Our security auditor is an idiot. How do I give him the information he wants?

http://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants

by splattne • 15 years ago

195 48 15 years ago

DanBlake• 15 years ago

Definitely seems less like a auditor (I believe asking for some of that is flat out illegal) and more like a hacker posing as a auditor, trying to get passwords/creditcard #'s.

antihero• 15 years ago

Bang on. Most likely social engineering. If this were actually an employee, they should be fired/told to fuck off.

d2• 15 years ago

A social engineer wouldn't try for this much data. One SSH key or password would be enough. I'm going with the fucking-retarded-auditor theory.

middus• 15 years ago

Who in their right mind would give their SSH private key to anyone?

It's a private key after all.

planb• 15 years ago

Never attribute to malice that which is adequately explained by stupidity.

philjackson• 15 years ago

Perhaps the auditor is smarter than everyone thinks and is expecting the sysadmin to come to him empty handed and with an explanation as to why the requirements aren't reasonable.

wccrawford• 15 years ago

He's already done that, and got the reply that every other company did it. The auditor is not just trying to get him to do the right thing.

AgentConundrum• 15 years ago

The poster has already tried that, which is when the "auditor" replied with the "10 years experience" rant. If this actually is his tactic, then he should be fired simply on the principle that his modus operandi will cost the company clients, as it seems to be in this case. If he just has his head up his ass, then he needs to be fired for gross incompetence and the company may need to notify anyone that he's previously certified that they need to be recertified or at least notify them that there's a potential problem.

The "social engineering" idea is definitely worth considering, and the poster definitely needs to run this up the flag pole to his senior management. Preferably, this email would also have the words "contact our legal counsel" prominently displayed.

astrodust• 15 years ago

Allegedly ten years of experience is more than anyone on Stack Overflow. I had no idea the site was populated by only teenagers.

mv• 15 years ago

Am I the only one who thinks the story is a little too perfect and ridiculous? It is much more likely that the author simply fabricated the story.

He did manage to start a very popular thread, and get a ton of people with really high rep to respond AND get a link on HN. He just threw out some bait, and the community swarmed like starving fish.

kenneth• 15 years ago

And he gains what, exactly, from doing this? Posting anonymously, he doesn't get any credit from posting the story.

thaumaturgy4• 15 years ago

It's called trolling. It's been done since there were bangs in people's email addresses.

The modern currency for trolls is "lulz".

ma2rten• 15 years ago

And what would be the benefit?

fungi• 15 years ago

it's funny

jrockway• 15 years ago

He just threw out some bait, and the community swarmed like starving fish.

This is true of all "light" SO/SF posts. Nobody gets excited about answering someone's obscure apt-get question. Everyone gets excited when they can spend their boring workday telling some dude that his security consultant is fucking him. It's the same reason people read "People Magazine" instead of "Purely Functional Data Structures".

thaumaturgy4• 15 years ago

I flagged this. The likely explanation is that this is just a troll -- 2-day-old account, this is the only question that's been asked on it. There's no way that somebody that's been doing audits for 10 years would ask for this stuff, and there's no way any server admin would even consider providing the information. ...At least, any server admin that shouldn't be yoinked back down to making patch cables.

DrJokepu• 15 years ago

It's a throwaway account. It has "throwaway" in its name. The question ends with the asker explaining that he's posting it from a throwaway account because he doesn't want his real name associated with it. How many questions would you expect a throwaway account to have?

thaumaturgy4• 15 years ago

I know what throwaway accounts are, and I read his username.

It's still a troll.

yuhong• 15 years ago

Yea, I can understand why they asked this from a throwaway account. Ideally it should not be needed, but...

danparsonson• 15 years ago

Regarding the age of the account, there is a note at the end of the post: "Sidenote; I'm posting from a throw-away account to (mostly) dis-associate my name from this post"

code_duck• 15 years ago

I agree, either this is untrue or is the product of someone very dumb. The four minutes I spent reading that were an utter waste of time.

scott_s• 15 years ago

Troll or not, it generated good responses and summaries of standard security.

blackboxxx• 15 years ago

This is a case of social engineering, not of a security auditor, but of the poster. The poster wants to know an easy way to collect public and private SSH keys and fake 6 months of inbound traffic. There is no auditor.

Maybe the poster is writing a book on cracking systems? Who knows. But it smells like a hoax.

pyre• 15 years ago

What is 'hard' about harvesting public and private keys? Especially if you are the sysadmin.

What purpose would faking 6 months of inbound traffic serve? If he just wanted to cover his tracks, wouldn't he just erase logs rather than trying to make them look legit? That would seem like doing things the hard way.

sigzero• 15 years ago

That "auditor" is an idiot as some of the posters have mentioned already. I was like "No" and then I got to the "both private and public keys" and I was like "Hell no!".

ChristianMarks• 15 years ago

This is suspicious:

  *The "new security policies" were introduced two weeks  
   before our audit, and the six months historical logging
   was not required before the policy changes.

These "policies" were introduced by whom? His payment processor or by his company on the advice of this "auditor"? Or did the OP make this up?

  In short, I need;

    A way to 'fake' six months worth of password changes 
    and make it look valid
    
    A way to 'fake' six months of inbound file transfers

Why is the poster requesting help generating plausible fake data? Is he naive? Afraid of losing his job? Unaware of the legal implications?

drunkpotato2• 15 years ago

Yes, I wondered the same thing! Aside from the legal implications, the OP seems to have some questionable ethics as well.

lukeschlather• 15 years ago

What's unethical about that? If politics have required him to do provide information he can't legally provide, falsifying the information seems like the only reasonable course of action.

Of course, quitting is the other out, but I do think he has a moral obligation to prevent his company from handing any of this information over to the auditor.

drunkpotato2• 15 years ago

Everyone so far has focused on the auditor, but I want to know why the OP thinks faking the requested data is an acceptable response. That disturbs me and nobody else commented on it!

DannoHung• 15 years ago

Because this guy shouldn't be allowed to have that information and unless he was going to use it for nefarious purposes, he wouldn't be using any of it at all.

dspeyer2• 15 years ago

Handing over the data is certainly not an acceptable response. If it's the sort of organization that makes saying no very hard, and leaving looks impractical, this may be the best option. Sometimes all you can do with a prestigious idiot is work around him.

giardini• 15 years ago

Please post the name of the company that the security auditor works for.

molecule• 15 years ago

Please post the name of the security auditor. This is completely unprofessional and insecure.

jdq• 15 years ago

Agreed. I wouldn't want to do business with this company.

Natsu• 15 years ago

I wonder if, when confronted about how ridiculous the requests were, the auditor will claim to have been testing how well the admins resisted social engineering?

gaius• 15 years ago

I was in exactly that situation myself recently. However I was hungry and the auditor was cute and I told her I would give her the root password in exchange for a donut. Which she dutifully wrote down on her clipboard. Now the whole company has to go on training. I don't even know the root password!

Our security auditor is an idiot. How do I give him the information he wants?

Related Stories