TLDR: Small family owned finance business woes as the “you-do-everything-now” network/sysadmin intern

Friday my boss, who is currently traveling in Vegas (hmmm), sends me an email asking me to punch a hole in our firewall so he can access our locally hosted Jira server that we use for time logging/task management.

Because of our lack of proper documentation I have to refer to my half completed network map and rely on some acrobatic cable tracing to discover that we use a SonicWall physical firewall. I then realize asking around that I don’t have access to the management interface because no one knows the password.

Using some lucky guesses and documentation I discover on a file share from four years ago, I piece together the username and password to log in only to discover that the enterprise support subscription is two years expired. The pretty and useful interface that I’m expecting has been deactivated and instead of a nice overview of firewall access rules the only thing I can access is an arcane table of network rules using abbreviated notation and five year old custom made objects representing our internal network.

An hour and a half later I have a solid understanding of SonicWallOS, its firewall rules, and our particular configuration and I’m able to direct external traffic from the right port to our internal server running Jira. I even configure a HIDS on the Jira server and throw up an iptables firewall quickly since the machine is now connected to the outside world.

After seeing how many access rules our firewall has, as a precaution I decide to run a quick nmap scan to see what our network looks like to an attacker.

The output doesn’t stop scrolling for a minute. Final count we have 38 ports wide open with a GOLDMINE of information from every web, DNS, and public server flooding my terminal. Our local domain controller has ports directly connected to the Internet. Several un-updated Windows Server 2008 machines with confidential business information have IIS 7.0 running connected directly to the internet (versions with confirmed remote code execution vulnerabilities). I’ve got my work cut out for me.

It looks like someone’s idea of allowing remote access to the office at some point was “port forward everything” instead of setting up a VPN. I learn the owners close personal friend did all their IT until 4 years ago, when the professional documentation stops. He retired and they’ve only invested in low cost students (like me!) to fill the gap. Some kid who port forwarded his home router for League at some point was like “let’s do that with production servers!”

At this point my boss emails me to see what I’ve done. I spit him back a link to use our Jira server. He sends me a reply “You haven’t logged any work in Jira, what have you been doing?”

Facepalm.

!dev rant about social media 🤡 s like this one.

I hate when people seek for a reason to bitch on social media. This tweet for example.

1) I went to a small high school (small compared to a lot) and we still had a personal management class and this was covered.
2) Who the fuck uses checks still.
3) It's addition and subtraction, not brain surgery.
4) if you actually cared, Google it. There's a shit ton of information on balancing a check book out there.
5) You're probably in debt due to a shitty lifestyle combined with terrible money management, but keep playing victim. It's never your fault.

But of course she doesn't care. It's another case of someone wanting a reason to bitch and moan on social media. Get a hobby you clown.

Oh wow, so many memorable co-workers, though typically not in a positive way. I guess the most memorable was this project manager who got his job solely through nepotism. He was a fucking moron, putting it lightly. He would rattle off buzzwords and jargon that he had randomly picked up in a completely nonsensical way, which made him sound even more ridiculous. He didn't seem to notice our blank stares.

Anyway, since he loved to show everyone just how awesome he was, he had to have the latest and greatest laptop. He had some top-of-the-line model which cost an insane amount of cash back in the day, but of course he got bored of it when something better came out six months later. So he decided to sell his old laptop.

Now, this was his personal laptop he was selling but we were about three months away from launching a top-secret project which had a seven figure budget and a lot riding on it. So what did this absolute goose do? He sold his laptop unformatted with a metric shit ton of confidential files and documents on it. As fate would have it... he sold it to someone who just so happened to work for a competing company.

Cut to about two and a half months later, around two weeks before the launch of this massive project, our competition comes out with something incredibly similar and beat us to market. Aghast, senior management then found out that they had obtained a treasure trove of confidential information from this numpty's laptop, handed to them on a silver platter.

The following Monday, with a sombre mood in the office, this guy cheerfully comes in through the door and is immediately yanked into the boardroom by management. What followed was around thirty minutes of brutal, relentless, non-stop shouting, table- banging and obscenities. When it finally stopped, the door quietly opened, this guy walks out as white as a sheet, turns towards the exit and left the building.

We never saw him again.

Oh boy I got a few. I could tell you stories about very stupid xss vectors like tracking IDs that get properly sanitized when they come through the url but as soon as you go to the next page and the backend returns them they are trusted and put into the Dom unsanitized or an error page for a wrong token / transaction id combo that accidentally set the same auth cookie as the valid combination but I guess the title "dumbest" would go to another one, if only for the management response to it.

Without being to precise let's just say our website contained a service to send a formally correct email or fax to your provider to cancel your mobile contract, nice thing really. You put in all your personal information and then you could hit a button to send your cancelation and get redirected to a page that also allows you to download a pdf with the sent cancelation (including all your personal data). That page was secured by a cancelation id and a (totally save) 16 characters long security token.

Now, a few months ago I tested a small change on the cancelation service and noticed a rather interesting detail : The same email always results in the same (totally save) security token...
So I tried again and sure, the token seemed to be generated from the email, well so much about "totally save". Of course this was a minor problem since our cancelation ids were strong uuids that would be incredibly hard to brute force, right? Well of course they weren't, they counted up. So at that point you could take an email, send a cancelation, get the token and just count down from your id until you hit a 200 and download the pdf with all that juicy user data, nice.

Well, of course now I raised a critical ticket and the issue was fixed as soon as possible, right?
Of course not. Well I raised the ticket, I made it critical and personally went to the ceo to make sure its prioritized. The next day I get an email from jira that the issue now was minor because "its in the code since 2017 and wasn't exploited".

Well, long story short, I argued a lot and in the end it came to the point where I, as QA, wrote a fix to create a proper token because management just "didn't see the need" to secure such a "hard to find problem". Well, before that I sent them a zip file containing 84 pdfs I scrapped in a night and the message that they can be happy I signed an NDA.

PayPal = GayPal

PHASE 1

1. I create my personal gaypal account
2. I use my real data
3. Try to link my debit card, denied
4. Call gaypal support via international phone number
5. Guy asks me for my full name email phone number debit card street address, all confirmed and verified
6. Finally i can add my card

PAHSE 2

7. Now the account is temporarily limited and in review, for absolutely no fucking reason, need 3 days for it to be done

8. Five (5) days later still limited i cant deposit or withdraw money

9. Call gaypal support again via phone number, burn my phone bill

10. Guy tells me to wait for 3 days and he'll resolve it

PHASE 3

11. One (1) day later (and not 3), i wake up from a yellow account to a red account where my account is now permanently limited WITHOUT ANY FUCKING REASON WHY

12. They blocked my card and forever blocked my name from using gaypal

13. I contact them on twitter to tell me what their fucking problem is and they tell me this:

"Hi there, thank you for being so patient while your conversation was being escalated to me. I understand from your messages that your PayPal account has been permanently limited, I appreciate this can be concerning. Sometimes PayPal makes the decision to end a relationship with a customer if we believe there has been a violation of our terms of service or if a customer's business or business practices pose a high risk to PayPal or the PayPal community. This type of decision isn’t something we do lightly, and I can assure you that we fully review all factors of an account before making this type of decision. While I appreciate that you don’t agree with the outcome, this is something that would have been fully reviewed and we would be unable to change it. If there are funds on your balance, they can be held for up to 180 days from when you received your most recent payment. This is to reduce the impact of any disputes or chargebacks being filed against you. After this point, you will then receive an email with more information on accessing your balance.

As you can appreciate, I would not be able to share the exact reason why the account was permanently limited as I cannot provide any account-specific information on Twitter for security reasons. Also, we may not be able to share additional information with you as our reviews are based on confidential criteria, and we have no obligation to disclose the details of our risk management or security procedures or our confidential information to you. As you can no longer use our services, I recommend researching payment processors you can use going forward. I aplogise for any inconvenience caused."

PHASE 4

14. I see they basically replied in context of "fuck you and suck my fucking dick". So I reply aggressively:

"That seems like you're a fraudulent company robbing people. The fact that you can't tell me what exactly have i broken for your terms of service, means you're hiding something, because i haven't broken anything. I have NOT violated your terms of service. Prove to me that i have. Your words and confidentially means nothing. CALL MY NUMBER and talk to me privately and explain to me what the problem is. Go 1 on 1 with the account owner and lets talk

You have no right to block my financial statements for 180 days WITHOUT A REASON. I am NOT going to wait 6 months to get my money out

Had i done something wrong or violated your terms of service, I would admit it and not bother trying to get my account back. But knowing i did nothing wrong AND STILL GOT BLOCKED, i will not back down without getting my money out or a reason what the problem is.

Do you understand?"

15. They reply:

"I regret that we're unable to provide you with the answer you're looking for with this. As no additional information can be provided on this topic, any additional questions pertaining to this issue would yield no further responses. Thank you for your time, and I wish you the best of luck in utilizing another payment processor."

16. ARE YOU FUCKING KIDDING ME? I AM BLOCKED FOR NO FUCKING REASON, THEY TOOK MY MONEY AND DONT GIVE A FUCK TO ANSWER WHY THEY DID THAT?

HOW CAN I FILE A LAWSUIT AGAINST THIS FRAUDULENT CORPORATION?

Starting the day with Management complaining about budget and how R&D spends a lot. I start talking about the form to get a machine to a developer, that requires detailed information about the specs, proper justification, provide price comparison, fields of text which I know their departments will not check or fully comprehend BUT administration type departments always get the latest MacBook when their work literally involves little more than read emails, PDFs, write word documents and not high demanding software tools. R&D colleague suggests that a Raspberry pi would suffice for what administration personal needs out of a PC.
Management didn't comment.

I AM SO ANGRY! Today my job fired me for the stupidest reason!! A while back I lost my job a (non-important) client for having an "overactive temper" so my boss made me begin taking VRTAM (or virtual reality therapy for Anger Management). Well I attended the first couple things but decided to stop because they were definitely stealing my information. I don't know what sketchy website they found for that but as a dev I can tell when they are taking my personal information. Also there's no way it works I attended a couple sessions and nothing helped because I DONT HAVE ANGER ISSUES!!! Anyway my job found out I had been skipping them and when they confronted me they avoided my concerns and just fired me... Haven't told my wife yet, she's going to be so mad.

I want to know how a certain type of software is called.

I once saw a talk where someone tracked his personal life for a year or so. This means photos are tomestamped and have a geolocation. Emails and phone calls are timestamped as well ...

On a timeline software he could then see exactly where he was and what he did on a specific date like 2 years ago...

There's a name for software that tracks all kind of data about your personal life. I think it starts with m.

Three Layers of Security
As InfoWorld notes, all smartphones have three basic
elements of security. Your first major task as a mobile
user is to become aware of these layers and enable them
in your devices:
1. Device Protection: Allowing remote data "wiping" if your
device is ever lost or stolen.
2. Data Protection: Preventing corporate data from being
transferred to personal apps running on the same device
or personal network
3. App-Management Security: Protecting your in-app
information from becoming compromised.