Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

theverge.com

Post reply on HN
Print view View original

41–50 of 140 posts

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#41

Post by bigyikes »

bongodongobob wrote: post #28
dazbradbury wrote: post #14

The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!

Uh, it does allow that in the organization settings. Also the SAML/SSO comment below as well. If you can change names, IT admins are either non-existent or just being lazy.

My company allows name changes. It’s fun.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#42

Post by bigyikes »

reactordev wrote: post #35
dazbradbury wrote: post #20

Earlier quoted context omitted.

Presumably with SAML/SSO you can still change your slack display name and profile picture?

Negative, that comes from Azure AD, or Cognito, or Keycloak, or whatever. The users name, email, phone, location, avatar pic, department, etc all comes over in the SAML payload.

This is not correct in general. My job uses SSO and I can change my Slack name.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#43

Post by makeitdouble »

dazbradbury wrote: post #14

The fact slack doesn't allow you to lock down name changes must be such a gaping security hole for big companies. Change your name to the CEO, and profile image to match. Odds of people noticing the difference are extremely small until it's too late. Changing to slackbot seems like small fry!

At the same time the ability to change name is sich a godsend.

We're currently abusing it to have presence info straight in the display name (e.g. mike-2/12~16vac.) to let anyone contacting us what to expect for response times, or wether to ask for a task if it's a few days before a planned vacation.

Nobody seemed to look at the actual status property and it beats going to the calendars to check.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#44

Post by user_7832 »

InitialLastName wrote: post #29
toomuchtodo wrote: post #2

Best place to hide is something that looks like a service account everyone is afraid to touch for fear of what will break if disabled. Well played!

On the other hand, an over-zealous IT guy at my job just deleted our Jira automation account (because he didn't know what it was there for and got sketched out by the name $CompanySecretary). Cue (a few days later) a large pile of pain as we tried to find and fix every workflow and ticket that formerly referred to that user before something really important broke.

Aah, he took down Chesterton's fence and found the reason of its existance!

(https://en.wiktionary.org/wiki/Chesterton%27s_fence)

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#45

Post by bongodongobob »

bigyikes wrote: post #41
bongodongobob wrote: post #28

Earlier quoted context omitted.

Uh, it does allow that in the organization settings. Also the SAML/SSO comment below as well. If you can change names, IT admins are either non-existent or just being lazy.

My company allows name changes. It’s fun.

That means they're not using SAML/SSO which sounds absolutely crazy to me, unless you only have like a dozen users. The implication is that your IT team doesn't take security seriously. Not because you can change names, but because they aren't implementing identity policies.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#46

Post by foobarian »

bigyikes wrote: post #42
reactordev wrote: post #35

Earlier quoted context omitted.

Negative, that comes from Azure AD, or Cognito, or Keycloak, or whatever. The users name, email, phone, location, avatar pic, department, etc all comes over in the SAML payload.

This is not correct in general. My job uses SSO and I can change my Slack name.

In our case we can not change the Slack display name, but we can change the @ handle. Pretty good compromise IMO.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#47

Post by selectodude »

neilv wrote: post #4

> Of course, not every company will fall for this trick The company can have the last laugh: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

That’s why he waited two years to say he did it which just so happens to be the CFAA statute of limitations.

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#49

Post by zzixp »

rokkitmensch wrote: post #9

This reminds me of a glorious day at my consulting company ca. 2016 when we discovered that we could change each other's names on Slack. At one point everyone was just named dad.

... is this still possible?

(my college frisbee team is on slack)

Re: A former Gizmodo writer changed name to 'Slackbot', stayed undetected for months

#50

Post by reactordev »

bigyikes wrote: post #42
reactordev wrote: post #35

Earlier quoted context omitted.

Negative, that comes from Azure AD, or Cognito, or Keycloak, or whatever. The users name, email, phone, location, avatar pic, department, etc all comes over in the SAML payload.

This is not correct in general. My job uses SSO and I can change my Slack name.

It is correct, your company just messed up somewhere...
Post reply on HN