Blackhat Admin?

I've heard a lot of bar stories from drunk admin about doing dodgy stuff. One of our pain in the ass clients was arrested for child porn, 6 hours after a drunk admin was taking credit. First for tipping the cops to what a dodger fuck the customer was and then as he got more wasted, for planting the porn and setting it all up. I know we all fantasised about something bad happening to that customer, he was a nightmare. But nobody framed the asshole. Hell nobody ever got around to doing the paperwork to tip 3rd party vendors off that he was pirating software because we were worried that we'd be implicated for not acting sooner. Nobody went and downloaded a bunch of kiddy porn to set him up. It was just a drunk wanting to sound like he was king shit on turd mountain.

But I've seen porn servers set up on the print network to hide traffic. I've seen VP of a major tech company use the server farm to mass pirat and stamp porn DVDs for illegal resale on company time. I once drunkenly explained how to use the pstoolkit and remote execution rights to fuck with coworkers, including creating proxy log entries that looked like they had been looking at porn from work using non interactive IE Windows, and came in to work the next day to find the script I'd described, with the file name I'd jokingly used and everything in my inbox and widely deployed through the tech support workstations for people to use.

Sometimes maliciously and sometimes just by not thinking. I once asked a former coworker on MSN messenger if he had a server that matched our respective area of expertise that I could use to test a remote execution exploit. He gave me an IP and voila, it worked and I gained execution rights on his server. After we played with the exploit a bit I closed it out and asked if he was still with the accounting firm he'd gone too when he left the business I knew him from. He said no, he was with a federal law enforcement agency with a three letter acronym that everyone knows. Fucking asshole didn't think to share that detail when he gave me the IP. Fortunately it was pre sept 11 and a test server outside of their secured operations - so I didn't find out how scary jail is for nerds.

If you look up Distribute.it - they were an Australian web hosting company that was hacked into bankruptcy when a huge chunk of customer data and backups was lost. The story that went around Australian we hosting was that they were doing disk to disk backup from their VMware platform to a San. A hacker, suspected to be a disgruntled former staffer, got access to the San cli admin interfaces and dropped prod and backup from there.

In terms of specific story? I'd suspect a kernel of truth and some drunk bullshit. Maybe he did make some money from re-routing ad requests to a dodgy provider. But no way he made any decent money out of it. Certainly not any time in the last ten years.

/r/sysadmin Thread