“Programmer Bob”: Latter-Day Tom Sawyer or Massive Security Risk? - IEEE

Hey guys, do you think this is #bullshit ? Let's talk about it in class! Red flags everywhere. #tauroscatics #nmc101

At first I thought this was one of those IT urban legends, like the “disappearing warehouse ” story, but according to Verizon's IT security risk team, it's all true. A few weeks ago, Verizon wrote on its IT security blog that it was asked to perform a security assessment for a U.S.-based client after the latter was “startled” to discover a live “open and active VPN [virtual private network] connection from Shenyang, China!” What made the client thoroughly worried about this surprisingly open communication port to China was first that it was a U.S. critical infrastructure company; second, it had two-factor authentication for its VPN connection, which had obviously been breached and, third, “the developer [given the pseudonym “Bob”] whose credentials were being used was sitting at his desk in the office.” In other words, “the VPN logs showed [the developer] logged in from Ch...

Full article: http://spectrum.ieee.org/riskfactor/computing/it/programm...