"Have you checked your firewall lately?" the networking professor asked me first thing in the morning.
"Um, no? Why?"
"Well, you're a Mac person and a recent update changed the firewall to accept all connections, I've heard."
WTF?? I was heading for lab, so I first got the peeps settled in and weaving away on the Impossible Basket of the week. I popped open the firewall, and there it was:
Allow all incoming connections - Yes
Hmm. Maybe that's what Mr. I'm-Not-Paying-Attention was doing. Indeed, when I collared the colleague over lunch, he admitted that he had overheard my bunch in his lab, discussing trying a port scan on my computer to see if they could break into it while I'm holding lecture. But they decided they were scared, 'cause I'm the dean and might harm their career if I found them doing this.
Harm? Can you spell "out on your ear"? We caught one smart-ass recently forging an email from a teacher giving him permission to attend his class after the end of registration. He's looking at a lawsuit for forgery. Our lawyer sucks at things having to do with universities, but really likes things like this.
So just a word here from the dean: y'all go check your firewalls and share folders. Now. And if you belong to the Facebook Fanatics (what's with all the "like" stuff showing up every now and then here?): have a look at Firesheep. They can capture your Facebook connection and post as you.
Isn't the Internet wonderful?
Dean Suzy
Other than that you will not fire the entire incompetent IT department, can I work for you? Please, pretty please?
ReplyDeleteCan I at least watch you drop some punk on his ass?
You should set up a web cam and charge $3.99 a month. Your retirement plan will be replenished in no time.
I was involved in a similar situation with one exception - I AM an IT instructor. We had just spent a few lectures covering the ethics of accessing systems for which you had no rights to access. The common theme was "you don't do something merely because you can". So, I decided to set up a controlled experiment to see if what was discussed at length actually sunk in to some of the wannabe fuckstick "hackers". I set up a sort of honeypot - a PC with open shares, with folder names such as "private", "Joe's Test Bank", etc. I even had a file that said "stay out - private" or some shit like that. I set up IP/computer name logging so I could see who accessed the system, and what they accessed. I also set up a web cam and microphone in the lab where students were working (a different course/instructor) so I could match computer names/IPs with students. Then I waited while I was teaching another class in my secondary lab across the hall.
ReplyDeleteI had to wait about 5 minutes before the asshats began their "attack". I listened and watched. About 1/2 of the students had no qualms about invading my computer, and had all sorts of derogatory comments about how stupid I was. A couple of them even printed out copies of a "bogus" final. A few more were a bit concerned, but fell in with the asshats. About a 1/4 of the class tried to reason with the others, almost restating my lectures verbatim. Most of the "good guys" also realized that they were being set up-they KNEW that I would never have such poor security, and tried to tell the dipshits. But, dipshits being dipshits, told the others to STFU. The good guys actually sent someone across the hall to me to tell me that I had an a security hole, and told me what it was. I thanked them, told them I knew it, then went across the hall.
I entered the room (with the other instructor's permission, who had an idea of what I was doing), and reamed the bad guys a new asshole. Of course, they denied it, until I showed them the evidence. The guy who printed out the test tried oh so hard to hide it...
I reported them to the Dean for ethics/hacking violations. All got letters/notes in their "permanent records", and one was expelled, since he was investigated for other violations (guess who - Mr. Test Printer). I probably could have pushed for harsher penalties, but that was enough for me, since I also stated that none of the idiots responsible would ever see a recommendation letter from me, and probably their other IT instructors - we are a small department, and we share information.