" or entrapment, but just leaving things as is and automating some logs of his activity or maybe automate somescans of his WS?

I am surprised they didn't see it as someone coming in and cutting the file cabinet open, which surely must be aginst policy and procedure. It makes me wonder if there is a behind the scenes sort of something with the CEO giving him another chance though. Politically it would be good to know this before doing anything.

by mckaytech

I am aware of a situation in which an employee of a State agency hacked another State agency's systems and, by policy and State law, should have been terminated immediately and probably criminally prosecuted as well.

But because he had a talented attorney who (I believe) threatened a "whistle-blower" lawsuit based on what he found on the system he hacked, he is now a protected employee and cannot be held accountable for his behavior. "Whistleblower" suits potentially incur triple damages, a credible threat of one cowers most employers and particularly those with deep pockets.

His days are numbered, certainly, but the failure to assign consequences to his hacking was tremendously damaging to the employer and to his colleagues.

So, these things do happen. More often than they should and it does offend both decency and justice.

As far as the risk of it happening again, that is very difficult to predict because it depends on intent and opportunity. If it was simply done out of curiosity, the offender probably won't risk it again. However, if it was an attempt to harm the company it will almost certainly happen again and once he leaves your company, it will probably happen at subsequent employers as well.

by douglas.osowski

LordALF:

This can be viewed one of two ways, either the VP of sales has something over on the CEO or he carries a lot of weight in the company. Ask yourself this question; what is he to gain by cracking these passwords? There has to be some kind of benefit in it for him to be doing this either he likes to live dangerously or he feels that this is a challenge. He must be a valuable employee for the CEO not to terminate his employment.

by lordinfidel

Since we, the admins, are not the executives, we can not really have a say in their actions.

But what we do have a say in is corporate computer policy.

If I was you, I would take this oppurtunity to enforce the "NO INSTALLING OF PROGRAMS" doctrine. Maybe the execs did not see this as an action for firing. Maybe the vp really did not know what he was doing and was messing around.

On my network, software installation offenders are somewhat scolded by the execs. But I take it a step further. I build them a new machine (either NT or 2K) and lock it down so that they can not install any programs on it.

You have a really good oppurtunity here to change the climate. Make sure you inform them of the security risks that free lance software installation entails. Especially in the $$$$ department. Plus the company can also be criminially liable it was pointed towards anyone elses network.

But never second gueess the ceo when it comes to hiring/retention. That is one pissing match you do not want to get into.

But your right, it's not right, he should of have been let go. (which is why I'm not a ceo) I would be pissed to and I would monitor that employee like a hawk.

Good luck

by epepke

and are running it yourself. Back in the day, we regularly ran password crackers on all the academic systems. At first, about half the passwords could be cracked in 15 minutes or less. We had the affected users change their passwords and enforcedtighter password rules until nothing could be cracked via the current technology.

by cryo

First off, thanks for all the posts thus far.

Some additional information that I didn?t post originally, and some answers to comments a couple of you have made:

1. The application that was installed was a cracked/illegal version of the program. So that?s two strikes (one: it was installed without IT?s knowledge and two: it?s an unlicensed copy).

2. We are a high tech niche company for our industry and we are in direct competition with some high profile companies.

3. The reason given for keeping the employee is that, ?this is bad timing.? The other excuse given was that he?s directly involved with customer dealings and if he was dismissed then customers would be dealing directly with the Director of Development. My point is?when is a good time for something like this?? Better that we caught it in the act then find out later when something more devious may have happened.

4. As far as what he could have gained? Well, since he was sniffing the network for name/passwords he ?could have? gained access to virtually anything. He could have swiped a Domain Admin?s password or even the account info for payroll. Hell, the application could have captured the account info of an employee trying to access their online brokerage account. Thankfully we caught it in the act and all corporate passwords have been changed. Also, we ran the application on our network and captured a few of the passwords to see how long it would have taken to crack. We employee a minimum8 character minimum with a special character and numeral character required. Needless to say we ended the app after running it for a week and a half. So I think it?s safe to say the he ?probably? didn?t get anything.

Again, thanks for all the replies so far.

by generalist

I'm hoping that the employees in your company have all signed nondisclosure agreements that have teeth in them. I would also recommend that the company attorney brush up on enforcing such just in case the VP of Sales decides to jump ship.

If theVP of Sales does jump ship, nail him if you can as long as the evidence is solid. Of course, you might have problems if he goes outside the country. At that point you may have to resort to trade sanctions against the company he ends up at.

Alsowork on a plan to reestablish the sales contacts with your customers if he leaves. After all "It takes months to get a customer and seconds to lose them".

by cryo

It seems management is taking a rather ambiguous approach to this whole ordeal. While I have been informed to what the decision is, I have not been told that it is set in stone yet. Meaning the VP has not been given his workstation back yet he still works from his office using his laptop. Supposedly papers are being drawn up for him to sign yet I haven?t been told of when they?ll be ready or what they?ll entail. Nor has HR for that matter.

Again, thanks for all the posts.
-LordAlf

by james r linn

Once a month we run them against the NT Domain passwords and the Unix passwords to see what percentage would be cracked in 24 hours.

We pay special attention to superuser passwords or admin passwords.

We started off with horrible numbers andnow have pretty good numbers, without having extra software to enforce special charecters etc.

James

by james r linn

Anyone, inside or outside of IT, who runs a cracker or sniffer without express written permission is terminated with extreme prejudice.

Just downloading one from the net, legal or not, is against our well publicized internet usage policy and a serious offense.

James

by admin

I still think there is something behind the scenes going on here that you are not being told. Somehow there is another piece in this puzzle IMHO. I don't think it's absolutely important to know what it is, but it has to be frustrating to only get reasons that are pretty lame (again IMHO). If I was your customer, I would rather know you had solved a problem with dishonesty. I would be more apt to continue your services later (marketing 101... the refrigerator that broke and was repaired well, promptly and courteously get's the return buyer...) as far as "bad timing" you are right. There never is a good time for this to happen.

It would be advantageous to know if it was political though, because then it would be more clear if you should leave it alone, or continue to try to fix or prevent this.

by reactor2002

It appears to me that your real dilema really is the fact that you are not getting the backing of the executive staff from your company that you indeed should have.

In the over 15 years that I have been working in the I.T industry, I have found that the one primary reason that companies have such a problem and need for outside consultants and support, is that they don't see the need to Train the full-time employees and arm them with the adequate knowledge to configure and protect, or maintain thier environments to the fullest extent. Which is why I make money when the sky falls.
Here is my advice to you and your team of two. Get armed bigtime with the tools and knowledge to go over the heads of the "paperpushers", and "figureheads"...they don't want to know the details...but you NEED to know everything, and be able to document everything so that you can blow the enemy out of the water.
You sound as if you have already started getting a fairly good handle on security....which I applaud you for.
Now you need to see through the eyes of "hackers", outsiders and insiders alike.
One thing I recommend to Engineers tha come to me with training needs is to get a copy of the book "Hacking Exposed 2nd Edition".
I don't know these guys perspnally...and don't make any money from the referal, but their book is a work of art...and actual fact. They even offer a CD bundled with all the tools that are mentioned in the book.
Real tools that are being used.

If that doesn't give you a wealth of information to assist you in protecting your network...then there are other problems involved.

I feel for you at this point...and was glad to see all the input from other sources.
Hope this bit of information will be helpful to you.
Any questions...you can contact me at:

greystone@cableaz.com
or
reactor@cableaz.com

Have a good on.

-Warloc8
Greystone Digital Security Labs-USA

by dmaher1890

Just to compare, a member of my IT staff was terminated for using a rather weak hacking tool for a legitimate, work related reason, but the company said it does not matter if it was legit or not it was and illegal program that can be used to do illegal activities inside or out of the company so they caught him, because he did something very stupid and he was escorted out of the building two days later. The tried to do it the next day but there was too much paper work.

by epepke

That you're running the cracking program, that is. Far too many people think that you can solve security problems just by being upset at the people you catch.

by admin

Most IT policies I have seen or written include a list of approved software to have much less install. I doubt this would have been on it. We don't have a "written permission" policy on network tools, underground or the expensive variety, but that is a good idea. Is the approval from the CEO, IT/IS director or someone else entirely?
~Thanks :>

by james r linn

tracks all usage of network tools, password crackers or tools used to test server vulnerability. Usually if permission is given, its with a proviso that IT security be present.

But we are a company with information classified all the way to top secret, so we have to have rules in place - we do get audited about such things.

James

by pounder_arthur9

"Bolting the stable door after the horse has bolted", springs to mind ...

What? Where? When? & Why?
Are my immediate questions.

You've identified, & corrected the initial fault, & he's had his fingers burnt; so I doubt that he'll try again inthe too near future. But the threat is still there ... & also the question, "How do I learn from this lesson & prevent it happening again".

MMorell offers a good observation, upon the point of locked profiles. My previous employers insisted upon locked profiles, & only the IT department, (who all used their own profiles - thereby their actions were accountable), had the authority to install software; although this increased the workload, it prevents the initial question being raised upon thesecurity implications to other users.

Sadly I find that within IT, the easiest way to prevent senior management complaining about the service that they are receiving is to provide them with local admin rights. Sadly this action is likely to open a pit of vipers that include hacking, & license issues which is something that no company really wants to deal with.

Arthur

by cryo

Currently the only employees that should have local admin right at our company are the developers, all whom I work with on a daily basis so if something ?fishy? was to crop up I?m secure in the fact that I would know about it. Past that we?ve been slowly tightening security on the network by moving all employees to a ?Win2K user account.? Unfortunately we still have a couple of users who have resisted upgrades (with one excuse or another), and this VP is one of them. He was running on Win98SE that he installed himself. So needless to say it was bad from the get-go.

Thanks for all the posts
LordAlf

by kima

Policy & User Rights should be limited to him know. You should be able to perform that as the administrator.

Remove access to the following:

- Control Panel
- Start>Run
- Registry
- Eliminate downloads
- No software installation, except byAdmin
- Implement strict rules to access network drives & files

That should keep him away for a while, also make sure to secure the server in a room nobody has access, keep up with the latest upgrades from Microsoft, virus software, etc.

Get a software that will track all executives run in each PC, I forgot the name, but do some research. Any exe file installed in the PC will be shown whether running or not.

Kima

by kima

If it gets to the point you have to be extreme, installed a Keylogger in his computer that will keep a log file of every single acsii he types on a hidden file. Where is save depends on the keylogger make sure you installed in a directory nobody knows, hide it if you can.

This is a very dangerous tool, but sometimes is necessary, do watch out yourself, because he could do the same...

by kima

Here is the deal, I know some hacking and I can tell you that he will try different ways to get through. How secure are your servers??? It is important to secure them and not allow anybody in the room where the servers are.. Why, because there is adisk, that will change the administrator password based on another OS very well known available in the internet, which actually I have provided to some admin in need.

There are three main programs that can get the passwords for WinNT/Win2000 widely used by hackers...

L0pthCrack is the most famous one, follow by pwdump v.3.0, and the most dangerous of all are keyloggers... They just execute it, you won't see it, it keeps track of all the acsii characters that you type... no matter what they are. It's usually save on the C:/ drive hidden file, I forgot the name but I have lots of info about it. Security is what I love the most, although I can't get a job cause I don't have a piece of paper, which is unfortunate.

Snid2K a new program that allows remote administration is quite useful for hackers once they have access to your network. Somebody very smart will apply it to a computer along with a keylogger and waalaaa, he'll have access to your network.. I haven't heard of any incidents yet, but if I thought of it, I'm sure somebody else has too...

A good administrator will learn how to hack their own system and search for vulnerabilities before somebody else does it, as in your case. You guys were sort of lucky to caught up with the program, although 3 days running, I'm sure he obtain something...It ussually takes b/w 24 to 48 hrs to obtain 80% of the passwords in Win2000 and seconds in WinNT...

The tools and tutorials are out there just take the time... If a 12 year old can hack so can you....

Kima

by cryo

L0pthCrack is the tool that was used. The version seems to be the one from @Stake Inc. You can find more info at www.atstake.com/research/lc3/. I recommend any Sys/Net Admin not familiar with this tool to become familiar with it.

by boxxeronfly

I was able to find a boot disk on the web that loads linux and then just replaces the WinNT hash file (encryped password file). It took me an hour to find it and 3mins to implement it. I have no certificates and am interning at a small company. Ican do hardware but that and installs is about it. And this program lead you by the hand through the process. (that user will never change the local admin password again)
-New Gen Admin

by kima

You can get the crack by typing LC3 crack in any web browser. I have all the tools, I haven't put the list of all together, but there are many tools available for all OS free in the internet....Tutorials are everywhere. A good site for tutorials and tools is www.astalavista.com.. check it out...

Kima

by shanghai sam

Top management like to show that they have rules and regulations
that covers IT security to simply satisfy auditors , lawyers and outsiders. Until
IT security is taken more seriously and looked upon in a more professional way, such
cases will always exist. Computers should be considered seriously not only as
?fun and games machines? ?. But that sometimes they can be pretty harmful.
As for the time and effort spend tracing the VP for Marketing computer
Usage ?. It was a good exercise after which a cold beer should be highly
appreciated.

by cryo

Thanks for the post. I?ll definitely be picking up that book this week. Yeah, we?re definitely not getting the managerial backing that we should. Part of the problem is the fact that this company has been operating for the past 10 years without any sort of IT, Network, or Security policy in place. No checks and balances at all. Needless to say it?s been an uphill battle since we?ve been here. (It practically took an act of congress to get the current Security Policy in place) The CEO operates in a demeanor of not ?wanting to piss anyone off.? Unfortunately you can?t run a business and please everyone at the same time.

Thanks for the post
LordAlf

by generalist

Is this laptop connected to the network?

If it is, you might want to have the laptop investigated frequently.

If it isn't, you might want to verify that it isn't. I could see an instance where someone claims that the laptop isn't connected and can 'prove' it by showing that there isn't a hardware link. At the same time, that link could be restored in a matter of minutes.

You might want to physically pull the plug on the hardware connections to the VP's office if that is feasible. Either that, or carefully monitor what the person is doing so, if they are being underhanded, you can nail him with even more evidence.

by cryo

No, we disconnected his LAN connection into the office. He connects to email via a modem and Exchange OWA. We are monitoring him rather closely.

Thanks for the posts
LordALF

by tomsal

God that sucks. Man do I know where you are coming from though, it wasn't that long ago I posted on these forums myself that we have similar issues at my company. See the research, the studying the books, the fiddling around with software and hardware - that's all well and good for securing your systems and its data but no matter now methodical or professional we can be to making a secure systems... If no one supports you at the top of the food chain it really doesn't matter all that much.

I've tried everything to convince our company of the importance of security issues, I've download guides from the 'net, I've wrote up "cause and effect" type papers, I've brought up and spoke about it at our manager meetings.

It never ceases to amaze how people in the business were rationalize and prioritize things, it totally trips me out.

Our entire life blood of our business rests on the data on our systems, that data is compromised we are done. But I have to have a heart attack beforethey take the security seriously enough. Now, for something you'll really get a kick out of - our petty cash (whcih as policy is never over $300) is kept in a steel locked cased, which in turn is in a fire proof drawer safe, which in turn is in a locked drawer, which in turn is in the accounting room.

So lets safeguard $300 like Fort Knox, but let's not protect $20,000,000 worth of data. Makes sense to me. ;)

Not.

by supertechie

I dont see a problem with the use of such programs internally in an IT Department. They say the best way to catch a thief, is to set a thief, and to have good password security, you must be prepared to test those passwords. Thererore these sort of "tools" i would feel are a necessity to any company that has high risk/reward invested in IT.

by james r linn

You have to trust the people running them. Are using that automatically all IT people are more trustworthy than other employees?

The tools are certainly useful when trying to make your computers more secure, and should be used in a controlled andsupervised situation to do that. But not in a free for all atmosphere.

James

by bill cromwell

The major point using this kind of tool is "PERMISSION". IT security should be involved and use of the tools monitored.

I use all kinds of "non-standard" tools in my regular work and I don't ask. However, I would expect to be busted for using something like that. My job is not in security. My job is to keep my passwords safe from any crackers. Yes, our security dept uses them in the manner outlined in other posts... to see if our system is reasonably secure.

No single individual should beexposed to the possible results of these tools - not even a security person. The temptation and risk are just too great.

Bill

by admin

The CEO of a non-profit I work with once told me that in setting up IT infrastructure the #1 thing he looked for was someone that he could deeply trust. He was interested in their ability to do the work too, but that was #1.

I disagree that the temptation and risk are too great. Some people's word is truly their bond, and they will not abuse this. The trick is to put this in the hands of those people. The banking industry (and others) have done this for centuries -relied on people they couldtrust.
I'm not saying I never check security on other systems or am white hat or anything - but if I give my word to an employer, through a job description or in an interview or private conversation with the CEO etc. then it's a done deal, end of story. I am compensated for this work and yes there is honor -even amoung corporate and government employees.

All IT HR departments should learn to screen for this, and in some security jobs, it is a big part of the screening process. The military has their own special knack for this too.

Ironically to the uninformed, some cracker groups operate under a code of honor that translates well to the workplace.

by jessecameron

was the one that installed the program? Did you check for other trojans on his machine that his son would be able to do things like that.

I seriously doubt a VP would have any need to do this, but, a VP is also ignorant enough to do this. Take your pick.

by cryo

The humour in the whole thing is the fact that he?s admitted to installing the program, although he won?t tell us why he installed or ran the program.

LordAlf

by sparrowjim

I submit to you, thru my sense of people & social engineering, that the VP Sales DID NOT install / execute the sniffer. Rather, his admission that he did was a (weak) coverup for his Hacker son, who undoubtably also gave him the install floppy for his 'doctored' version of Win98SE. Consider for a moment the mindset of said Executive (using that term loosely): Had he actually been responsible for the sniffer install, he would have naturally had some sort of 'fabricated reason' for doing so. As it was, he took the responsibility in an effort to protect 'hacker-sonny' and make 'the buck stop here'. Given his apparant lack of computer savy, it was easy to say 'I did it', and thats where his creativeness (and lack of any reason for doing so) ended.

Just my 2 cents worth ......

by cryo

While I understand that there are other things besides this situation going on in the business, I thought that this would have been dealt with ASAP and in a firm manner.

The question I post to this forum is thus:
What would you do in my situation? (I give you the following facts)

1. Two eye witnesses view the application up and running during a routine IT auditing of workstations.

3. IT staff confiscates VP workstation and places it in the secured IT Lab. Evidence of time of installation, length of program running, and place of downloading are all gathered.

2. VP admits to installing and running LC3 (a network sniffing tool used to capture and hack passwords). The copy of LC3 is an illegally cracked, non-licensed copy.

4. Meeting with CEO, HR, Corporate Attorney, and IT staff takes place to go over all information, the situation, and recommended discipline. The company security policy specifically states no software is to be installed without the IT department?s knowledge, and specifically no unlicensed software.

6. CEO waits 17 days to make a decision then informs the IT staff that the VP will stay on, ?sign papers,? and that his workstation will need tighter security.

Okay, that was last Tuesday and I haven?t heard anything further. I haven?t been told to reinstall his workstation, tighten security, or that he?s signed any papers. Now I can go to extremes here; do absolutely nothing and go with the flow, or I can throw the extreme the other way and call the FBI (note: there was an article posted here by Brian Hook on Aug 15 that outlined very briefly how to report cybercrimes and pretty much listed the FBI for every type of crime). I think something down the middle is in order but I haven?t the foggiest idea what. I?ve never been in this position before so suggestions are welcomed.

Thanks to everyone for all the posts thus far.
-LordAlf

by mhubbard

Wow... you are in a sticky situation. I haven't been in your shoes exactly, but I do report to a business unit with no true cares about IT Policy. It seems that they are always trying to sneak around our policies.

Anyway, I see two options (not in order of preference):

1. Go to the FBI to report the crime. Just be sure to update your resume first.

2. Write up a document which states exactly what this VP did, include the documentation you gathered, and the steps you took with legal, HR, your CEO, etc. Also include the CEO's recommended action items. Indicate that with the signatures of the CEO, legal and yourself, that this case is closed and no further actions will be taken.
Have your CEO and legal sign it, and of courseyourself.
Give copies to both your CEO and legal.

This should sufficiently cover your butt, and if the issue comes up again, you'll have documentation and signatures all over.

Good luck!

by mikkawi

Listen, it happened, u caught him red handed, u reported it, Good work. Management sees that he should stay?, YOU! make it clear to them that they are risking the internal Security, and it's the decision makers FULL! responsibility. QED.

by mis_cmsd

The basic issue that you are facing, as far as I can tell, is that you have a problem with the fact that your CEO won't enforce your information security policy in an instance where a clear and deliberate violation has occurred. That is a difficult situation for you personally, but professionally, the matter is, in my opinion, very clear.

You have done everything required of you by nature of your professional position. Your CEO's decision may be unfortunate, but it was made with your full presentation of the facts of the matter. The CEO is ultimately responsible for the failure to enforce the company's security policy, not you.

Clearly, in order to provide yourself with some sort of protection, both legally and for your professionalreputation, you should personally maintain copies of your written findings and recommendations on the matter off-site. You probably should also ask that the CEO's decision on the matter be placed in writing, if it is not already. (Needless to say, keep a copy of that decision off-site as well.)

If it is part of the CEO's written decision that the VP in question be required to sign papers of some kind, you are well within your responsibilities to insist that you receive copies of those signed papers prior to restoring system access to the VP. Again, for obvious reasons, include a copy of those papers in your off-site document stash.

Your responsibility on the matter ends there. Your VP has committed a violation of company rules, as well as possibly violating cybercrime rules. However, as is the case with most instances where a law is broken, the victim (your company through the CEO) has the right to determine whether or not they wish to file charges. The CEO has fairly clearly indicated that this is not desired, so your only responsibility is to document the situation and monitor the VP's future activity.

by greggen

Well, there is the copyright violation that the Software Alliance should be alerted to.

by itmatters

MIS_CMSD hit it right on the head. Your concern seems to be from a personal view point, which you can't, no matter how hard it is for you, involve in this matter. Your CEO is concerned with $$$, which the VP of Sales must be providing for him.

Someone mentioned honesty earlier in this discussion. If this is your armor, then all you can do is follow the policies as presented to you. Once the CEO, HR, and the lawyers are behind doors, they can twist and present those policies however they wish. I've actually had my VP of HR tell me to change employee evaluations that included some negative verbatim from employees concerning the organization. HR and the lawyers are not concerned with honesty, they are concerned with protecting the business...and your CEO is concerned with keeping the business stable and making it grow.

Follow the policies, know you did what you could, and if you cannot live with the outcome, search elsewhere. If you ire your CEO by challenging his decision, you will be gradually (or quickly) in an unfriendly environment.

by r.bettse

Your problem is anything but unusual. As a consultant dealing with reviving companies that have been similiarly assaulted there are common threads I have seen and documented. First, the F.B.I. has it's own agenda. For sure your VP Sales has all of your customer data, all of your personal profiles and now is in possession of all the company's vulnerability's. Count on it. The "culprits'" only real crime was using unlicensed software. As an executive of (any) corporation it is understood that (s)he has the right to any information about the company. Not the right to abuse it. Solve this by documenting everything. Short of "shooting the bastard" little can be done. As well make sure that the offender is aware that you are taking safeguards, and yes, it's a veiled threat. Rolly (my trade name)

by mckaytech

From what you've described, what has occurred within your company is an internal civil matter and an internal policy matter, but I don't see anything in what you've written that suggests referral to an outside agency would be appropriate. Even the'crime' of using unlicensed software is primarily a civil matter (as opposed to distribution of unlicensed software which is definitely a criminal act).

My counsel would be simply to give your CEO and his legal advisers the benefit of the doubt and go on with life. Be wary and watchful but it seems to me your responsibility has been honorably discharged and it's time to give it a rest.

by kima

As the administrator you should be in top of everything. This is a red alert that means SECURITY was not as tight as it should have been.

Reporting him to FBI is not going to do anything, the only prove you have is that he tried to get the passwords with the tool but no evidence that he actually damage or acquire clasified data.

On the long run this is not good for you, my suggestion is that you get the tools available in the internet for people like him, perform SECURITY testing vulnerabilities with this tools, read tutorials. Once you find out the vulnerabilities, fix the problems..

In other words become a "HACKER" that way you'll know what it takes, secure your network better and be prepare for the next attack. Yes, there isa lot to read, lot's of tools to play, I have been collecting them, I don't have a file that list them all and what they do yet, but I'm working on it.

A good place to start learning and getting the tools is www.astalavista.com in which "astalavista" is a spanish word that means "See you later" do you get the point...

If a 12 year old can hack, so can you.. Start reading reading, get the tools & implement carefully

Kima

by epepke

"Lead us not into temptation. HAH!" -Heaven 17

I don't see that there's much temptation for IT people, at least the ones at upper levels. We're basically hired with a lot of money to have godlike powers. I once saw a list of things to say to managers, and one of them was, "I'm sorry, but my powers can only be used for good." IT people are actually in a position to say that sincerely. We can have honor, as it doesn't cost us and can give us cheap superiority feelings for doing what we have to do anyway.

Sales people, however, are hired (and also paid very well) to prevaricate, weasel, and generally be sociopaths. Honor would impair their effectiveness. It would be like giving a cat empathy.

Maybe this is an artifact of culture, and it might be possible to have a culture where those in sales can have honor, too. But I live in this culture. I didn't create the universe; I just live here.

by admin

LMAO hehehehe.. great post :>

Yeah, actually an old Twilight Zone episode comes to mind. There was this guy who gained the ability to read peoples thoughts when, I believe, a coin he tossed stood on end, and he then overheard the thoughts of a bank employee coming up with elaborate schemes to rob or otherwise pilfer the bank. In the end, the truth was that the man had been scheming for years, but was never once tempted to actually do it. In fact, he was probably a great employee and could think ahead and forewarn the bank of dangerous possibilities and better prepare them.

by epepke

Your mention of that episode is a good tie-in to the other aspect of this thread, the whole security problem in general. Nicely done.

I wonder if anybody has ever done a serious critical analysis of The Twilight Zone. It seems to me that the majority of the episodes were object lessons in a single body of myth which is

1) Extremely old, probably as old as any oral culture

2) Not particularly flattering of human beings

3) Sane, sensible, and rational to the point of being disturbing

4) So outre' that I'm mildly astonished that *anybody* in the 20th century gets it

Trickster myths, pantheons, and the like drain from the culture like wort through cheesecloth, but a weird guy with terrible stage fright but a deep desire to be a celebrity puts on a black-and-white TV show during one of the most vapid periods in American culture, and it sticks!

by admin

U BRU? I prefer a whirlpool, but, hey, I use what I got too :>

How do you sterilize the cheescloth? steam?

I of course, am assuming this reference makes sense to you in the same way it does to me, and if it's sounding like babble, I apologize.

Your take on the Twilight Zone is interesting, especially the point of the social mood when it began. Didn't this same era spawn Mad magazine, which oddly seems suddenly somewhat similar right now... do do do do, do do do do -zzzZZZZzzwONK!

by epepke

All you GENIUS computer WEENIES can't even STICK TO THE SUBJECT!

(whew! I feel better now.)

Naah, I don't sterilize the cheesecloth; I just open the package right before use and hope Pasteur was right. I do keep the scissors in a light sodium hypochlorite solution between uses, though.

Haven't done this in a couple of years, though. I used to be pretty good at it.

Mad magazine is also interesting, as it's the only publication that tells kids the truth. As I understand it, it came about largely because they made horror comics illegal. Incidentally, you can get Mad Magazine from 1952 through 1998, including specials and posters, on 7 CD-ROMs from The Learning Company.

by rdschaefer

That was the first thing that I thought of. During the almost 20 years of my career, I haven't met ANY sales-type people who were capable of this kind of activity.

Ralph

by itblackbelt

Given the information relayed in the original posting, I wouldn't take any action against the VP either. One VERY BIG door was left open by the "investigation" into this matter, as reported here. The son is a known "Hacker", most likely a wannabe script-kiddie who has his own web site. Setting this info. aside for a minute, we are talking about a VP level employee. If he wants information, there are easier ways to get it by using his position. What could he hope to achieve? Not much. His son, however, is a different story. Dad won't let him have a Corvette for his sweet 16, so he'll just start screwing with his Dad's company to get him back.

Had a more thorough investigation been done, and the perp. clearly identified, thenYES, the company should have thrown the book at him/her. As it was explained in the original posting, had the VP been fired for this, he would now OWN the company.

Just the opinion of a former C.I.

This discussion is closed to new replies.