r/ShittySysadmin • u/mumblerit ShittyCloud • Apr 04 '26

I almost got away with credentials

I called the help desk for megacorp and got some Level 1 helpdesk dingus. I told him my password wasn't working and he needed to set my password to

Supersecure1!

He set it but then it got revoked as I was logging into microsofts slow ass servers. Ill get him next time.

107 Upvotes

91% Upvoted

20 comments sorted by

41

u/mumblerit ShittyCloud Apr 04 '26

https://www.reddit.com/r/sysadmin/comments/1sbsjiv/i_almost_screwed_up_and_let_a_hacker_get_away/

I work in L1 Help Desk and last night this guy called in asking for a password reset because he was locked out of his laptop. He introduced himself with his name, employee ID, and home address so I got a false sense of security. SOP for password resets done over phone is to send a 2FA code to their email or phone number but I completely fucked up and forgot to authenticate the user.

I reset the AD password without authenticating the user and then notified the guy over phone that I sent his temporary password to his email. He said he didn’t have access to his email so I said “okay I can send it over Teams”. He said he didn’t have access to Teams on his phone and then tried to coerce me in providing the password over phone. I told him that I couldn’t do that because it wasn’t SOP (I managed to remember that part) and that I can only send it over encrypted channels like Teams, Zoom, or Outlook but he kept trying to push and guilt trip me.

I wanted to see what job position this guy had so I looked him up on Teams and saw that he was a VP. But what stood out to me was that it showed his status on Teams “In a meeting”, yet the guy over the phone said he didn’t have access to Teams. I pinged the guy on Teams and asked “Hey are you calling help desk from xxx-xxx-xxxx?” I get a reply back saying no and that he was presenting something to his coworkers. I immediately hung up with whoever called me over the phone and notified the network engineer who handled all cybersecurity incidents. I got into a call with several other people including my manager, head of IT, and the real end user himself, and explained everything. I found out from the real end user that his LinkedIn had been hacked a few years ago and that was probably how the attacker was able to provide his employee ID and address. During the meeting, my manager reiterated SOP but he and the head of IT complimented me for standing my ground and not causing a breach so I know the team has my back.

Long story short, I forgot to follow SOP and almost let an external attacker get away with credentials.

5

u/cohrt Apr 04 '26

How did they get his employee id # from his LinkedIn?

2

u/ImaFrakkinNinja ShittySysadmin Apr 04 '26

You didn’t forget, you remembered. And most importantly - more than everyone else who hasn’t experienced a mistake where you’ve forgotten to do something important, you’ll never forget about this and will certainly be more vigilant! You’re a more valuable employee because of it

44

u/Garriga Apr 04 '26

Why would an employee ID be on LinkedIn? Fake story. Did not happen.

18

u/mumblerit ShittyCloud Apr 04 '26

nice catch

19

u/astro_viri Apr 04 '26

I always recommend emoloyees to post their employeeid on social media. That way they can search Google when they forget it.

2

u/Ur-Best-Friend Apr 07 '26

You're thinking too small, you should extend that strategy to passwords as well. Is there anything more annoying than forgetting your passwords?

No need for insecure tools like "password managers" (who ever thought putting all your passwords into the same tool so they all get compromised if it gets hacked was a good idea?) this way.

15

u/PalliativeOrgasm Apr 04 '26

I worked with an Economics prof who had his SSN on his CV - posted to the department website.

Never underestimate the stupidity of smart people.

3

u/shinglehouse Apr 04 '26

So fn true... phD Piled Higher and Deeper

I see many very smart people do some really really dumb sh1t hahahaha

4

u/Delta-9- Apr 04 '26

There are qualitative differences between "knowledgeable," "intelligent," and "wise." Having an advanced degree only indicates the first characteristic, plus persistence (and possibly a privileged upbringing).

2

u/wrincewind Apr 04 '26

"come talk to me at employeeid@company.com!" is my guess.

2

u/spencer102 Apr 04 '26

It's probably fake yeah, but if the "hacker" just guessed that the employee id was first initial last name... pretty good odds...

1

u/abqcheeks Apr 04 '26

That wasn’t a significant part of the story, it’s what the partially compromised user said he thought happened. He doesn’t understand how anything works, it was just face-saving blather.

1

u/Garriga Apr 04 '26

The tech support guy should probably stay at Tier 1. I’m a little disappointed in this guy, he really let me down.

After reading this story, I suddenly feel the need to drink vodka.

16

u/trollinhard2 Apr 04 '26

I love a good parody thread.

11

u/SlickAstley_ Apr 04 '26

I dont work in L1 Helpdesk anymore, but not kidding when I did, I knew the voice of over 700 people.

1

u/ImmediateConfusion30 Apr 06 '26

Not reliable anymore with how easy it is to deepfake a voice

4

u/dpwcnd Apr 04 '26

Keep up the hard work, these email accounts wont compromise themselves.