One chestnut from my history in lottery game development:
While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.
Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.
Banned open source software because of security concerns. For password management they require LastPass or that we write them down in a book that we keep on ourselves at all times. Worth noting that this policy change was a few months ago. After the giant breach.
And for extra absurdity: MFA via SMS only.
I wish I was making this up.
Banning open source because of security concerns is the opposite of what they should be doing if they care about security. You can’t vet proprietary software.
It’s not about security, it’s about liability. You can’t sue OSS to get shareholders off your back.
Do you work for a government?
I tried so hard to steer my last company away from SMS MFA. CTO basically flat out said, “As long as I’m here SMS MFA will always be an option.”
Alright, smarmy dumbass. I dream of the day when they get breached because of SMS.
If I remember it correctly, in GSM it’s perfectly possibly to spoof a phone number to receive the SMS using the roaming part of the protocol.
The thing was designed to be decently safe, not to be highly secure.
Care to elaborate “MFA via SMS only”? I’m not in tech and know MFA through text is widely used. Or do you mean alternatives like Microsoft Authenticator or YubiKey? Thanks!
Through a low tech social engineering attack referred to as SIM Jacking, an attacker can have your number moved to their SIM card, redirecting all SMS 2FA codes effectively making the whole thing useless as a security measure. Despite this, companies still implement it out of both laziness and to collect phone numbers (which is often why SMS MFA is forced)
TIL! thanks for the explanation.
To collect numbers, which they sell in bulk, to shadey organizations, that might SIM Jack you.
Took away Admin rights, so everytime you wanted to install something or do something in general that requires higher privileges, we had to file a ticket in the helpdesk to get 10 minutes of Admin rights.
The review of your request took sometimes up 3 days. Fun times for a software developer.
We worked around this at my old job by getting VirtualBox installed on our PCs and just running CentOS or Ubuntu VMs to develop in. Developing on windows sucks unless you’re doing .NET imo.
Developing on VMs also sucks, neverending network issues on platforms like Windows which have a shitty networking stack (try forwarding ports or using VPN connections).
In fact, Windows is just a shitty dev platform in general for non-Microsoft technologies but I get that you needed to go for the least shit option
Yeah fortunately we didn’t need to do any port forwarding or anything complex for networking for developing locally. It was definitely much easier for us. I don’t like Apple, but I didn’t mind my other old job that gave us MacBooks honestly.
Oh shit, you just reminded me of the time that I had to PHONE Macromedia to manually activate software because of the firewalling. This was after waiting days to get administrative permission to install it in the first place.
“Thank you” for helping resurface those horrible memories!
I don’t miss those days.
3 days? That’s downright speedy!
I submitted a ticket that fell into a black hole. I have long since found an alternate solution, but am now keeping the ticket open for the sick fascination of seeing how long it takes to get a response. 47 days and counting…
Nobody wants to take it because it will mess up their KPIs.
Any ticketing system set up like that is just begging for abuse. If they don’t have queue managers then the team should share the hit if they just leave the ticket untouched
I too know this pain
During those 10 minutes of admin rights:
net user secretlocaladmin * /add net localgroup administrators secretlocaladmin /addThere’s likely a GPO cycling and removing all the admins.
This was my experience too. Shitty group policies messing with my local changes
We used Intune Portal for a list of approved desktop apps
Let me guess, the list is about 6 items long with no provision for getting any added
No, it was quite extensive (20-30?) and we (I) kept expanding it. I even added icons for each app so it looked nice.
All published software was approved by Cybersecurity. We allowed people to request apps and evaluated each case.
Fighting similar shit right now. I need admin rights frequently.
Over 150 Major Incidents in a single month.
Formerly, I was on the Major Incident Response team for a national insurance company. IT Security has always been in their own ivory tower in every company I’ve worked for. But this company IT Security department was about the worst case I’ve ever seen up until that time and since.
They refused to file changes, or discuss any type of change control with the rest of IT. I get that Change Management is a bitch for the most of IT, but if you want to avoid major outages, file a fucking Change record and follow the approval process. The security directors would get some hair brained idea in a meeting in the morning and assign one of their barely competent techs to implement it that afternoon. They’d bring down what ever system they were fucking with. Then my team had to spend hours, usually after business hours, figuring out why a system, which had not seen a change control in two weeks, suddenly stopped working. Would security send someone to the MI meeting? Of course not. What would happen is, we would call the IT Security response team and ask if anything changed on their end. Suddenly 20 minutes later everything was back up and running. With the MI team not doing anything. We would try to talk to security and ask what they changed. They answered “nothing” every god damn time.
They got their asses handed to them when they brought down a billing system which brought in over $10 Billion (yes with a “B”) a year and people could not pay their bills. That outage went straight to the CIO and even the CEO sat in on that call. All of the sudden there was a hard change freeze for a month and security was required to file changes in the common IT record system, which was ServiceNow at the time.
We went from 150 major outages (defined as having financial, or reputation impact to the company) in a single month to 4 or 5.
Fuck IT Security. It’s a very important part of of every IT Department, but it is almost always filled with the most narcissistic incompetent asshats of the entire industry.
Jesus Christ I never thought id be happy to have a change control process
Lots of safety measures really suck. But they generally get implemented because the alternative is far worse.
At my current company all changes have to happen via GitHub PR and commit because we use GitOps (ex: ArgoCD with Kubernetes). Any changes you do manually are immediately overwritten when ArgoCD notices the config drift.
This makes development more annoying sometimes but I’m so damn glad when I can immediately look at GitHub for an audit trail and source of truth.
It wasn’t InfoSec in this case but I had an annoying tech lead that would merge to main without telling people, so anytime something broke I had his GitHub activity bookmarked and could rule that out first.
You can also lock down the repo to require approvals before merge into main branch to avoid this.
Since we were on the platform team we were all GitHub admins 😩. So it all relied on trust. Is there a way to block even admins?
Hm can’t say. I’m using bitbucket and it does block admins, though they all have the ability to go into settings and remove the approval requirement. No one does though because then the bad devs would be able to get changes in without reviews.
That sounds like a good idea. I’ll take another look at GitHub settings. Thanks!
The past several years I have been working more as a process engineer than a technical one. I’ve worked in Problem Management, Change Management, and currently in Incident for a major defense contractor (yes, you’ve heard of it). So I’ve been on both sides. Documenting an incident is a PITA. File a Change record to restart a server that is in an otherwise healthy cluster? You’re kidding, right? What the hell is a “Problem” record and why do I need to mess with it?
All things I’ve heard and even thought over the years. What it comes down to, the difference between a Mom and Pop operation, that has limited scalability and a full Enterprise Environment that can support a multi-billion dollar business… Is documentation. That’s what those numb nuts in that Insurance Company were too stupid to understand.
You poor man. I’ve worked with those exact fukkin’ bozos.
Lack of a Change Control process has nothing to do with IT Security except within the domain of Availability. Part of Security is ensuring IT systems are available and working.
You simply experienced working at an organization with poor enforcement of Change Control policies. That was a mistake of oversight, because with competent oversight anyone causing outages by making unapproved changes that cause an outage would be reprimanded and instructed to follow policy properly.
Set the automatic timeout for admin accounts to 15 minutes…meaning that process that may take an hour or so you have to wiggle the mouse or it logs out …not locks… logs out
From installs to copying log files, to moving data to reassigning owner of data to the service account.
And that’s why people use mouse jigglers and keep their computers unlocked 24/7.
Mine was removed by Corporate IT, along with a bunch of other open source stuff that made my life bearable.
Also I spent 5 months with our cyber security guys to try and provide a simple file replication server for my team working in a remote office with shit internet connectivity. I gave up, the spooks put up a solid defense, push all the onerous IT security compliance checking onto my desk instead of taking control.
Not as bad as my previous company though, outsourced IT support to ATOS was a nightmare.
It’s reasonably easy to make a hardware mouse wiggler with an Arduino Micro (and I don’t mean something that physically moves a mouse, rather something that looks like a USB mouse to the computer and periodically sends mouse movement messages).
If you’re desperate enough, look it up as it’s quite simple so there should be step by step instructions out there.
Absolutely love my Uno keyboard for this https://keyhive.xyz/shop/uno-single-key-keyboard
Got like 6 commands on a single key and one of them is to press shift every 30seconds so my computer doesn’t lock. Lifesaver.
Yeah, it’s surprisingly simple to get these microcontrollers to become essentially programmable keyboard/mouse emulators, by which point if you’re familiar with the stuff to program them (Arduino being the simplest and most widespread framework) it really just becomes a coding task and you can get it to do crazy stuff.
I suggested an Arduino Micro board because it bypasses the whole hardware side of the problem, but something like what you mention is even simpler.
I used a Sidewinder keyboard for years with programmable macros.
Yeah, I had my password as a macro.
Dick move on my part as the macro, I’m fairly sure, is stored in plaintext on the PC. But the convenience was great. I don’t do that any more.
Can also just buy one from Amazon if you’re lazy or not technically inclined.
Well, my off the cuff suggestion was what seems simple to me in this domain ;)
That said I get what you mean and agree.
That’s why you buy a jiggler that you place your mouse onto. Not detectable by IT :)
After mine was disabled, I found that if I run videos of old meetings or training onscreen, it keeps the system alive…
Works nicely when I’m WFH.
I set my pocket knife on the ctrl key when I have to step away.
Ahhh the old “level up an RPG Skill by jamming a pen cap into a key and going to watch Night Court reruns” method.
Thanks, I actually didn’t know holding CTRL would keep the system awake!
Does that keep your status in Teams as “online”? That’s what I use the jiggler for - if I’m waiting for CI tests which take 30+ minutes and I sit in front of the laptop, I don’t want to have to manually jiggle my mouse every couple of minutes just to keep my status.
Yep
Awesome, thank you!
That works?
Idk about every application but it keeps windows from timing out which serves most purposes for me.
The internal IT at that hellhole is a nightmare as well.
deleted by creator
There is no compliance item I am aware of that has that requirement, some CISO needs to learn to read.
Misunderstood STIG from the sound of it. The STIG is only applicable to unprivileged users but tends to get applied to all workstations regardless of user privileges. Also I think the .mil STIG GPOs apply it to all workstations regardless of privileges.
The other thing that tends to get overlooked is that AC-12 let’s you set it to whatever the heck you want. Ao you could theoretically set it to 99999 year by policy if you wanted.
https://www.stigviewer.com/stig/application_security_and_development/2017-01-09/finding/V-69243
One IT security team insisted we have separate source code repositories for production and development environments.
I’m honestly not sure how they thought that would work.
That’s fucking bananas.
In my job, the only difference between prod/dev is a single environmental file. Two repositories would literally serve no purpose and if anything, double the chances of having the source code be stolen.
That was the only difference for us as well. The CI/CD process built container images. Only difference between dev, test, and prod was the environment variables passed to the container.
At first I asked the clueless security analyst to explain how that improves security, which he couldn’t. Then I asked him how testing against one repository and deploying from another wouldn’t invalidate the results of the testing done by the QA team, but he kept insisting we needed it to check some box. I asked about the source of the policy and still no explanation, at least not one that made any sense.
Security analyst escalated it to his (thankfully not clueless) boss who promptly gave our process a pass and pointed out to Mr security analyst that literally nobody does that.
I’m honestly not sure how they thought that would work.
Just manually copy-paste everything. That never goes wrong, right?
I mean, it’s what the Security guys do, right? Just copy+paste everything, mandate that everyone else does it too, Management won’t argue because it’s for “security” reasons.
Then the Security guys will sit around jerking each other off about how much more secure they made the system
Could work if dev was upstream from prod. But honestly there would be no difference between that and branches.
Maybe it is a rights issue. Preventing a prod build agent of sorts to access develop code.
Yeah…assuming that the policy was written “from blood” (meaning someone did something stupid).
But even then you can put other checks and balances in place to make sure that kind of thing doesn’t happen.
This is such an extreme reaction though. Or the policy was made from someone dumb
Yep doing that now. Not sustainable in the slightest. Im glad im not in charge of that system.
Not my IT department (I am my IT department): One of the manufacturers for a brand of equipment we sell has a “Dealer Resource Center,” which consists solely of a web page where you can download the official product photography and user’s manuals, etc. for their products. This is to enable you to list their products on your e-commerce web site, or whatever.
Apparently whoever they subcontracted this to got their hands on a copy of Front End Dev For Dummies, and in order to use this you must create a mandatory account with minimum password complexity requirements, and solve a CAPTCHA every time you log in. They also require you to change your password every 60 days, and if you don’t they lock your account and you have to call their tech support.
Three major problems with this:
-
There is no verification check that you are actually an authorized dealer of this brand of product, so any fool who finds this on Google and comes up with an email address can just create an account and away you go downloading whatever you want. If you’ve been locked out of your account and don’t feel like picking up the telephone – no problem! Just create a new one.
-
There is no personalized content on this service. Everyone sees the same content, and it’s not like there’s a way to purchase anything on here or anyway, and your “account” stores no identifying information about you or your dealership that you feel like giving it other than your email address. You are free to fill it out with a fake name if you like; no one checks. You could create an account using obvioushacker@pwned.ru and no one would notice.
-
Every single scrap of content on this site is identical to the images and .pdf downloads already available on the manufacturer’s public web site. There is no privileged or secure content hosted in this “Resource Center” whatsoever. The pictures aren’t higher res or anything. Even the file names are the same. It’s obviously hooked up to the same backend as the manufacturer’s public web site. So if there were such a thing as a “bad actor” who wanted to obtain a complete library of glamor shots of durable goods, for some reason, there’s nothing stopping them from scraping the public web site and coming up with literally exactly the same thing.
It’s baffling.
deleted by creator
That’s three words.
That’s is only one word, dumby
-
I had to run experiments that generate a lot of data (think hundreds of megabytes per minute). Our laptops had very little internal storage. I wasn’t allowed to use an external drive, or my own NAS, or the company share - instead they said “can’t you just delete the older experiments?”… Sure, why would I need the experiment data I’m generating? Might as well /dev/null it!
Oh hey I was living this a few months ago!
Hasn’t made life hell, but the general dumb following of compliance has left me baffled:
- users must not be able to have a crontab. Crontab for users disabled.
- compliance says nothing about systemd timers, so these work just fine 🤦
I’ve raised it with security and they just shrugged it off. Wankers.
Thats really funny. Made my day thanks.
Are they super old school and not know about systemd? Or are they doing something out of compliance that they may hate too? I have so many questions.
I actually think they’re new school enough where Linux to them means a lot less than it does to us. And so they don’t feel at home on a Linux machine and, unfortunately, don’t care to learn.
I could totally be wrong, though. Maybe I’m the moron.
I dont think your the moron. Thats super strange. I can only think it might be some sort of standard that they had to comply with…or whatever.
deleted by creator
I’m torn if I should be nodding and patting myself on the back for not doing any of this insanity or cackling and taking notes…
Taking notes?!? If you can’t make idiotic decisions on your own, you’re not much of an IT guy to begin with.
Are you twirling your mustache?
deleted by creator
Mozilla products banned by IT because they had a vulnerability in a pervious version.
Rant
It was so bullshit. I had Mozilla Firefox 115.1 installed, and Mozilla put out an advisory, like they do all the fucking time. Fujitsu made it out to be some huge huge unfixed bug the very next day in an email after the advisory was posted and the email chain basically said “yk, we should just remove all Firefox. It’s vulnerable so it must be removed.”
I wouldn’t be mad if they decided that they didn’t want to have it be a managed app or that there was something (actually) wrong with it or literally anything else than the fact that they didn’t bother actually reading either fucking advisory and decided to nuke something I use daily.
Nah mate, they were completely right. What if you install an older version, and keep using it maliciously? Oh wait, now that you mention, I’m totally sure Edge had a similar problem at one point in the past. So refrain from using Edge, too. Or Explorer. And while we’re at it, it’s best to stay away from Chrome, as well. That had a similar vulnerability before, I’m sure. So let’s dish that, along with Opera, Safari, Maxthon and Netscape Navigator. Just use Lynx, it’s super lightweight!
EDIT: on another thought, you should just have stopped working for the above reason. Nothing is safe anymore.
Can’t use Lynx either.
https://www.cvedetails.com/cve/CVE-2010-2810/
All web pages must now be phoned in via a touch-tone system, and delivered on paper printouts via regular post.
Touch-tones had some sort of vulnerability too; you’re going to have to mail in your HTTP requests.
We cant run scripts on our work laptop because of domain policy. Thing is, I am a software developer. They also do not allow docker without some heavy approval process, nor VMs. So im just sitting here remoting into a machine for development…which is fine but the machine is super slow. Also their VPN keeps going down, so all the software developers have to reconnect periodically all at the same time.
At my prior jobs, it was all open so it was very easy to install the tools we needed or get approval fairly quickly. Its more frustrating than anything. At least they give us software development work marked months out.
My dev pc isn’t allowed to be connected to the internet :D
Yep you have it the worst. Shut down the thread.
Wait, I haven’t even started talking about the fact it’s a huge unstructured legacy project using SharePoint 2016 and…
Where did everyone go?
I cannot remember the specifics because it’s going back almost 15 years now but at one point…crontab (edit and other various vital tools) was disabled by policy.
To get necessary processes/cleanup done at night, I used a scheduled task on a Windows PC to run a BAT that opened a macro program which opened a remote shell and “typed” the commands.
Fuuuuuuck.
I hate this stuff. When I had a more devops role I would just VM everything. Developers need their tools, here is a VM with root. Do what you want and backups run on Friday.
Thought my work was bad. We at least can use VMs. I literally can’t do my job without one, Rockwell being what it is. Companies don’t like upgrading PLC software so I need to use old versions of windows occasionally to run old Rockwell stuff.
There was also a bug for a bit that would brick win11 PCs when trying to update PLC firmware, fun stuff.
Same boat. I use dedicated laptops. This is for my old Rockwell stuff, this is for my old Siemens stuff, this is my normal laptop with AD stuff, this one for Idec, and the last one for Schneider. Pretty much every laptop at the company gets retired it becomes mine.
Also works for on site access. Customer needs support? Mail them a laptop. I got one laptop that has been in Canada, both coastlines in America, Australia, and Vietnam.
I had a software developer job where they expected me to write code in Microsoft notepad, put it on a USB, and then plug it into airgapped computers to test it. Wasn’t allowed to even use notepad++.
Oh it felt so freaken good leaving that job after 6 weeks. It felt even better when I used my old manager’s personal phone number on a fake grinder profile I made. She kept a tally of my bathroom breaks.
Jump systems are a good practice but they gotta have the resources you need… I hate to say it but it sounds like y’all need to just move to a cloud platform…
Removed admin access for all developers without warning and without a means for us to install software. We got access back in the form of a secondary admin account a few days later, it was just annoying until then.
I had the same problem once. Every time I needed to be an admin, I had to send an email to an outsourced guy in another country, and wait one hour for an answer with a temporary password.
With WSL and Linux, I needed to be admin 3 or 4 times per day. I CCed my boss for every request. When he saw that I was waiting and doing nothing for 4 hours every day, he sent them an angry email and I got my admin account back.
The stupid restriction was meant for managers and sales people who didn’t need an admin account. It was annoying for developers.
I worked at a big name health insurance company that did the same. You would have to give them an email, wait a week, then give them a call to get them to do anything. You could not install anything yourself, it was always a person that remote into your computer. After a month, I still didn’t have visual studio installed when they wanted me to work on some .Net. Then they installed the wrong version of Visual Studio. So the whole process had to be restarted.
I got a new job within 3 months and just noped out.
Local admin of your interactive account is just. Ad though.
Locked down our USB ports. We work on network equipment that we have to use the USB port to log in to locally.
One place I worked at did this but had bluetooth on no issues. People brought all kinds of things to the office.
Admin access needed to change the clock, which was wrong. Missed a train because of that.
They set zscaler so that if I don’t access an internal service for an unknown number of months, it means I don’t need it “for my daily work”, so they block it. If I want to access it again I need to open a ticket. There is no way to know what they closed and when they’ll close something.
In 1 months since this policy is active, I already have opened tickets to access test databases, k8s control plane, quality control dashboards, tableau server…
I really cannot comment how wrong it is.
Zscaler is one of the worst products I’ve had the displeasure to interact with. They implemented it at my old job and it said that my home Internet connection was insecure to connect to the VPN. Cyber Sec guys couldn’t figure out the issue because the logs were SO helpful.
Took working with their support to find that it has somehow identified my nonstandard address spacing on my LAN to be insecure for some reason.
I kept my work laptop on a separate vlan for obvious reasons.
Pretty sure it’s some misapplied heuristics for previously identified bad clients, but that should only trigger an alert (with details!) in most cases and not block you if it’s not also paired with any known malicious activity
I’m going off memory from early 2021. But it was my private IP on the laptop using a Class B private address according to their support team. I was flabbergasted. Maybe they just expected every remote worker to use Class C or something. Who knows?
