10 ms·
A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months
- toomuchtodo 3y agoBest place to hide is something that looks like a service account everyone is afraid to touch for fear of what will break if disabled. Well played!
- deleted 3y ago[deleted]
- thih9 3y agoReminds me of popular malware and their process names.
- InitialLastName 3y agoOn the other hand, an over-zealous IT guy at my job just deleted our Jira automation account (because he didn't know what it was there for and got sketched out by the name $CompanySecretary). Cue (a few days later) a large pile of pain as we tried to find and fix every workflow and ticket that formerly referred to that user before something really important broke.
- toomuchtodo 3y agoInstitutional knowledge and documentation is not free, but it has a cost!
- InitialLastName 3y agoApparently the cost of reading the documentation, asking anybody, or just looking at the account's activity was too high.
- user_7832 3y agoAah, he took down Chesterton's fence and found the reason of its existance! (https://en.wiktionary.org/wiki/Chesterton%27s_fence https://en.wiktionary.org/wiki/Chesterton%27s_fence)
- ChainOfFools 3y agoMore than once I have taken down a Chesterton's fence that I myself had originally put up
- mooreds 3y agoSounds like a few good stories....
- willcipriano 3y agoChesterton's key more like.
- at_a_remove 3y agoDang. Our scream test was just "disable if nobody could tell what it was for."
- themoonisachees 3y agoAt my previous job, we had an entire system aptly named Pandora whose entire role was keeping track of which ssh keys were permitted to be found on servers. It had a bot that would crawl through every server, and if it found a key not in it's database, it nuked it. Every new person or automation key had to first be registered fomarlly, with an end date. A bit of a hassle but definitely necessary for the space the company was in.
- smelendez 3y agoThat’s a good idea although I’d probably be paranoid enough to have a human do the deletions, out of fear of the failure mode where it deletes all the keys everywhere and nobody can log into anything.
- vertis 3y agoThere is a future where they're locked out of the servers.
- konha 3y agoWhy not use ssh certificates at that point?
- falserum 3y agoI assume op’s system was to allow A to ssh to B, but not to C. (With lot of different As and Cs) Where “but not to C” is the reason for existence. How certificates simplify that part? (Never used them, but my understanding they are usefull when you want x1,x2,… ssh’ing into y1,y2,…; two uniform sets; if set sizes approach 1, then cert usefullness aproach zero)
- themoonisachees 3y agoI would have been a good use case, but unfortunately no, if your key was registered it would be left alone on all servers (though you had to place it, and access control was done by way of bastions). Ssh certs weren't used because the system was put in place before they became commonplace.
- deleted 3y ago[deleted]
- neilv 3y ago> Of course, not every company will fall for this trick The company can have the last laugh: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- argiopetech 3y agoThis was my first thought on the "silly prank" line.
- dancemethis 3y agowell, Slack is the one having the last laugh, since they get their hands on a lot of "sensitive business data".
- selectodude 3y agoThat’s why he waited two years to say he did it which just so happens to be the CFAA statute of limitations.
- sio8ohPi 3y agoIANAL, but as far as I can tell that's only for civil actions (and it runs from the date that the damages are discovered, not necessarily the time of the offense). For criminal charges, I believe you'd use the default 5 year statute of limitations for noncapitcal federal crimes (18 U.S.C. § 3282)
- themoonisachees 3y agoBut the company can't force the state to pursue criminal action whereas it can sue in a civil court any time it wants.
- jstarfish 3y ago'Nothing signed "THE MGT." would ever be challenged; the Midget could always pass himself off as the Management.'
- vlovich123 3y agoNormally an organization would have this protected via SSO & thus the deactivation of the employee's account on Gizmodo's systems would have kicked them off of the company's slack. Just another reason why it's valuable to avoid non-SSO 3p cloud apps so that "who's an active user" has a single source of truth.
- throwanem 3y agoSlack has supported SSO via a variety of providers for quite a long time now. If G/O Media didn't bother setting up the integration, that's on them.
- timetopay 3y agoOne thing that SSO isn't great at is deactivating live sessions. Often, you either solve this with short session times (annoying to users), making a note in the de-provisioning steps document (not foolproof), or using a third party vendor (costly).
- tw04 3y agoSure it is, this problem has been solved for a long time: SCIM. Any modern idp should support SCIM and if the app doesn’t I’d question using it at all.
- timetopay 3y agoSCIM adoption isn't near where it needs to be. I guess yeah, this is the correct answer. We live in a world where SSO is considered an enterprise feature, I hope one day that it's considered default.
- grinich 3y agoShameless plug for my startup (hope that's ok!) If you're building an app and need to add SCIM, check out WorkOS. My email is in my profile to chat. More info -> https://workos.com/directory-sync https://workos.com/directory-sync
- Marciplan 3y agoit was a joke Verge
- rokkitmensch 3y agoPerhaps sadly, it's the kind of joke you can get in mega-trouble for these days (see other comments about CFAA and flicking boogers on the carpet).
- rokkitmensch 3y agoThis reminds me of a glorious day at my consulting company ca. 2016 when we discovered that we could change each other's names on Slack. At one point everyone was just named dad.
- gerdesj 3y agoLove it but I will insist on grandad or I will set the girls (grand-daughters) on you ... and they are merciless 8)
- rokkitmensch 3y agoThere was a phase where folks were riffing on phonetic variants: dad, sad, brad, chad, glad. I miss whimsy at work. Not in the code, never in the code, but at work absolutely. Nowadays either I'm older, or the environment is different, or people are less funny. Hard to tell.
- kej 3y agoThis sounds a lot like when my kids realized anyone can edit Netflix/Disney+ profile names and pictures.
- Aeolun 3y agoAll the accounts are filled with the maximum number of ‘djehebdxineEbsuan’ profiles. And my son is asking why there’s a limit ;)
- cosmodisk 3y agoI've been playing this for a while now with our daughter. She wakes up in the morning and finds some absurdity written on my account,then she changes it and the cycle repeats on the following day:)
- zzixp 3y ago... is this still possible? (my college frisbee team is on slack)
- justanother 3y agoI knew an ex-employee back in the day (not me I swear) who created a dialup/ISDN provisioning profile called 'Ringing' in the modem rack controller module (not the Radius server, that would be too obvious), such that a glance at the modem rack status page showed everyone who was connected, and one that was 'Ringing', just like any other incoming call that hadn't been picked up yet. It went completely undetected, yielding 128Kbit ISDN service for well over a year. Obviously I do not advise this, especially now that the CFAA has been interpreted to include things like changing URL parameters and flicking boogers on the carpet.
- nadermx 3y agoYou got a reference on the CFAA? On the contrary, I found that it was probably not a problem to change a URL parameter "We also note that in order to be guilty of accessing “without authorization, or in excess of authorization” under New Jersey law, the Government needed to prove that Auernheimer or Spitler circumvented a code-or password-based barrier to access. See State v. Riley, 988 A.2d 1252, 1267 (N.J. Super. Ct.Law Div.2009). Although we need not resolve whether Auernheimer’s conduct involved such a breach, no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier. The account slurper simply accessed the publicly facing portion of the login screen and scraped information that AT&T unintentionally published." https://law.justia.com/cases/federal/appellate-courts/ca3/13-1816/13-1816-2014-04-11.html https://law.justia.com/cases/federal/appellate-courts/ca3/13...
- justanother 3y agoExactly correct. Nonetheless, a prosecution was indeed brought, and the opinion you're citing is an appeal. Without the EFF's financial support, weev would not be a free man.
- 3abiton 3y agoThat's one way to go. Yolo on a prank.
- KennyBlanken 3y ago
- dazbradbury 3y agoThe fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!
- reactordev 3y agoBigger companies use SAML or other federation that makes it impossible to login without a corporate authentication.
- dazbradbury 3y agoPresumably with SAML/SSO you can still change your slack display name and profile picture?
- grinich 3y agoThe data only comes during the sign-in flow. If you want to change it dynamically outside of that, it's typically done via SCIM. For anyone curious, we wrote a blog post all about this. https://workos.com/blog/the-developers-guide-to-directory-sync-scim https://workos.com/blog/the-developers-guide-to-directory-sy... (I work at WorkOS.)
- neom 3y agoNot slack, we use teams at work and I have very limited ability to do anything, can't change my name and we have profile pics disabled.
- reactordev 3y agoNegative, that comes from Azure AD, or Cognito, or Keycloak, or whatever. The users name, email, phone, location, avatar pic, department, etc all comes over in the SAML payload.
- bigyikes 3y ago
- notatoad 3y agothe screenshots of people replying to him who clearly know he's not slackbot, including calling him Tom, kind of contradict the headline here. he was clearly not "undetected". we've got some former staff in our slack still. they check in and say hi every now and then, it's nice. if one of them started pretending to be a snarky slackbot one day, we'd probably have a laugh about it too.
- ksenzee 3y ago“Undetected by management” is the meaning here, as the article makes clear. His friends knew he was there and were having a laugh.
- INTPenis 3y agoSame here, slack is not our main communications channel but it was used for some external consultants. And sure enough people who had quit were never kicked out so they just continued planning lunches together.
- adamrezich 3y agothis is a reporter "reporting" on another reporter's self-reporting (on twitter) of what he did from when he quit/was fired/laid off (the "article" doesn't even say) from his job as a reporter. "reporting" is in quotes here because it's the thinnest possible veneer atop the original tweet. what possible value does this article have over the original tweet, aside from adding an additional, unnecessary needed layer of "reporting" for this non-story? it's difficult to see this as anything but a "journalism" circlejerk (redundant).
- berkes 3y agoThe author gave some context for readers not familiar with slack. And interviewed another former employee (albeit with minimal effort) to add another validation point.
- twodave 3y agoOne place I worked was slow to deactivate slack accounts, so when I left I made a private channel #daves_cave and invited friends my friends to it. I would leave a short story or pithy saying now and then; it was fun until management got wise and deactivated me.
- petesergeant 3y agoI’ve got a private, paid Slack team ($10 a month?) and you can invite people from other paid Slack teams to chat in rooms on it. Nice thing about this is it’s “by design”, so less likely to get shut down, and also unlikely to fall foul of computer misuse laws.
- aaron695 3y ago[dead]
- yareal 3y ago[dead]
- brunosutic 3y agoReplacing ascii with similar-looking unicode characters is an old trick. There's a bunch of these characters out there. You can use it in the code to prank your colleague developers - April 1st is nearing! I even made a vim plugin that highlights these "dangerous" characters: https://github.com/vim-utils/vim-troll-stopper https://github.com/vim-utils/vim-troll-stopper I've never been pranked with unicode characters, but I've had a situation at work where a consultant from Japan unintentionally used some "japanese space" characters in a translation file, and that broke our app. Since I have my vim plugin running all the time it didn't take me a lot to see what's going on.
- lostlogin 3y agoThe accidental crap can go a long way. I recall someone using a superscript ‘O’ as a degrees symbol in a medical report. This then got converted to a non—superscript character and rather changed the meaning. Extra unhelpful was that they wrote the word ‘degrees’ after the attempt at the symbol too.
- kzrdude 3y agoThere's also the Spanish superscript a and o symbols (used for ordinals) that can be confused for this.
- xp84 3y ago“patient’s temperature was approaching 100O degrees” Very nice error :D
- lostlogin 3y agoIt was a measurement of angle for an ortho surgeon. However as you point out, wrong by a x10 multiplier has the sanity checks kicking in.
- stefan_ 3y agoLots of apps have helpfully started turning two dashes (—-) into some sort of Unicode long dash that is more aesthetically pleasing, while also breaking command line tools.
- solatic 3y agoA lot of people advise ways of locking down name changes, but this doesn't really solve the problem. I'm sure there's someone out there whose first name is actually Jira. I worked for $company where customer dashboards were set up on a wildcard - https://*.$company.com https://*.$company.com, e.g. https://foo.$company.com https://foo.$company.com. Guess what happens when someone picks a dashboard slug that conflicts with an actual record, like `www` or `blog`? Their dashboard becomes completely inaccessible. Of course, the setting to change the prefix is also on https://$dashboard.$company.com https://$dashboard.$company.com, so the customer is unable to fix it themselves and requires support. Of course, support's tools don't expose the ability to change the $dashboard prefix directly... Figuring out how to build the denylist isn't really trivial. Of course, there's pre-existing DNS entries. Then there's pre-existing $dashboard prefixes that already exist. Then there's dirty language, Unicode symbols, Punycode (i.e. xn-- prefixes)... then there's setting up redirects from the old prefix and reserving it so that nobody can claim it in the future... I'm not surprised Slack has holes here, it's a fundamentally hard problem.
- hennell 3y agoLimit usable characters, and just literally check the page doesn't resolve already before allowing the change. Customers will never be locked out and characters can't impersonate others. If you want to allow some symbols you can either whitelist or check if usernames are an appropriate levenshtein distance away from core names (like say slackbot) and either ban such things or flag to a human "hey this could be an issue". It's fundamentally hard to stop everything, but it's not hard to stop the biggest issues.
- solatic 3y ago> just literally check the page doesn't resolve already before allowing the change It's a wildcard DNS record, it always resolves, even if it's not saved in the system. There's a general rule of thumb: when someone on HN tells you to "just" do something, they generally underestimate the amount of effort involved in doing it properly.
- 3y ago
- jimnotgym 3y agoI would have thought the answer to this at a corporation was Single Sign On? I don't run IT these days, but when I did...we used to mark them as inactive in Azure Active Directory. They could no longer log in to any Office 365 service, Outlook Teams or whatever, and none of the third party services we had using MS SSO. Wouldn't you join Slack to it too?
- justusthane 3y agoIf you have a competent/adequately resourced IT department, sure, of course. It’s also possible that a different department set up Slack without consulting IT.
- thecupisblue 3y agoAdmins not killing old accounts is a security hole that I'd say 50% of companies I worked with had/have. I can still log into the google workspace, slack, check out confidential documents on drive (not because of transparency, but because they dont know how to share properly). I can check out what is happening in nearly any of their projects by peeking at the channel and if I want to know more, I just take a look at the documents, including their pitches. If I poked for a bit, I could probably also find API keys and DB credentials. These people work for banks, insurances, national televisions, hotels, airlines and more. If I was a bad actor, it would be incredibly easy to cause damage to both them and the clients or do insider trading based on the upcoming project data. But it seems like half of these places just don't care about security - even when contacted, admins/responsible people just flat out ignored it. And then we wonder how breaches happen.
- vrosas 3y agoOne manager asked for my personal email so they could add me to all the relevant google groups and whatnot so day 1 I could hit the ground running and wouldn’t need to wait for my company email to be provisioned. Needless to say, 8 years and 2 jobs later it’s still in there.
- CatWChainsaw 3y agoThe distinction between the registered username and display name in discord and elsewhere is a great innovation..