Feeds

BOFH: Remote access malarkey

Don't mark yourself as a target

  • alert
  • submit to reddit

Top three mobile application threats

Episode 31

"...And so you can just log in to my machine and look at it whenever you like?" our user asks indignantly.

"Uh-huh," the PFY says, fixing the user's printer settings while he's talking.

"And I don't have to give you permission or anything?"

"I'd have assumed that was implied by ringing the helpdesk?" the PFY says.

"Yes but surely you'd ring me beforehand - as a courtesy, if nothing else!?"

"No, the courtesy bit is me looking up a helpdesk call on a Friday afternoon after three lunchtime pints," the PFY says.

"I... is this the way you normally solve problems?"

"Sometimes," the PFY admits. "Although other times I find that if I leave the call open long enough the user'll go back into their printer settings and remember they stuffed around with the local printer/network printer combo and put it right themselves. But like I say - I'm feeling courteous this afternoon."

"I'd like to speak with your Supervisor!"

"Absolutely," the PFY says (courteously). "Putting you through now!"

>RING<

It never ceases to amaze me how every now and then an otherwise sane user suddenly starts believing that they, their email, and their personal files and instant messages would become so interesting for an administrator that they would forgo the worlds of computer games, movie torrents, porn and piracy simply to peruse their desktop in the hopes of finding something which could only be - let's face it - disappointing.

I mean when the world's your oyster you don't generally settle for fish paste...

"Hello there," I say, handsfree enabled. "IT... Oh... Management, I guess." (For I too have had three pints at lunchtime, plus a couple of extremely generous shots of The Macallan.)

"I was just talking to your systems person and he was most unhelpful."

"Really?" I say. "On a Friday afternoon - after three pints? I'm surprised he answered the phone at all."

"Look, this is serious. He was logged into my machine without my permission."

"Technically," I say, as the Macallan is known to fire up the pedant in me, "that would be the company's machine, however as we're all friends here we should look into it. When exactly did he log into it?"

"Just now."

"He can't have - he's been here the past hour."

"He did it over the network."

"Oh right, remote administration - you must have logged a helpdesk call then?"

"Yes - but surely you'd call me before just rifling through my desktop!"

"No not really," I say. "But give us a minute and I'll just check the job. >clickety< . . . >Pregnant pause while I check my eBay bids, order some more coffee for the espresso machine and fire up Bioshock for some afternoon boredom relief< Yes, a printer config problem. It's been... resolved by the look of it. So no harm done with the remote access."

"But then he could do it at any time!"

"True - but it's relatively simple to stop this from happening if it worries you," I say.

"How?"

"There's two ways that we commonly recommend - one's called shutdown and the other one's not logging a call with the helpdesk. But to be completely honest, shutdown's your best option."

"Why's that then?" he asks, suspiciously.

"Look," I sigh. "It's a Friday afternoon and I can see where this is going, so why don't we just cut to the chase? We get calls from concerned users like yourself upon occasion and I'll tell you what I tell them: When it comes to an administrator's interest in your affairs you're competing against the rich tapestry of the internet - and losing. The only thing that can possibly be done to engage our interest in you is for you to complain about your lack of privacy - because then we start wondering what the hell it is you have that you don't want us to see. And before you know it the administrator concerned has passed you on to someone such as myself whose sole purpose is to keep you talking long enough to fire off a backup of the contents of your hard drive."

>Scrabble<

"Oh it's too late now," I say. "By now my assistant will poring over the contents of your 'My documents' folder, skimming your instant message logs, ferreting through your browser cache and ultimately nosing through your email - which he didn't even need access to your desktop to do in the first place."

>Slam<

>Ring<

"Hello?" I say.

"What's this I hear about you rifling through someone's desktop machine?" the Boss snaps.

"Oh that!" I say. "It was just a remote administration thing - a user had stuffed up their printer settings and my assistant had connected remotely to fix it."

"Without talking to him about it?"

"No - we were just adjusting the settings - same as we did for your machine last week."

"You logged into my machine last week? You didn't ask me!"

"Technically it's not your machine," I say nodding knowingly at the PFY. "However as we're all friends here we should..."

High performance access to file storage

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Kingston DataTraveler MicroDuo: Turn your phone into a 72GB beast
USB-usiness in the front, micro-USB party in the back
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Inside the Hekaton: SQL Server 2014's database engine deconstructed
Nadella's database sqares the circle of cheap memory vs speed
BOFH: Oh DO tell us what you think. *CLICK*
$%%&amp Oh dear, we've been cut *CLICK* Well hello *CLICK* You're breaking up...
Just what could be inside Dropbox's new 'Home For Life'?
Biz apps, messaging, photos, email, more storage – sorry, did you think there would be cake?
IT bods: How long does it take YOU to train up on new tech?
I'll leave my arrays to do the hard work, if you don't mind
Amazon reveals its Google-killing 'R3' server instances
A mega-memory instance that never forgets
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.