Comments on: Security Anecdotes

By: Dave Lewis

Dave Lewis — Fri, 21 Dec 2007 15:52:46 +0000

@CJ

Love it! Too funny, thanks for that.

By: CJ

CJ — Fri, 21 Dec 2007 15:19:53 +0000

My all-time favorite archive of lame excuses to not secure something:

http://www.crypto.com/bingo/pr

By: Dave Lewis

Dave Lewis — Sat, 03 Nov 2007 01:00:45 +0000

@Abuse Desk

OMFG That was hysterical!

Thanks!

By: Abuse Desk

Abuse Desk — Fri, 02 Nov 2007 22:52:11 +0000

Here’s a few you might find amusing. From actual conversations with IT site admins on business class service.

“If thats so vulnerable, why hasn’t it been attacked yet?” — customer questioning advice to firewall a server better

“But I thought Firefox was a firewall!!” — customer being advised on need to firewall their LAN.

“I’m not sure why you are calling this abuse, it’s not like he’s doing it on purpose.” — customer objecting to being held accountable for their malware infestation

“You guys call here, you little pissant trying to tell me about my computers” — some self described network administrator complaining of being notified his LAN was overrun by spambots and malware.

“I have a Law Degree from Harvard…. I don’t need you to tell me how to troubleshoot.” — customer complaining when given troubleshooting advice

“I checked the machine and it was not connecting anywhere on port 25. It was only connecting on port 80 to find hosts to compromise so I have no indication that it sent any spam.” — customer baffled as to how his LAN could be outbounding malware spams.

“Loyalty tests have been given to all computers on the network, and all failing members have been purged. The streets run red with blood.” — amusing customer who audited his LAN successfully.

“We have a pix box so am I correct in assuming that acts as a firewall?” — alert customer

By: Dave Lewis

Dave Lewis — Wed, 29 Aug 2007 02:27:30 +0000

@Steve, Benny, Portswigger, Taylor and Myrcurial

Thanks everyone for your comments! I loved the snmpwalk and %n lines. Brilliant!

By: Security Anecdotes « From The Watch Tower

Security Anecdotes « From The Watch Tower — Fri, 24 Aug 2007 15:09:49 +0000

[...] Site [...]

By: taylor

taylor — Fri, 24 Aug 2007 13:48:15 +0000

upon notifying a security hardware vendor that their device reboots when running an snmpwalk against it, i was told “you shouldn’t do that – we don’t support snmpwalk”.

By: PortSwigger

PortSwigger — Thu, 23 Aug 2007 15:16:04 +0000

A vendor’s response to notification of a format string bug:

“I don’t understand. You should be typing your password. Where are all those %n’s coming from?”

By: Benny K

Benny K — Thu, 23 Aug 2007 06:45:23 +0000

Some of my own:

* Why do we need to secure this? We are not a bank. (from the CTO of a manufacturing company)
* We need to get this fixed. We’ll worry about security tomorrow (yeah right)
* We have no security policy
* Why can’t we allow ipsec from the vendor into this blackbox in the corporate LAN? (aka preventing the huge hole in the firewall)

And if you need more IT humor, just hit the BOFH archives.

By: Steve Dispensa

Steve Dispensa — Thu, 23 Aug 2007 03:36:06 +0000

“We have two factor authentication, a) username b) password”

Amazingly enough, I recently had lunch with a senior security official at a bank, who told me that the term “two-factor authentication” is defined very broadly from the perspective of FFIEC compliance – it can simply be two different passwords, or a password plus the fact that you’ve connected from that IP address before, or other similarly vague things.

The accepted security-industry definition of two-factor is much stricter than this federal standard.