Attack of the Trojan Printers 144
snydeq writes "Security professionals are tapping Trojan horse access points cloaked in printers and other office equipment to infiltrate clients who want their defenses tested, InfoWorld reports. Attackers dressed in IT supplier uniforms drop off printers to a company for a test-drive. Once the device is connected to the network, the penetration testers have a platform behind any perimeter defenses from which to attack. 'You can put your box inside a printer tray and glue it shut, and who will notice if there are one or two or three power cables coming out?' one security researcher says of the method. A variant of the attack, presented by Errata Security at the Defcon hacking convention, uses an attack-tool-laden iPhone mailed to a target company to get inside the firm's network defenses."
tried that with a Flip cam (Score:2)
an attractive USB device could host something undesirable. Smart clients won't touch them.
Re: (Score:2, Troll)
Wow where did you find "Smart Clients"?
The average person will pick up a USB pen drive from the parking lot and plug it into there PC or Laptop. Heck, I bed 99% would run a program on it called "Owner_Information.exe" To see who to return it to.
I bet good 50% would run a program called "Run_Me.exe" lol
In all honesty most Technical people over think most hacks. It is like watching a person try to pick the lock on a door when the window next to the door is open.
Re: (Score:3)
The average person will pick up a USB pen drive from the parking lot and plug it into there PC or Laptop.
I did that last month.
I run Linux though, so I'm not really worried about the things most people worry about. All that was on it was an exceptionally boring PowerPoint file which I deleted before giving the stick to my wife (who uses a Macbook)
Re: (Score:3, Funny)
before giving the stick to my wife
Pics or it didn't happen.
Re: (Score:2)
I didn't understand your response until I expanded it and read the quote. Well done.
My wife has already forbidden sexy time pics though...sorry.
Re: (Score:2)
Just pointing out that not every system can be easily affected with a memory stick. Mine is a windows free house
Did you really have to call me a smug retard, or are you just an anonymous coward...
Oh...so you are.
#1 problem with Mac is the user (Score:2)
If you want it to go undetected for a longer period of time, then actually include some lame ass strip poker program on the drive. If you make one for Windows, one for Mac and one for Linux. You're nearly guaranteed that it will be installed.
The difference is, Windows users are paranoid that everything is dangerous. So there's at least a 20% chance that a
Re: (Score:2)
- Dan.
Re: (Score:2)
Actually, that's exactly how I would try to find out who the owner of the device was. I would expect to find myself an office document or other files that would let me get a name.
Re: (Score:2)
Re: (Score:2)
USB host controller drivers are generally fairly stupid things. Unlike more "intelligent" architectures, USB is generally quite a bit simpler. If you're making a top level USB controller for Windows, it's quite likely that you've implemented the mini-host driver for the controller since pretty much no other method works anymore without reimplementing the entire USB stack.
A USB device actually doesn't initiate DMA transfers but instead, after configuring a destination for it, an app can
Re: (Score:2, Funny)
Good luck trying to mail someone a printer right now :-)
Re:tried that with a Flip cam (Score:5, Insightful)
Printer is indeed a better choice.
Some printers can have a full attack kit loaded and have WiFi. While most printers are yet to be hacked, the possibility is there. The bigger ones have a fully blown OS of some description doing the management functionality. Some of it is also hopelessly out of date securitywise. I have seen stuff like Win2000 being used on the print centers by one well known big company. Rooting that is trivial.
The ones that cannot be routed can still have a MIM put in between their built-in network functionality and the customer network. If done properly it will _NOT_ have any "cables sticking out" either. A microcontroller with two Ethernets which bridges between the printer original Ether and a fake one sticking out can be put in something the size of an match box nowdays. With most IT depts putting indiscriminately power over ethernet nobody will notice if it is powered from the net. And so on. There are lots of variations on this theme and having "more than one cable sticking out" actually means a very lame job on the side of whoever did it.
Re: (Score:2)
Or to paraphrase a certain Pixar character, once you're plugged into the switch, all sorts of culinary experiences open up.
Re: (Score:2)
2000 does have features that would let one lock them down pretty well; as to whether this is feasible with a print server, I don't want to know.
ask Oce - they use win2k server on dell power edge towers as the controller in the printers that we have..
the Tech's have zero maintenance schedule for them and don't have access to configure or change them.. i block access to them except for the single VM that's allowed to talk to it.
That old saying applies (Score:5, Funny)
Re: (Score:2)
Here's what I don't get. An extra power cable? If you're inside the printer anyway, why not just tap its power supply. It's not like the printer is right at the edge of what its power supply can put out, and if it is, you could always build a bigger power supply. Likewise, tap the printer's Ethernet connection---slice the traces to the printer guts itself, and embed a small passive Ethernet hub that provides a connection to both to the sliced traces on the board and to your sniffer. Done, and done. Un
Re: (Score:2)
We're talking about networked printers, they are connected directly to mains, not to an external power supply. You just tap the mains power from inside the printer. If you can't do this and make it look factory you're probably not even interested in doing it.
Re: (Score:2)
Way too hard. Tap the +12V or +5V output of the power supply and DC-DC it to whatever voltages you need. Then you don't have to find room for another full size power supply inside the machine.
Re: (Score:2)
You don't need a full-size power supply anyway, you use a tiny switching supply. They cost more but not dramatically so. This gets you out of situations where you might overload some part of the power supply and cause a failure, thus bringing attention to the device.
Re: (Score:3)
Some custom firmware and all of a sudden you've turned this printer into an access point as well. No glued shut trays, no mysterious power cables, etc.
Re:That old saying applies (Score:4, Insightful)
The point is that your situation is unlike most, especially small businesses who will generally run on a "How much will i cost to do it right? OK, you get half that," budget.
Re: (Score:2)
Re: (Score:2)
port forward to the printer
You don't need to even do that. Generally you can wire multiple devices to the same switch port and it actually works. I got a personal shock about 15 years ago when I saw it temporarly done to work around an out of switch ports situation. Since then, I try it once in a while to see if it still works, its like the crossover cable trick, doesn't work 100% of the time, but doesn't need to. The carrier sense and collision detection functions still work even at 1Gbit, so the two adap
Re: (Score:3)
With cat6 I assume you are running GigE or better, which generally has auto MDI-X and may not even require a crossover. The problem is this crap often doesn't work as advertised, and disabling auto negotiation often forces the speed to 100Mbit, or worse (cause auto negotiation is required for GigE per the spec). I've seen adapters that expect the remote side of the port to send NLP/FLP sequences before they wake up. Get two adapters like that, and they won't talk.
Re: (Score:2)
disabled autonegotion, but now understand that on GigE links autonego will still take place.
Re: (Score:2)
Re: (Score:2)
You work for a firm that is run by people with a clue.
A lot of PHBs at SMBs just say "security has no ROI" and only worry about an edge firewall and antivirus products on the PCs as the main security bastions. Because one can romp freely through their internal network without setting off an IDS or getting the brains splattered by an IPS, these are the gold mines for blackhats, as usually the SMBs have a good sum of unprotected salable data, and a large pipe to use for DDoS abilities.
Re: (Score:2)
Switching traffic doesn't necessarily do you much good. Tools like hunt allow you to hijack active TCP streams relatively easily, and it's quite hard to do much about it.
Re: (Score:2)
Crunchy on the Outside, Chewy on the Inside (Score:5, Interesting)
Most corporate firewalls (at least the part that most users are working behind) stop stuff from coming in, but permit most traffic going out. And even if they do block most traffic going out, they almost always permit 80/tcp out, and while they might have some sort of nanny filter there, something that just goes out to a random address at port 80 and then sends encrypted data will likely get through.
Once this machine is on the network, it can connect to a server somewhere on the Internet, and then the bad guys can come back in through this connection and do whatever they want from the printer. The important intranet sites may indeed require Smart Cards (rare, but some may do this) but all the machines that people work on are often poorly maintained, and the intranet systems that require Smart Cards often have all sorts of vulnerabilities -- the machines they reside on aren't secured, the applications have the whole spectrum of website vulnerabilities, etc. Yes, the company could secure all this stuff, but it would take time and money, and they think "it's inside the firewall, it's safe" (and yes, they're wrong.)
Perhaps some companies are different, but I'd say most are like this. Some companies separate everything internally with firewalls, but most don't, or if they do, there's lots of stuff behind each of these internal firewalls, and anything behind the same firewall as the trojan horse would be vulnerable (and really, stuff on the other side of the firewall might be too, depending on how draconian it is.)
This may not work on the NSA (assuming they follow all their policies!) but I would guess that getting a printer set up like this installed on most company's networks, coupled with skilled crackers working through it (not just script kiddies, though they might have some success too), would be able to get at all sorts of stuff they weren't supposed to get to. If it's a software company, they could get the source for their work, perhaps add their own code (back doors!), etc.
Re: (Score:2)
First, as others have pointed out, that's an unusually secure network. Second, in the worst case, you can sniff everything that gets sent to the printer, write it to flash, firmware-timebomb the printer so that it fails after a couple of weeks, then recover the sniffer itself when they call you to come repair the printer. This assumes, of course, that you work for a company providing printers to the business. It's much harder to do that otherwise, but then again, it's much harder to get the printer in th
Physical access == pwnage (Score:4, Insightful)
Nothing really new here, other than perhaps people realizing that printers are a network entity (which they have been at least since the HP LaserJet cards). As for housing a blackhat-usable machine, that has been done for ages, as it isn't hard to just plug in a laptop or network powered biscuit PC and start firing up nmap.
How to protect about this? Cisco's core routers have plenty of tools to deal with rogue devices (MAC address locking per port, healthchecking, etc.) Wireless networks take some more doing, but can be just as well locked down.
Re:Physical access == pwnage (Score:5, Interesting)
How to protect about this? Cisco's core routers have plenty of tools to deal with rogue devices (MAC address locking per port, healthchecking, etc.) Wireless networks take some more doing, but can be just as well locked down.
Agreed -- we use 802.1x authentication on all of our switch pots, only domain computers are allowed on the network. We do MAC address bypass on specific ports for known network printers, etc, but they go on a limited access VLAN. No one outside of IT can receive a printer in the mail and just plug it in and have it on our network.
I thought all midsized and larger businesses used some sort of port control to control network access?
Small business are usually so lax in computer security that there are so many holes in their network making it unnecessary to send them a Trojan Printer to hack in. I've done work for a number of small businesses that use 40 bit WEP to "protect" their Wifi network -- and no amount of persuading from me will make them change it.
Re: (Score:2)
Well a lot of people fail to remember that the majority of the Ethernet switches being sold today only send packets to the specific port the endpoint is on, unless its a broadcase/multicast packet. This means that plugging joe random promiscuous mode adapter into a switch won't give you visibility to the whole network.
That said, unless the designer of the trojan is stupid there will only be a single mac address exported to the network by the printer. Sure, no one is going to just plug a random printer in, b
Re: (Score:3)
That's the definition of a switch. So I would hope that the majority of them do that.
Re: (Score:2)
Re: (Score:2)
Really, even when its a proprietary, or edge/wimax/etc type adapter? If it does then it must be getting enough false positives to cause you heartache... If someone is putting a wireless interface in a device for back-channel communications I would assume there are much better choices than a normal 802 wireless interface.
Re: (Score:2)
Re: (Score:2)
Well a lot of people fail to remember that the majority of the Ethernet switches being sold today only send packets to the specific port the endpoint is on, unless its a broadcase/multicast packet. This means that plugging joe random promiscuous mode adapter into a switch won't give you visibility to the whole network.
I'm not worried about someone snooping packets (well, I am, but that's not why I use 802.1x). I'm more worried about someone plugging into the corporate VLAN and having unfettered access to try to hack into all of my endpoints. While we do have antivirus and a pretty decent patching policy, I'm not really ready to declare that all of my hosts are immune to attack. Network access control is just one layer in my security and keeping non 802.1x authenticated devices off of my main corporate network is trivial
Re: (Score:2)
Network access control is just one layer in my security and keeping non 802.1x authenticated devices off of my main corporate network is trivial to implement and prevents someone from spoofing my printer's MAC address to give him full network access.
Locking the mac to a given switch port achieves the same functionality.
I mean really, what possible harm could someone do if all they can do is send/receive traffic to any port on any of my internal hosts?
My point is that unless your very careful the vlan probab
Re: (Score:2)
Locking the mac to a given switch port achieves the same functionality.
how does locking a MAC to a particular port prevent someone from spoofing that printer's MAC on his laptop and plugging into the same switch port to gain the same network access that the printer had?
My point is that unless your very careful the vlan probably isn't going to give you 100% protection in this regard. Vlan tagging tends to be more a "gentleman's agreement" type protocol. A device which talks MSTP could very well just change its vlan tagging.
I'm not aware of any mechanism to allow an endpoint to access another VLAN on an switch port set as an "access" port rather than a "trunk" port. I'm not using tagged VLANs for endpoints.
Re: (Score:2)
how does locking a MAC to a particular port prevent someone from spoofing that printer's MAC on his laptop and plugging into the same switch port to gain the same network access that the printer had?
It doesn't, but they way I understood it, you had the printers on the vlan because they didn't support 802.1x anyway.
I'm not aware of any mechanism to allow an endpoint to access another VLAN on an switch port set as an "access" port rather than a "trunk" port. I'm not using tagged VLANs for endpoints.
Your switc
Re: (Score:2)
It doesn't, but they way I understood it, you had the printers on the vlan because they didn't support 802.1x anyway.
I have the printers on their own VLAN because they don't support 802.1x, and I don't allow any non-802.1x devices on the corporate VLAN. Well, another reason is because IT doesn't maintain the printers, an outside company does. I have yet another VLAN for other miscellaneous non-802.1x devices (like building control systems).
Your switches are probably better than most (by definition, if you can run 802.1x), in many cases a device can negotiate "trunk" (aka another switch) status on any random port. Even on devices which can disable it for all but a specified set of ports, that oftentimes is an option that must be enabled.
They are just run of the mill Cisco switches -- call me a Cisco fan-boy, but I wouldn't implement a secure corporate network on anything else.
Plus vmware and other virtual adapter type applications cause real heartache in environments like yours (cause even a non switched endpoint can have multiple mac's and don't necessary support 802.1x).
Yes, VMWare can be a headache, but so far
Re: (Score:2)
Yah, the ones with dedicated "monitor" modes tend to be more robust. Course those generally are layer3, which also by itself tends to be more robust.
Re: (Score:2)
Wow, I used to have a career breaking past security measures like your. I hope that wasn't a complete list.
There are two major attack points and flaws in your description.
Re: (Score:3)
Yes, I have described all facets of my security in 2 sentences and it consists entirely of port access control on my switches. Oh, I forgot to include the admin passwords for the switches, they are all set to "RngZr". Come hack me, please.
Re: (Score:2)
I've done work for a number of small businesses that use 40 bit WEP to "protect" their Wifi network -- and no amount of persuading from me will make them change it.
Do they have old hardware only capable of WEP?
Re: (Score:2)
I thought this was pretty old news, too. I've stashed laptops, access points and even SFF desktops in desks, cabinets and above ceiling tiles, enabling all manner of access long after I had physical access to the facility.
It was generally legitimate (ie, I was network manager) subterfuge to do troubleshooting at remote facilities, but there was one place that was a "sister company" that I was required to support but wouldn't give me any remote access. Those people got the old laptop above the ceiling tile
Re: (Score:2)
Indeed the JetDirect stuff delivers several signed Java Applets so there's plenty of room to hide a trojan in there. But in most printers of any size there's more than enough room for a micro-hub and some kind of teeny embedded system (like a dockstar stripped out of the case.)
Re: (Score:2)
Obvious trojans? (Score:2, Insightful)
Dumb people being tricked?! News at 11.
Technically, if you've got extra wires hanging out of your Trojan Printer, you just might be the biggest idiot in fuckheadland. Integrate your spyshit to the motherboard and feed off the built-in network connection and power system! Sorry, I don't click on *world.com articles due to high ad noise and shitty page layout, but I get the drift, Ned. Not even close. NEXT?!
Re: (Score:2)
Everyone can be tricked.
If you don't want to read the article, fuine but don't post about them. It's just additional noise for nothing.
You want to know who the biggest idiot in fuckheadland is?
People who comment on articles based on just the /. description. I mean, seriously, those thing are usually wrong.
Old trick, upgraded (Score:3)
This sounds like a modern version of when the CIA planted a camera inside the Xerox machine in the Soviet embassy.
Re:Old trick, upgraded (Score:4, Funny)
Re: (Score:3)
Cool (Score:3)
These are pretty cool tactics, but are they warranted? Is the world of corporate espionage so devious and sophisticated that these would be legitimate vectors of attack in the wild?
Re: (Score:2)
Nah, they don't use legitimate vectors of attack in the wild yet. They still use bitmaps.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I mean is there any evidence of this happening IRL? Would someone do something this convoluted or have there been breakins before like this? For example, I'm sure my organization is vulnerable to a scuba attack, but is it that high of a risk that I should take notice?
Re: (Score:2)
About 10 years ago I was at a security conference, where the Navy's cyber warfare officer (I think at the time he was the only one - he was working hard at the time to set up the first "cyber warfare battalion", and was also trying to get more cooperation between gov and industry, with the gov providing useful hints on security, and a voluntary security network among industry sysadmins) pointed out that in red team tests, the average cost of rolling over a data center employee to get physical access to a da
Why make it complicated? (Score:5, Interesting)
This was a HUGE security breach, process breach, you-name-it breach. The guy was canned afterwards, but that's not the issue. What's funny is that pretty much all companies' buildings in that area have at least one unprotected WiFi network, freely accessible from any device. No username or password required.
You want to browse through most of the Top50 companies' "secured" networks? You got it. Sometimes I wonder where are all the damn hackers...
Re: (Score:3)
Trying to hack Blizzard's servers to get some l33t gear they can't bother questing for?
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
But would that help you find magenta and teal access points as well?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You got it. Sometimes I wonder where are all the damn hackers...
Chasing your WiFi?
Re:Why make it complicated? (Score:4, Informative)
This is why serious wireless vendors like Cisco and Aruba and the like have "rogue access point detection" which can not only triangulate the location of an unknown device given its wireless signal strength in relation to legitimate APs, they can also determine if it's hooked up to your network (if there's appropriate hardware in the packet path) and spoof packets to cause a denial of service and disconnect any clients.
Of course, these capabilities will cost you.
Re: (Score:2)
Funny Similar story - one day we found one of our buildings was getting bad IP addresses. 192.168's, so thats even more odd, that whole building is on 172.21.0.whatever. We couldn't figure it out at first, nothing wrong with our servers. Tracing it back from one of the computers with a Bad IP, we determined, there was a rogue router plugged into our network, DHCP was still enabled and this little Linksys thing was causing a world of trouble - luckily it was set to the default username and password otherwise
Re: (Score:2)
Linksys thing was causing a world of trouble - luckily it was set to the default username and password otherwise we might have had difficulty grabbing the MAC Address of it.
You need the username and password of the gateway in order to run: "arp -a" from a computer that's connected to it?
Glued shut with 3 cables? (Score:2)
I, for one, would certainly notice THAT. But who in the corporate world would notice or even care?
Also interesting is that the article links to an eWeek article that in turn links to a Slashdot article from 2007 about this same thing.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
If I were really designing a modular MFP, all of the modules would be powered off an internal bus rather than each having their own power cord.
If I were really designing a printer with a wireless router hacked into it, I'd spend the extra 30 minutes attaching the router power to the printer's internal power supply rather than having two power cords, since I'm likely elbow deep in the printer guts to reroute the ethernet cable in the first place.
A pro would be more thorough (Score:2)
'You can put your box inside a printer tray and glue it shut, and who will notice if there are one or two or three power cables coming out?'
I, for one, would certainly notice THAT. But who in the corporate world would notice or even care?
No you wouldn't. For an extra ~$20 or so, the attacker could put a power splitter and network switch inside the box, making it just one power cable and one network cable. Given how trivial that is, any real attacker (as in a person or group expecting a hefty profit on the operation) would go that extra step. Security groups are more budget-constrained (they also proved that you don't need that level of sophistication for most targets).
It should also be rather simple to use an embedded computer that con
Old Hat... (Score:5, Insightful)
Did that years ago.
HPLJ4 -- two power cables? what are they hiring amateurs?
Open printer, add PC-104 computer with ethernet and a linux on it along with a small switch. printer AND PC104 connect to the switch inside AND scab onto the power supply.
Printer + network scanner/document grabber completely hidden.
Today it's even easier... Shiva plug with a HP sticker on it and it will go unnoticed for months.
Re: (Score:2)
Re: (Score:2)
Or... just put custom firmware on the printer.
Re: (Score:3)
Shiva plug with a HP sticker on it and it will go unnoticed for months.
There's a ton of truth in that... I recently walked into an office and noticed an odd outlet sized box on the ceiling with no significant markings, some slots and two LEDs (one lit red.)
Nobody that I asked knew what it was, including building maintenance... and nobody bothered to look where the cable was going. It was joked that it was a spying device (owned by the company) to monitor workers.
(I think it was a sensor for the HVAC...)
Re: (Score:2)
Cover it with a dark bag. You'll find out what it is eventually.
Re: (Score:2)
1. Disconnect the unknown hardware.
2. See who turns up to find out why it's not working.
3. Tell HR to prepare a P45 / pink slip (depending on country) and notify Security that there's a non employee in an employee-only area.
Re: (Score:3)
Open printer, add PC-104 computer with ethernet and a linux on it along with a small switch. printer AND PC104 connect to the switch inside AND scab onto the power supply.
Printer + network scanner/document grabber completely hidden.
It's not even necessary to hide any physical equipment inside the printer. HP LaserJets can be hacked to steal documents, run port scans, host rogue FTP or HTTP servers, and more. FX from Phenoelit did some interesting work on this, but his website [phenoelit.de] is now censored due to legal issues. Some of his stuff can now be found here [phenoelit-us.org].
Operation: espionage (Score:2)
Man, back in the day you'd send in what looks like an ordinary audio cassette and, after recording a day's worth of audio to on-board memory, it would transform into a bird, shoot its way out, and return to the chest of Soundwave who'd play back what it heard for Megatron.
I've been doing it the hard way... (Score:2)
Wow, I wish I'd thought of that sooner. Stuffing an Arduino with a battery pack and a wifi shield up my ass and asking to use the company john was really wearing on me.
Off the Shelf Trojans (Score:2)
The trojan doesn't have to be so crudely delivered so late in the supply chain. The printer could have trojan SW installed in it, attacking a host PC (and then the rest of the network) over USB, or the network directly when connected over ethernet. The printer manufacturer, or many of its OEMs, could build them to attack anyone, or specific targets among the many installations they're sleeping in. Or a government could build them in, like if the US had succeeded in requiring a Clipper chip installed in all
You can get a mini pc with 2 network ports and put (Score:2)
You can get a mini pc with 2 network ports and put it on the printer that is in place and put a HP printer sicker on the box and make it look like its part on the printer.
seriously? (Score:2)
Seriously? I gave and listend to speeches about this kind of stuff six years ago. I know people who've done this stuff in their security consulting work for five years. Granted, those are cutting-edge people, but the general state of the security industry is not five years behind the state of the art, is it?
Re: (Score:2)
haha, sorry if this is insulting, but you are so typical of the security 'experts' in the industry and the reason I threw up my hands and left it.
A) People are people. You can spend a year giving speeches and lectures and expect the next wave on employees to magically have that information.
B) Comparing the state of the art to security is ignorant.
C) technology is just a TINY part of IT security.
D) Security it a process that needs to be part of the culture. Sending some people to a lecture and giving them a
Re: (Score:2)
A) People are people. You can spend a year giving speeches and lectures and expect the next wave on employees to magically have that information.
Yes, which is why I don't buy the "security awareness" crap anymore. We've been doing security awareness for 20 years now, if it would solve anything, you'd expect to be seeing some results by now.
I don't give lectures to common employees for that reason. I speak (used to speak, been doing different stuff for a few years now) at conferences for security people.
B) Comparing the state of the art to security is ignorant.
There is a state of the art in security as in any other field. There was a time when IDS/IPS systems were cutting edge, now they are standard. There
When I did scurtity work, (Score:2)
printers were a common weak point. Often configure wrong and trivial to get into.
Extra powercables? (Score:2)
Umm if you don't notice that you are a moron. If you accept random electronic 'gifts' that show up in the mail you are just as stupid.
Trojan Printers, Exploding toner cartridges... (Score:2)
Re: Old News (Score:5, Informative)
Urban myth, read the first two paragraphs of TFA
Re: (Score:2)
The true kind or the false kind?
Re: (Score:2)
What always impresses me is when third party pen testers are invited into our office, we are told they are coming and to cooperate with them, and then they tell us how easy it was for them to break into our systems. Well, of course, dumb ass we watched you do it. If we hadn't invited you -- escorted you -- in then you would have had a much harder time. When I step away from my computer to chat with the guy in the cubicle four feet away and I see you sit down but don't hassle your ass, it's not because you'r
outside equipment / stuff not owned by your compan (Score:2)
outside equipment / stuff not owned by your company is easier to swap out.
Even more so if you are renting a office and the building maintenance says it's for any one of the building systems. Like the fire alarm / HVAC / keycard / door security / and so on.