Dude your getting a Dell

[Andrew Plato <intrepid_es -at- yahoo -dot- com>]

Last week I get a frantic call from this company. Their PCs have been
hacked. Its a crisis situation. They need some security consultants to
figure out what happened. Anitian security response, at your service. 

So, me and one of my techs slog over to their offices way out in BFE. We
sit down with their IT manager, a tech writer and some other sys admin
guy. Blah blah blah...basically, all of their internal documentation has
been corrupted. Nobody can access it. They think it is a Trojan or a
virus. The tech writer had a great theory, he thinks all new PCs come with
some spyware placed there by the manufacturer to stop you from committing
terrorist acts. 

Oh brother. This is fun.  

So we slap a sniffer on the wire and start looking around. Pull the logs
off the servers, and start probing the firewall.

Their firewall is a joke and their servers look like swiss cheese. So I
send the tech out to look at the ACLs on the servers while I scan through
the last known location of the documents. I can see them. They're a bunch
of PDF files on one of the servers. They look fine. 

IT MANAGER: "How did you open them?" 

ANDREW: "I double-clicked on them."

IT MANAGER: "Yeah, when we do that, we get an error. And they worked fine
last week on the old machines." 

ANDREW: "You just get new PCs?" 

He nods. "Whole company got 'em. We replaced all the workstations and
laptops. Our lease on the old ones was up so we just got all new ones." 

ANDREW: "Did you install Acrobat on those PCs?"

IT GUY: "What's Acrobat?"

I look over to my tech who is trying to pull the logs off this horrible
server. I motion to him to stop what he is doing. I walk over to the tech
writer. 

ANDREW: "Do you have Acrobat on your PC?" 

TECH WRITER: "What's Acrobat?"

ANDREW: "How do you generate the docs?" 

TECH WRITER: "Oh, I don't generate them. Johnny Whatever does back in San
Jose. I just edit and review them and put them on the web site."

ANDREW: "Riiiiight..."

So I sit down at the tech writer's desk. Download Acrobat off the Adobe
site. Install it and open the docs. 

"Oh my God, you got it to work!" 

Needless to say, that was the most expensive technical support call they
have ever had (we charge $195.00 per hour for incident response and we
we're there about 5 hours.) 

I felt sorry for them so I only charged them 1/2. But, I told them to fix
that firewall so they're probably going to buy a firewall and IDS from us.


Should of bought a Dell. 

Andrew Plato 

__________________________________________________
Do You Yahoo!?
Send FREE video emails in Yahoo! Mail!
http://promo.yahoo.com/videomail/

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Attention ForeHelp and Doc-to-Help Users! Upgrade your existing product to 
RoboHelp for FREE, through January 15th. RoboHelp can import your existing 
Help projects! Learn how else RoboHelp can benefit you. www.ehelp.com/techwr

---
You are currently subscribed to techwr-l as: archive -at- raycomm -dot- com
To unsubscribe send a blank email to leave-techwr-l-obscured -at- lists -dot- raycomm -dot- com
Send administrative questions to ejray -at- raycomm -dot- com -dot-  Visit 
http://www.raycomm.com/techwhirl/ for more resources and info.