Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What's the most devious thing a user has ever done that you've had to deal with? Obviously, we've all seen quite a lot of malice from unfriendly users, but how about from so-called friendly users?

In my case, I think it would have to be ping tunnel: using outgoing ICMP packets to carry an SSH tunnel to circumvent the firewall. [Full disclosure: I contributed toward the Windows port of this tool ;) ]

(reopened as community wiki)

share|improve this question
    
Why do you say it's not a real question? I'm curious to hear what other challenges people have face; perhaps it should be a community wiki? –  Mikeage May 4 '09 at 2:31
1  
It's a survey, not a question that has an answer. I guess Joel's being less laissez-faire about those than on SO. –  chaos May 4 '09 at 2:45
    
I think this could be a good Community wiki to read as a what not to do –  Shard May 4 '09 at 3:22
4  
Bad call Joel .. you don't work for a company with lots of users, and probably don't place a lot of restrictions on your users. I would love to read this thread. –  tomjedrz May 4 '09 at 3:30
3  
I agree this is a good topic for the site.. anything to stop the endless Windows 7 "sysadmin" questions :P –  Jeff Atwood May 4 '09 at 11:29
show 5 more comments

5 Answers

I used to do system-wide 'blackhat' consultancy for one of those big IT companies. We always found that the client companies were very good at hardening their routers/firewalls/servers etc but terrible about sorting out their human processes.

One such demo we gave to a client had me using their conference room speakerphone to call directory enquiries, ask for the client's main reception number, call that, ask for their tech support number, call reception again ask for their Financial Director's name, then call their tech support claiming to be the FD, had to be a bit loud and 'boss-like' but they very quickly reset his password and gave it to me, I dialled (they used MS RAS) into their system, logged in and sent myself an email saying 'You got the job!' - all in front of the FD concerned.

Basically people are always the weak point and you don't have to be that sneaky to get around them. That said I do know of competitors who dressed as Police to gain access to our offices, luckily someone called 'their branch' to check up on them and they literally ran away once confronted.

share|improve this answer
5  
Rubber hose cryptanalysis ftw. –  chaos May 4 '09 at 16:10
    
Fun job ! –  spoulson May 22 '09 at 12:01
    
I know a gal who works as a telecom consultant, and this is basically exactly what she does - just on behalf of her client instead of the teleco - and rather than passwords, she goes for information about how much her clients could be saving in telecom fees. She's very good at what she does. –  Wayne Werner Mar 12 '11 at 22:55
add comment

Most devious?

I set the default login picture for all users to a picture of Pedobear.

For the guest picture, I have set up Pedobear with a thumbs up with the words Pedobear Seal of Approval

Nobody in the company knows who is Pedobear and they just assumed that the bear is a cute cartoon character.

Its been two months since I did this. Many have already changed their user picture but the guest picture is still there.

...and no, I'm not a system administrator but that's what happens when I have to spend one weekend installing Vista on all the laptops and computers at the company.

share|improve this answer
1  
Pedobear is a cute cartoon character –  sparks May 22 '09 at 14:12
add comment

More devious than a ping tunnel might be a dns tunnel - but it's pretty much in the same ballpark. Both usually work (though dns tunnel more often) for pay-to-use public wireless access without paying by the way - which might be nice to know if you manage such services^^

On the opposite scale of sneakiness, but almost as bad, a whole department kept everyone's passwords written on the inside of a kitchen cupboard. Just so they could unlock each others computers at the reception disks in case someone forgot to log out... the kitchen was frequently used by visiting contractors.

Another typical problem is a user that just refuses to work with computers, and secretly lets a co-worker handle his or her necessities like time reports and checking the e-mail. This took a while to discover as it was a remote office where everyone knew but didn't care about this - they just helped their friend.

share|improve this answer
1  
Where I work now, outgoing DNS is blocks, but ICMP is not. In fact, everything is blocked for all non proxy machines except for SSH. The web proxy will forward HTTP on port 80 (only) and HTTPS on port 443. I guess they leave SSH open on the assumption that if you know enough to use SSH, you probably won't break anything. I (personally) also use sslh on my webserver, just in case I need to send my SSH traffic through the proxy on port 443. –  Mikeage May 4 '09 at 12:41
    
ICMP enabled through the firewalls from normal user nets is interesting... well, there's always something open ^^ As long as https is open I guess there's not much to do though anyway, unless the https traffic is decrypted (possibly with a man-in-the-middle-attack by the firewall, or SSL bridging configurations) and inspected as well... –  Oskar Duveborn May 4 '09 at 14:06
    
how would you transparently decrypt (or intercept) HTTPS? One thing they could do is limit the duration of an HTTPS connection; no reason for one to last for 35 minutes... –  Mikeage May 4 '09 at 19:51
1  
Well you can only do it for the HTTPS endpoints you publish I guess, like your outside-facing web mail or extranet site - having the firewall impersonate and bridge that site/server while inspecting the HTTP content and still use HTTPS onwards to the actual web server on the inside. But if you spoof the endpoint (DNS spoofing for instance) you could do successfully do this to any HTTPS connection - the tools out there are basically script kiddie friendly by now, even though it's not elementary to perform ^^ –  Oskar Duveborn May 5 '09 at 12:22
    
there's still no way to prevent tunneling (short) SSH over HTTPS if you want to allow access to an arbitrary HTTPS server out on the internet –  Mikeage May 6 '09 at 8:16
show 2 more comments

I worked as a sys/app/net admin at a high school (age 11 -> 18) and discovered that the laptop I got was the one my predecessor used (he was on sick leave), before formatting the machine I made a backup of the HD in case there was anything on that shouldn't be deleted.

After some while my manager asked me to files that might be on that laptop. So I searched the backup disk but only found the records and photos of children aged 11 to 14 and only the female ones and only of a particular hair colour.

I reported my findings to my manager, but I can assure you that I was pretty spooked.

share|improve this answer
add comment

A user knew that he couldn't get around the firewall filter for web browsing, but found a way around it. He had a group of 5 friends, and they would email a dirty picture in an email attachment in a ring between them all.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.