41–50 of 50 posts
Earlier quoted context omitted.
Bang on. Most likely social engineering. If this were actually an employee, they should be fired/told to fuck off.
A social engineer wouldn't try for this much data. One SSH key or password would be enough. I'm going with the fucking-retarded-auditor theory.
I flagged this. The likely explanation is that this is just a troll -- 2-day-old account, this is the only question that's been asked on it. There's no way that somebody that's been doing audits for 10 years would ask for this stuff, and there's no way any server admin would even consider providing the information. ...At least, any server admin that shouldn't be yoinked back down to making patch cables.
It's a throwaway account. It has "throwaway" in its name. The question ends with the asker explaining that he's posting it from a throwaway account because he doesn't want his real name associated with it. How many questions would you expect a throwaway account to have?
Am I the only one who thinks the story is a little too perfect and ridiculous? It is much more likely that the author simply fabricated the story. He did manage to start a very popular thread, and get a ton of people with really high rep to respond AND get a link on HN. He just threw out some bait, and the community swarmed like starving fish.
This is true of all "light" SO/SF posts. Nobody gets excited about answering someone's obscure apt-get question. Everyone gets excited when they can spend their boring workday telling some dude that his security consultant is fucking him. It's the same reason people read "People Magazine" instead of "Purely Functional Data Structures".
This is a case of social engineering, not of a security auditor, but of the poster. The poster wants to know an easy way to collect public and private SSH keys and fake 6 months of inbound traffic. There is no auditor. Maybe the poster is writing a book on cracking systems? Who knows. But it smells like a hoax.
What purpose would faking 6 months of inbound traffic serve? If he just wanted to cover his tracks, wouldn't he just erase logs rather than trying to make them look legit? That would seem like doing things the hard way.
Earlier quoted context omitted.
Yes, I wondered the same thing! Aside from the legal implications, the OP seems to have some questionable ethics as well.
What's unethical about that? If politics have required him to do provide information he can't legally provide, falsifying the information seems like the only reasonable course of action. Of course, quitting is the other out, but I do think he has a moral obligation to prevent his company from handing any of this information over to the auditor.
- what this guy is asking for
- how that is in violation of the PCI data security standard
- explain that you are not able, and not allowed to provide this information
- explain that this likely means the auditor is a hack and steps need to be taken to get a proper auditor
I flagged this. The likely explanation is that this is just a troll -- 2-day-old account, this is the only question that's been asked on it. There's no way that somebody that's been doing audits for 10 years would ask for this stuff, and there's no way any server admin would even consider providing the information. ...At least, any server admin that shouldn't be yoinked back down to making patch cables.
Earlier quoted context omitted.
What's unethical about that? If politics have required him to do provide information he can't legally provide, falsifying the information seems like the only reasonable course of action. Of course, quitting is the other out, but I do think he has a moral obligation to prevent his company from handing any of this information over to the auditor.
The only ethical course of action is to stop the circus and explain to your manager: - what this guy is asking for - how that is in violation of the PCI data security standard - explain that you are not able, and not allowed to provide this information - explain that this likely means the auditor is a hack and steps need to be taken to get a proper auditor
To quote: if I don't provide this information we loose access to our payments platform
I wonder if, when confronted about how ridiculous the requests were, the auditor will claim to have been testing how well the admins resisted social engineering?
Perhaps the auditor is smarter than everyone thinks and is expecting the sysadmin to come to him empty handed and with an explanation as to why the requirements aren't reasonable.
The poster has already tried that, which is when the "auditor" replied with the "10 years experience" rant. If this actually is his tactic, then he should be fired simply on the principle that his modus operandi will cost the company clients, as it seems to be in this case. If he just has his head up his ass, then he needs to be fired for gross incompetence and the company may need to notify anyone that he's previous…