More Computer Stupidity

[rrich]

We had purchased a network from an un-named supplier. (UNS) Included in the UNS network was the network control system. Our network control system used the identical software as the network control system of the UNS public network offering.

My job was network administrator and I had spent several weeks going through the computer code listing of our Network Control System. I was also required to attend class on how to program the network nodes. (Assembly language that utilized the IBM 360 RR, RXR and RS code set.)

About the second day of class ("File services on the Network Control System") we were assigned the task of copying files from one account to another. Then the instructor went to lunch. To accomplish the task, a priority level was needed by the copying user. No one in the class had the required priority level. We were using the live network control system of the public network.

I knew, from looking at the computer code listing of the network control system, the user names of the accounts authorized to raise a user's priority. I also knew the people associated with user names. I chose the user name "GOD" and used the persons initials from the company phone book as the password. I got in on the first try. Then I gave all the students in the class the necessary priority level to copy files from one account to another. Then I signed off.

On Tuesday or Wednesday of the week following our management held a meeting with all the students that had attended class. It seems that UNS had blew a gasket because someone in the class had logged into the GOD account on the live network control system for the public network. Our management didn't want to know but we were instructed to not do it again.

After the meeting I went into my director's office and explained the who, (me) the why (to complete the assignment) and how (intelligent computer hacking). After the why was disclosed my director is laughing. After the how was disclosed my director was laughing hysterically with tears in his eyes. My director told me to get out of his office and that this conversation never happened.

The following week, I heard all the UNS personnel complaining that they were required to change their passwords and follow a specific gibberish format.

[doug3030]

not computers, but still "intelligent hacking"

When I was in the Army, I was tasked with conducting a surprise security inspection on a set of offices. I had a roll of stickers to post on anything I found insecure. I had a master key so that I could access all areas.

On the appointed day I turned up 30 minutes after work finished and found the front door wide open. They had a security list on the wall that was supposed to be filled in by the duty lockup person each day but it was not completed for this day. I nearly ran out of stickers to place around. not a single office had been locked.

My highlight of the day was finding a high security safe in the commander's office. It was locked but I noticed a few numbers circled on a calendar next to the safe. I soon worked out the meaning and dialed the correct combination into the Chubb Manifoil combination lock (it was in the early 1980's, and they were "it" back then).

I plastered the remaining stickers on the roll onto the inside of the safe, taping all the drawers shut and generally being as annoying and obvious as I could. I then locked the safe.

A few minutes later, it occurred to me that this was a major incident and I phoned my boss and told him what I had found and what I had done about it. My boss came out, took a look and then sent me home to protect my identity then called in the commander of the unit in the building and let fly. People from that unit were still looking for whoever blew the whistle on them for a couple of years.

Cheers

Doug