4 ms·

Maybe he was hoping OP didnt know about VPNs, it's not an uncommon scare tactic to imply being tracked is unavoidable.

• judge2020 5y ago
  I'm sure any further unauthorized access from random VPN IPs would have also been blamed on OP, unfortunately. "He found this out then an hour later random IPs exploited it. He must have initiated those VPNs".
  • TedDoesntTalk 5y ago
    VPN doesn’t matter here. OP made it clear he was logged into the system first. Presumably all data is blocked until you are logged in. And if you are logged in, IT admin does not care about your IP address when they have your username.
    • beerandt 5y ago
      Unless the IT guy was accidentally letting it slip that there was no authorization implemented at all.
      • lazide 5y ago
        Which in context? Is very, very likely
• Ph0X 5y ago
  Would be ironic since OP caught an exploit that their entire team wasn't smart enough to catch... yet somehow he wouldn't know about something as basic as VPNs?
  • idiotsecant 5y ago
    Zero chance this was an issue of an entire team not being smart enough to check - everyone who touched this would immediately understand it wasn't in the authenticated flow. This smells like bad requirements being delivered to the implementers.