The Daily WTF: Curious Perversions in Information Technology

2006-08-09 Reply Admin

Anonymous:
On top of being rediculously executed, doing a yearly password change seems very lax in general. Where I'm working, we have to change passwords for all systems (by ourselves, of course. They are OUR passwords) every 90 days. At least 8 characters, containing upper and lower case characters, numbers, symbols, cannot be one of our last 5 passwords (the systems check against a list of our old passwords), cannot contain dictionary words, and cannot be a sequence (ie: May2006!, Jun2006!, etc.). Is it a pain? Yes. Does anyone complain? No. Why? Because we know we have competent Sys Admins running the show.

Hardly. Enforced password changes are a classic piece of cargo cult. Everyone does them because everyone does them, not because they understand why they are doing them. They don't improve security. In fact they probably decrease it.

The one time regular enforced changes are sensible is when a code (such as an access code on a door) is shared among several people. Otherwise not.

Loopy · 2006-08-09 Reply Admin

In case you were wondering, that was sarcasm.

Loopy · 2006-08-09 Reply Admin

I happen to agree. Frequent password changes force people without an extremely good memory to write down every password and what application the password is supposed to access. Written-down passwords, as a previous poster said, is one of the most glaring security risks there is.

snoofle · 2006-08-09 Reply Admin

Ford351-4V:
snoofle:

Not so sure about that. Not long ago, I helped a friend set up a new office. We brought in about 10 computer-setups. Nothing fancy, just basic large flat panels and mid-line PCs. The system was used to store data for an accounting practice (picture all the info on your federal tax return (account numbers, social security numbers, etc) times thousands of clients). The security guards in the building watched as we hauled in the equipment.

That night, they unlocked the door, and ripped the PC's from the network. They took the junkiest boxes, and left the (very expensive) flat panels and server sitting amidst the rubble. It never occurred to them to look at the webcams pointed right at the door and computer areas, with the thick blue wire running across a white wall directly to the server. The whole thing was caught on video, which, if they had taken the server (where it was stored), wouldn't have been of much use to us.

Afterwards, they admitted they never even tried to gain access to the boxes - they just thought they could hock them for $50 each. Apparently, you don't even need to be mildly intelligent to be a thief.

Wait, you were robbed by your own security guards??? WTF?

Um, no. My friend rents an office in a *large* building. The building has rent-a-cops sitting at the front desk. THEY were the ones who broke in and stole the stuff. Not my friend's employees, but still...

2006-08-09 Reply Admin

Anonymous:
Anonymous:
Pin Numbers

WTF is a PIN number? People have started numbering their personal identification numbers?

I bet you're using a NIC card to connect to this website and you type your PIN number into ATM machines.

Thank you! Danke schön! About time someone says something about. We are all nerds here, something redundent like PIN number and ATM machine shoudln't even be in our vocabulary...!

jo42 · 2006-08-09 Reply Admin

And the password for passwords.xls is: dilb3rts

snoofle · 2006-08-09 Reply Admin

The place I work in must be extremely anal about passwords. They have the usual 90-day change policy, but I have no less than 7 different passwords (one for each of the 7 different systems that all have different password requirements (upper/lower/number/with[out] special chars/min-max len). Then, all seven systems keep track of the last THIRTEEN passwords so you can't duplicate them.

Admittedly, I memorized just the main system's password. Then I have a NOTE in Outlook with all of the passwords, written in what is obviously a hint to me, but will mean nothing to anyone else.

Of course, all seven login names are different too, so they're in the note as well.

I do NOT look forward to my 90th day on this job when I need to rotate 7 passwords 13 times. *sighs*

SkyProphet · 2006-08-09 Reply Admin

I can absolutely see this happening. The company I used to work for required us to give the operations manager our passwords. I flat out told her no in an email. I got called in to my supervisors office and told that she thought it was rude and what happened if someone needed to access my emails when I was not there? I told him that's what the admin account was for and if his sysadmin didn't know how to access it I'd be happy to show him. However, I was not giving my password to anyone so they could write it down or store it in a file. Kind of defeats the point of the password. They still got angry, so I made up a password and gave it to them. Never occurred to them that it wasn't the right one.

gremlin · 2006-08-09 Reply Admin

Anonymous:
Anonymous:
it was a pretty close estimate.

According to the FBI/CSI 1999 Computer Crime & Security Survey, 30% of companies polled reported system penetration by outsiders. But even higher crime rates were reported from within the traditional perimeter of the enterprise. According to the same study, 55% experienced unauthorized access by insiders within the past year (up 10% from 1998)

http://www.intel.com/network/connectivity/resources/doc_library/white_papers/products/ipsecurity/index.htm#Section4


"60% of companies have been attacked from the inside" != "60% of attacks on companies come from the inside"

No, but 55 / (55+30) ~ 60% (as the OP claimed).

2006-08-09 Reply Admin

GoatCheez:

I really think that the speadsheet in question is to be deleted immediately after the password update is done.

Not before it has been printed, faxed to the next room, placed on a wooden table ,photographed, scanned and added to the company's website to prove their security methods to potential clients.

Beanbag girl and Foosball girl are the same chick, only in different modes.

mnature · 2006-08-09 Reply Admin

SkyProphet:
I can absolutely see this happening. The company I used to work for required us to give the operations manager our passwords. I flat out told her no in an email. I got called in to my supervisors office and told that she thought it was rude and what happened if someone needed to access my emails when I was not there? I told him that's what the admin account was for and if his sysadmin didn't know how to access it I'd be happy to show him. However, I was not giving my password to anyone so they could write it down or store it in a file. Kind of defeats the point of the password. They still got angry, so I made up a password and gave it to them. Never occurred to them that it wasn't the right one.

I like that, making up a password for them. We do have to give copies of our safe combinations to our group office, but those are sealed in envelopes, and must have two people present both to open the envelope and then to open the safe, in case of emergencies.

Where I work, we have security posters up that emphasize to us the importance of not sharing our passwords with anyone. We could probably have security escort out anyone that tried to demand a password from someone.

For the mundane office work that requires a password (such as entering our time), we have smartcards. Most of us have two smartcards: One for the open network, and one for the classified network.

2006-08-09 Reply Admin

Regular password changes are not always the best thing to do. If you require password changes too often, people indeed start to write them down and slip them under the keyboard.

You change passwords when you have evidence that a password leaked out. E.g. a sys admin leaving means you change all sys admin (root, etc.) passwords. An employee leaving means you block all his/her accounts. A normal employee leaving who had access to a shared account with a shared password (bad!) means you change the shared password. A contractor leaves who had access ... you know the drill.

Monitor account usage. If things look normal, if nothing happens, you don't require to change passwords. If you see strange access patterns, require a password change.

triso · 2006-08-09 Reply Admin

Thuktun:
After all, the staff doing the password changes can be implicitly trusted not to save a copy of this file (or a subset of its contents) for use during the next year...

I doubt anyone works there for more than one year.

2006-08-09 Reply Admin

Anonymous:
Hey, it is *still* a step up from storing your PW under your keyboard

At my last sysadmin job, I got the label maker and put two incredibly bogus passwords on the bottom of my keyboard. I wonder if anyone ever tried them...

2006-08-09 Reply Admin

Alex Papadimoulis:
When I was a kid, all we needed to know was where the power button is and what side to boot the floppy to; and we were all fine!"

Floppies? FLOPPIES?! We had to toggle in the boot strap on the front panel of the machine, only later we got a punched tape system to load our programs and data off of!

Young people these days. *hrumph*

triso · 2006-08-09 Reply Admin

SecondMouse:
I wonder if the password file is sorted alphabetically? So if my name is Zute and the CEO's name is Arthur, and I'm a lazy bastard, then I don't have read past the first page. I can just use the CEO's creds right?!?!

"Bad, bad, naughty Zute!"

Eureka! I've got it. The name of the company is Castle Anthrax. Well, maybe not.

Maurits · 2006-08-09 Reply Admin

Anonymous:
Foosball girl must have found out what the forum software admin password was so she could regain the top position over bean bag girl.

There's a nice mental picture.

triso · 2006-08-09 Reply Admin

shadowman:
What I can't get past is the Windows Logon. It's so easy for an admin to set password policies that require a change every xx days, and to force constraints. Why would anyone stay for a whole weekend doing somethig that doesn't require any manual work? Are you sure this isn't made up?

Perhaps the users were too frustrated or stunned when they had to do it themselves: 'I can't change my password. Can you send someone to help.' or 'I can't login with my new password.'

biziclop · 2006-08-09 Reply Admin

Anonymous:
Anonymous:

On top of being rediculously executed, doing a yearly password change seems very lax in general. Where I'm working, we have to change passwords for all systems (by ourselves, of course. They are OUR passwords) every 90 days. At least 8 characters, containing upper and lower case characters, numbers, symbols, cannot be one of our last 5 passwords (the systems check against a list of our old passwords), cannot contain dictionary words, and cannot be a sequence (ie: May2006!, Jun2006!, etc.). Is it a pain? Yes. Does anyone complain? No. Why? Because we know we have competent Sys Admins running the show.

Hardly. Enforced password changes are a classic piece of cargo cult. Everyone does them because everyone does them, not because they understand why they are doing them. They don't improve security. In fact they probably decrease it. The one time regular enforced changes are sensible is when a code (such as an access code on a door) is shared among several people. Otherwise not.

Actually the theory behind frequent password changes is that if someone steals the file with all the hashes, you get to change them before he can rip them. Of course the practice is writing it onto sticky notes or use the same password for every system or use a sequence your policy doesn't check against.

Bus Raker · 2006-08-09 Reply Admin

gremlin:
Anonymous:
Anonymous:
it was a pretty close estimate.

According to the FBI/CSI 1999 Computer Crime & Security Survey, 30% of companies polled reported system penetration by outsiders. But even higher crime rates were reported from within the traditional perimeter of the enterprise. According to the same study, 55% experienced unauthorized access by insiders within the past year (up 10% from 1998)

http://www.intel.com/network/connectivity/resources/doc_library/white_papers/products/ipsecurity/index.htm#Section4


"60% of companies have been attacked from the inside" != "60% of attacks on companies come from the inside"

No, but 55 / (55+30) ~ 60% (as the OP claimed).

So is 3/5. Coincidence?

Speaking of penetration by outsiders and the mental picture of foosball girl on top of beanbag girl. ..

biziclop · 2006-08-09 Reply Admin

snoofle:

The place I work in must be extremely anal about passwords. They have the usual 90-day change policy, but I have no less than 7 different passwords (one for each of the 7 different systems that all have different password requirements (upper/lower/number/with[out] special chars/min-max len). Then, all seven systems keep track of the last THIRTEEN passwords so you can't duplicate them.

Admittedly, I memorized just the main system's password. Then I have a NOTE in Outlook with all of the passwords, written in what is obviously a hint to me, but will mean nothing to anyone else.

Of course, all seven login names are different too, so they're in the note as well.

I do NOT look forward to my 90th day on this job when I need to rotate 7 passwords 13 times. *sighs*

On one of our systems we have a truly evil policy: passwords expire after 30 days but the mandatory minimum delay between two consecutive password changes is ... drumroll... yes, 30 days.

mratzloff · 2006-08-09 Reply Admin

Because no real company would have such a brain-dead password changing scheme, I must conclude that this is all an elaborate phishing scheme designed to gain access to Brian K's commonly-used passwords. When he goes in on Thursday he'll find that the office has been stripped bare and his bank account is empty. Only then will he realize that all of the other employees were simply actors in a fabricated reality, a la "The Prisoner".

Jackal von ÖRF · 2006-08-09 Reply Admin

Alex Papadimoulis:

This password must be 
exactly 8 characters long and can be any combination of lower
case letters and numbers.

This reminds me about a bug (or undocumented feature) I found a short while ago from one web-based system. When logging into the system, it only checks the first 8 characters of the password. If your password is longer than 8 characters, the rest of the characters can be anything or missing.

I'm just a regular user of the system, so I can't access the source code, but I believe that somewhere in the database there is a field called `password` varchar(8) instead of storing a hash of the password.

2006-08-09 Reply Admin

To all new employees:
please write your password down, and place it under your keyboard. After your work, we will take it, and set your new password in all of our systems.

2006-08-09 Reply Admin

Anonymous:
Anonymous:
Anonymous:
Pin Numbers
WTF is a PIN number? People have started numbering their personal identification numbers? I bet you're using a NIC card to connect to this website and you type your PIN number into ATM machines.

Thank you! Danke schön! About time someone says something about. We are all nerds here, something redundent like PIN number and ATM machine shoudln't even be in our vocabulary...!

What's wrong with using an ATM machine? Beats using an Ethernet machine!

Sorry, will go back under rock now.

2006-08-09 Reply Admin

I'm taking that you were implying sarcasm, but what you said I have found to be true. You pretty much have to trust a portion of your IT staff to not do bad things. It's impossible for them not to be able to see/find the passwords or other things (yet).

Trusting sysadmins to some extent- Yes. But... Your sysadmins should never see passwords. You give them the power to CHANGE passwords, yes! But to look at them? That's Bad, mmmkay?

I have to tell this to my users often. Fortunately, I only have about three of them.

2006-08-09 Reply Admin

I worked for a company this bad once. The IT manager was completely incompetent - a fresh grad who magically found his way in to the job. He insisted on keeping everyones password in a file "just in case".

What's worse the guy couldn't type - he would hunt and peck one key at a time

My department were so utterly frustrated with this policy that I later found out that one of my guys changed his password to "thequickbrownfoxjumpsoverthelazydog" just for the satisfaction of the corresponding mental image... ....t.....h......e......q.......u......i... (you get the idea)

skington · 2006-08-09 Reply Admin

Jackal von ÖRF:
This reminds me about a bug (or undocumented feature) I found a short while ago from one web-based system. When logging into the system, it only checks the first 8 characters of the password. If your password is longer than 8 characters, the rest of the characters can be anything or missing.

This could well be a system using the basic Unix crypt() function, that (if not patched) only works on the first 8 bytes.

2006-08-09 Reply Admin

Anonymous:
PS: And while we're doing this if you have any other passwords you would like changed such as Pin Numbers for your bank cards or log on to your private email just send us the relevant information and we'll change those as well.

Hate to nit pick but WTF is with "pin number" thats like saying personal identification number number, its as bad as ATM machine.(just one of my pet hates)

Anywho, I would love to work for this place, you could use the payroll officers username to change your pay. : )

captcha: perfection LOL

SilverDirk · 2006-08-09 Reply Admin

Anonymous:
Anonymous:
PS: And while we're doing this if you have any other passwords you would like changed such as Pin Numbers for your bank cards or log on to your private email just send us the relevant information and we'll change those as well.

Hate to nit pick but WTF is with "pin number" thats like saying personal identification number number, its as bad as ATM machine.(just one of my pet hates)

captcha: perfection LOL

How about "Windows 2000, built on NT Technology"

Rodyland · 2006-08-09 Reply Admin

When I get in the right mood, I'll prod stupidity like this with a stick until it dies or I get bored... in this case I forsee the following exchange:

Me. My new password should be "aaaaaaaa"
Them: Inappropriate. Please mix the case.
Me: But you said "it may include upper/lower/number". You didn't say "must".
Them: It must include upper/lower
Me: Make it "Aaaaaaaa"
Them: Please include numbers too.
Me: Make it "Aaaaaaa1"
Them: Inapproprate. Too easy to guess.
Me: No it's not. It's hard to guess. You'd never guess it in a milion years.
Them: Just change it.
Me: "Aaaaaaa2"
......

I could keep this going for weeks if the mood struck me and they were persistent enough.

Rodyland · 2006-08-09 Reply Admin

Anonymous:
Anonymous:
Anonymous:
Pin Numbers

WTF is a PIN number? People have started numbering their personal identification numbers?

I bet you're using a NIC card to connect to this website and you type your PIN number into ATM machines.

Thank you! Danke schön! About time someone says something about. We are all nerds here, something redundent like PIN number and ATM machine shoudln't even be in our vocabulary...!

Brought to you by the Department of Redundancy Department.

Rodyland · 2006-08-09 Reply Admin

Jackal von ÖRF:
Alex Papadimoulis:
This password must be 
exactly 8 characters long and can be any combination of lower
case letters and numbers.
This reminds me about a bug (or undocumented feature) I found a short while ago from one web-based system. When logging into the system, it only checks the first 8 characters of the password. If your password is longer than 8 characters, the rest of the characters can be anything or missing.

My old Uni system had an automated password robustness checker, had to have a mixture of upper and lower case, numberals and special characters with no dictionary words, minimum 7 characters I think. All nice, got me in the habit of using strong passwords, except a friend of mine discovered that the password stored by the system used 8 characters, while the robustness checker checked the entire string.

So your new password could be set as "aaaaaaaaaa123#$#ADK" and get through, but to log in you'd only have to type "aaaaaaaa"

olddog · 2006-08-09 Reply Admin

ParkinT:

GoatCheez:
Is it possible that the speadsheet in question is only to be used for the weekend? No coding related WTF's today? Assuming the spreadsheet in question was left on a publicly shared drive on their internal network, then yeah, WTF man.... Still though, not that much of a biggie... Well, it wasn't automated either sooooo..... eh... blah.

I really think that the speadsheet in question is to be deleted immediately after the password update is done.

Ah, but suppose the Spreadsheet was printed,

laid on a wooden table,

photographed.....

This is probably a good time to introduce "proof of concept" on the wooden tabletop *security* scanner.

1) Start with a micro-smooth sanded, unfinished wooden table top. ( the master table )

2) Coat it generously with a ( secret formula ) transfer solvent.
3) Place all the security document print-outs *FACE DOWN* onto the wet table top.
4) 'Take and put' a rug on top of that.
5) 'Take and put' rocks on top of that.
6) Wait a month.

... Time passes...
-) Remove the rugs -n- rocks revealing the ( reverse image ) master table

7) Get another fresh micro-smooth sanded, unfinished wooden table top. ( the transfer table )
8) Coat it generously with ( the secret formula ) transfer solvent.
8) Also re-coat master table top generously with ( the secret formula ) transfer solvent.
9) Up-end the master table top and place it directly ( top to top ) on top of the transfer table.
10) 'Take and put' the same rocks on top of that. ( rock re-use )
11) Wait only a few days. ( timimg is critical ) . Don't let the two tables 'bond'.

... Time passes...
12) Separate the table tops. ( typicall known as transfer separation )

....For security purposes ( this topic is about security )
13) Burn the the master table.
14) Wrap the rug around the the transfer table and bury it. ( rug re-use )
15) Mark the burial spot with the rocks ( more rock re-use, this is good, yes? )

... Time passes...until the next security audit
16) Dig up the table for admin purposes.

....For added *EXTRA* security ( this topic is about security )
17) Burn the rug and bury the rocks.

Of course this technology will become public knowlege,
so the real money will be with the consumables...( the secret formula ) transfer solvent.

deathkrush · 2006-08-09 Reply Admin

Alex Papadimoulis:

So with the new drive to bigger and greater security, Brian K was happy to see that at least one company took a more nostalgic approach.

Is this the same Brian K as Brian Keron from Volition?

deathkrush · 2006-08-09 Reply Admin

Anonymous:
Anonymous:
PS: And while we're doing this if you have any other passwords you would like changed such as Pin Numbers for your bank cards or log on to your private email just send us the relevant information and we'll change those as well.

Hate to nit pick but WTF is with "pin number" thats like saying personal identification number number, its as bad as ATM machine.(just one of my pet hates)

Anywho, I would love to work for this place, you could use the payroll officers username to change your pay. : )

captcha: perfection LOL

So what am I supposed to say then, PI number, AT machine? Sounds kind of WTF if you ask me.

Rodyland · 2006-08-09 Reply Admin

deathkrush:

So what am I supposed to say then, PI number, AT machine? Sounds kind of WTF if you ask me.

How about "PIN" or "ATM"?

2006-08-09 Reply Admin

The real WTF is that some people have to write a frickin' essay instead of a quick comment!

Nobody bothers to read your crap, so don't bother posting it. Do you think it makes you smarter if you type more? Losers!

2006-08-09 Reply Admin

Anonymous:
The real WTF is that some people have to write a frickin' essay instead of a quick comment!

Nobody bothers to read your crap, so don't bother posting it. Do you think it makes you smarter if you type more? Losers!

This will probably offend you even more then!
I said a hip hop the hippie the hippie
to the hip hip hop, a you dont stop
a rock on, pretty bubba to the boogity bang, bang,
the boogie to the boogity beat!

2006-08-09 Reply Admin

Anon:
This will probably offend you even more then!
I said a hip hop the hippie the hippie
to the hip hip hop, a you dont stop
a rock on, pretty bubba to the boogity bang, bang,
the boogie to the boogity beat!

ARRRGHHH!!! You bastard!!!

Some Idiot · 2006-08-09 Reply Admin

Anonymous:
Anonymous:
Pin Numbers
WTF is a PIN number? People have started numbering their personal identification numbers? I bet you're using a NIC card to connect to this website and you type your PIN number into ATM machines.

Hey, I do that every day at 10 am in the morning daily.

2006-08-10 Reply Admin

Gary:
ARRRGHHH!!! You bastard!!!

Real mature Gary.

2006-08-10 Reply Admin

Anonymous:
Anonymous:
Anonymous:
Anonymous:
Pin Numbers
WTF is a PIN number? People have started numbering their personal identification numbers? I bet you're using a NIC card to connect to this website and you type your PIN number into ATM machines.

Thank you! Danke schön! About time someone says something about. We are all nerds here, something redundent like PIN number and ATM machine shoudln't even be in our vocabulary...!

What's wrong with using an ATM machine? Beats using an Ethernet machine!

Sorry, will go back under rock now.

OMG god! WTF f*ck!

2006-08-10 Reply Admin

Anonymous:
Anonymous:
Anonymous:
Anonymous:
Anonymous:
Anonymous:
Anonymous:
Anonymous:
Anonymous:
Anonymous:

There should be a limit to quoting...

2006-08-10 Reply Admin

Anonymous:
Hey, it is *still* a step up from storing your PW under your keyboard

D*mn you! Now I got to find a new place to store my password..!

2006-08-10 Reply Admin

Anonymous:
Hey, it is *still* a step up from storing your PW under your keyboard

Is it? I've yet to meet the hacker who can remotely read a post-it note in my desk drawer.

--
Colin

Rodyland · 2006-08-10 Reply Admin

Reall, post-it-note in the (locked?) drawer next to your computer is not that insecure. It's pretty much a given that physical access = pwnage, so IMO the only thing a password will give is system-wide network access, which any half-decent hacker with access to a connected/trusted machine will be able to get for himself anyway.

Still, it'd be nice for the hack that came from my computer to NOT use my password and login, too. :)

2006-08-10 Reply Admin

biziclop:

Actually the theory behind frequent password changes is that if someone steals the file with all the hashes, you get to change them before he can rip them. .

This is true. But I've yet to meet a Sysadmin who could tell me that. And, as you probably know, the policy originated a long time ago on systems with relatively primitive security. Nowadays, if you set up a system properly, the only people who can get at the hash file already have admin rights, so it's an uncommon way of obtaining passwords.

biziclop:

Of course the practice is writing it onto sticky notes or use the same password for every system or use a sequence your policy doesn't check against.

Precisely. (And actually I've not yet encountered a system that checked for sequences anyway.)

2006-08-10 Reply Admin

mnature:
We do have to give copies of our safe combinations to our group office, but those are sealed in envelopes, and must have two people present both to open the envelope and then to open the safe, in case of emergencies.

How does the envelope know how many people are present?

2006-08-10 Reply Admin

Jackal von ÖRF:

This reminds me about a bug (or undocumented feature) I found a short while ago from one web-based system. When logging into the system, it only checks the first 8 characters of the password. If your password is longer than 8 characters, the rest of the characters can be anything or missing.

I'm just a regular user of the system, so I can't access the source code, but I believe that somewhere in the database there is a field called `password` varchar(8) instead of storing a hash of the password.

There is a remote system that I log into regularly that runs SunOS 5.9, and it does the same thing. The sysadmins recently upped the password requirements to include odd symbols, numbers, etc., which I added...after the 8th character. I had assumed this was a localized problem, however. Good to know that it's more common than I thought.

Also, at work, our various passwords are dictated to us, and don't seem to ever change (been working there a couple years and they haven't changed yet)....and there's no way for us to change them.

Captcha = Quality

Annual About Security

Leave a comment on “Annual About Security”