Comments on: The Tale of the Disgruntled Employee – Part 12 http://ogenstad.net/2006/09/19/the-tale-of-the-disgruntled-employee-part-12/ Security Stories and Help with Network Documentation Wed, 28 Mar 2012 12:36:19 +0000 hourly 1 http://wordpress.org/?v=3.1.1 By: Patrick Ogenstad http://ogenstad.net/2006/09/19/the-tale-of-the-disgruntled-employee-part-12/comment-page-1/#comment-314 Patrick Ogenstad Mon, 25 Sep 2006 15:14:44 +0000 http://ogenstad.net/2006/09/19/the-tale-of-the-disgruntled-employee-part-12/#comment-314 Excellent, making people think is one of my objectives :) If we start with the first question, this would depend on a few circumstances. First though, if it comes to this stage it's Game Over, we don't have a network anymore and have to start from scratch. When it comes to this specific case in order to answer your question I would have to know what n3m0 did during the hours he spent in the server room. What n3m0 did was really a sledgehammer approach; it left all kind of footprints in different logs. If a server had crashed randomly twice during the night I would have investigated it, since I've created the fictional character n3m0 I can say that yes I would have noticed that something was seriously wrong. If there had been a more skilled attacker it would depend on which of my customers' networks had been targeted. With central monitoring and log servers this would sound all kinds of alarms. With the logs kept on the computer I would just be guessing, I might not even know if the server had been restarted. As soon as the server has been compromised we can't trust it anymore, it will lie to us (and keep a straight face too). My trusty old PowerEdge would lie to its mother if an attacker told it to. As for the second question, hopefully no one would be so cruel to "my" network(s) :) It comes down to the trust you put to the employees and then their motivation to do so. Skill only enters into it if the attacker is working alone. n3m0 or someone else could have pulled this off without any kind of knowledge about computers, he would just need a cell phone and a friend. What are your thoughts? Excellent, making people think is one of my objectives :)

If we start with the first question, this would depend on a few circumstances. First though, if it comes to this stage it’s Game Over, we don’t have a network anymore and have to start from scratch.

When it comes to this specific case in order to answer your question I would have to know what n3m0 did during the hours he spent in the server room. What n3m0 did was really a sledgehammer approach; it left all kind of footprints in different logs. If a server had crashed randomly twice during the night I would have investigated it, since I’ve created the fictional character n3m0 I can say that yes I would have noticed that something was seriously wrong.

If there had been a more skilled attacker it would depend on which of my customers’ networks had been targeted. With central monitoring and log servers this would sound all kinds of alarms. With the logs kept on the computer I would just be guessing, I might not even know if the server had been restarted.

As soon as the server has been compromised we can’t trust it anymore, it will lie to us (and keep a straight face too). My trusty old PowerEdge would lie to its mother if an attacker told it to.

As for the second question, hopefully no one would be so cruel to “my” network(s) :) It comes down to the trust you put to the employees and then their motivation to do so. Skill only enters into it if the attacker is working alone. n3m0 or someone else could have pulled this off without any kind of knowledge about computers, he would just need a cell phone and a friend.

What are your thoughts?

]]> By: LonerVamp http://ogenstad.net/2006/09/19/the-tale-of-the-disgruntled-employee-part-12/comment-page-1/#comment-305 LonerVamp Wed, 20 Sep 2006 21:59:21 +0000 http://ogenstad.net/2006/09/19/the-tale-of-the-disgruntled-employee-part-12/#comment-305 As I read this, the question comes up, "What if this employee worked where you do, would you detect this or notice it? Who would do it, just any employee that normally wouldn't have special privilege?" Kinda puts security into perspective, as many stories like this do (hopefully). As I read this, the question comes up, “What if this employee worked where you do, would you detect this or notice it? Who would do it, just any employee that normally wouldn’t have special privilege?” Kinda puts security into perspective, as many stories like this do (hopefully).

]]>