Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

theverge.com

Post reply on HN
Print view View original

31–40 of 140 posts

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#31

Post by InitialLastName »

toomuchtodo wrote: post #30
InitialLastName wrote: post #29

Earlier quoted context omitted.

On the other hand, an over-zealous IT guy at my job just deleted our Jira automation account (because he didn't know what it was there for and got sketched out by the name $CompanySecretary). Cue (a few days later) a large pile of pain as we tried to find and fix every workflow and ticket that formerly referred to that user before something really important broke.

Institutional knowledge and documentation is not free, but it has a cost!

Apparently the cost of reading the documentation, asking anybody, or just looking at the account's activity was too high.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#32

Post by nadermx »

justanother wrote: post #10

I knew an ex-employee back in the day (not me I swear) who created a dialup/ISDN provisioning profile called 'Ringing' in the modem rack controller module (not the Radius server, that would be too obvious), such that a glance at the modem rack status page showed everyone who was connected, and one that was 'Ringing', just like any other incoming call that hadn't been picked up yet. It went completely undetected, yiel…

You got a reference on the CFAA? On the contrary, I found that it was probably not a problem to change a URL parameter

"We also note that in order to be guilty of accessing “without authorization, or in excess of authorization” under New Jersey law, the Government needed to prove that Auernheimer or Spitler circumvented a code-or password-based barrier to access. See State v. Riley, 988 A.2d 1252, 1267 (N.J. Super. Ct.Law Div.2009). Although we need not resolve whether Auernheimer’s conduct involved such a breach, no evidence was advanced at trial that the account slurper ever breached any password gate or other code-based barrier. The account slurper simply accessed the publicly facing portion of the login screen and scraped information that AT&T unintentionally published."

https://law.justia.com/cases/federal/appellate-courts/ca3/13...

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#33

Post by jackson1442 »

dazbradbury wrote: post #14

The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!

Name changes can be locked; I'm in an Enterprise Grid org and our display names/usernames are synced against our employee profile. We're also required to SSO every single time we launch the desktop app so once you're terminated you're definitely not getting back in (they deactivate accounts very quickly too, so mobile is likely not a major concern).

Basically the only thing you can change without filing a ticket is your picture and some mostly-irrelevant freetext fields.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#34

Post by justanother »

nadermx wrote: post #32
justanother wrote: post #10

I knew an ex-employee back in the day (not me I swear) who created a dialup/ISDN provisioning profile called 'Ringing' in the modem rack controller module (not the Radius server, that would be too obvious), such that a glance at the modem rack status page showed everyone who was connected, and one that was 'Ringing', just like any other incoming call that hadn't been picked up yet. It went completely undetected, yiel…

You got a reference on the CFAA? On the contrary, I found that it was probably not a problem to change a URL parameter "We also note that in order to be guilty of accessing “without authorization, or in excess of authorization” under New Jersey law, the Government needed to prove that Auernheimer or Spitler circumvented a code-or password-based barrier to access. See State v. Riley, 988 A.2d 1252, 1267 (N.J. Super. C…

Exactly correct. Nonetheless, a prosecution was indeed brought, and the opinion you're citing is an appeal. Without the EFF's financial support, weev would not be a free man.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#35

Post by reactordev »

dazbradbury wrote: post #20
reactordev wrote: post #16

Earlier quoted context omitted.

Bigger companies use SAML or other federation that makes it impossible to login without a corporate authentication.

Presumably with SAML/SSO you can still change your slack display name and profile picture?

Negative, that comes from Azure AD, or Cognito, or Keycloak, or whatever.

The users name, email, phone, location, avatar pic, department, etc all comes over in the SAML payload.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#36

Post by notatoad »

the screenshots of people replying to him who clearly know he's not slackbot, including calling him Tom, kind of contradict the headline here. he was clearly not "undetected".

we've got some former staff in our slack still. they check in and say hi every now and then, it's nice. if one of them started pretending to be a snarky slackbot one day, we'd probably have a laugh about it too.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#37

Post by gerdesj »

rokkitmensch wrote: post #9

This reminds me of a glorious day at my consulting company ca. 2016 when we discovered that we could change each other's names on Slack. At one point everyone was just named dad.

Love it but I will insist on grandad or I will set the girls (grand-daughters) on you ... and they are merciless 8)

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#38

Post by adamrezich »

this is a reporter "reporting" on another reporter's self-reporting (on twitter) of what he did from when he quit/was fired/laid off (the "article" doesn't even say) from his job as a reporter. "reporting" is in quotes here because it's the thinnest possible veneer atop the original tweet. what possible value does this article have over the original tweet, aside from adding an additional, unnecessary needed layer of "reporting" for this non-story? it's difficult to see this as anything but a "journalism" circlejerk (redundant).

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#39

Post by ksenzee »

notatoad wrote: post #36

the screenshots of people replying to him who clearly know he's not slackbot, including calling him Tom, kind of contradict the headline here. he was clearly not "undetected". we've got some former staff in our slack still. they check in and say hi every now and then, it's nice. if one of them started pretending to be a snarky slackbot one day, we'd probably have a laugh about it too.

“Undetected by management” is the meaning here, as the article makes clear. His friends knew he was there and were having a laugh.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#40

Post by kej »

rokkitmensch wrote: post #9

This reminds me of a glorious day at my consulting company ca. 2016 when we discovered that we could change each other's names on Slack. At one point everyone was just named dad.

This sounds a lot like when my kids realized anyone can edit Netflix/Disney+ profile names and pictures.
Post reply on HN