Mark Loveless, aka Simple Nomad, is a researcher and hacker. He frequently speaks at security conferences around the globe, gets quoted in the press, and has a somewhat odd perspective on security in general.

Tales from the Past - Bizarre Help Desk Request

Tales from the Past - Bizarre Help Desk Request

Photo by rawpixel on Unsplash

Photo by rawpixel on Unsplash

Once upon a time I worked at a railroad. This was in the 90s. To show you what a different time it was, I was once in a meeting where two guys got into an argument that led to fisticuffs. After pulling the guys apart, the manager called for some semblance of order, and made them shake hands. Then we all sat down and had the meeting like normal. No one was fired, disciplined, nor was HR ever involved. But this is not a story about two guys punching each other, it is a story about the dumbest request ever received by the Help Desk.

I worked in the LAN group, and we handled the servers. For server issues we were considered second level support for the Help Desk. Novell NetWare ruled the day, and we were in the process of upgrading the file servers to more powerful hardware. We were doing this one department at a time, and it involved a series of backups, restores, and some manual copying of files. The copying itself was not an issue, but it was mainly coordinating the non-technical users. We were working closely with the Help Desk for user migration, which was somewhat painful.

Now, a part of corporate policy called for no personal data on corporate PCs. There had been issues with people installing crap on PCs, and the main method of fixing a PC back then was to wipe and reload. The other part of this scenario was that we did not want people storing important documents like spreadsheets and whatnot on the PCs. The data should have been on the servers which were backed up nightly. So, the culture around computer usage was to store data on the server lest it get wiped if your PC acted up. You could also log in from anyplace on the corporate network and have access to all of your work.

During the migration of user data, all kinds of files were found that were not work appropriate on the servers in the user personal directories. The most common things were recipes, maybe a kid’s school report uploaded for later printing, and so on. Most of it we ignored and simply moved it over to the new server. A few people had a really large amount of personal stuff deemed non-work-related, and we’d “forget” to move that data - games were the most common. It prevented us from filing extra paperwork on someone, and it prevented some type of HR investigation into the “misuse of corporate resources”.

After the server migration of one of the traditional railroad departments whose job it was to keep trains moving, the Help Desk gets a call from this guy on the “train” side of the house stating that not all of his files made it over. No big deal. The Help Desk was already getting a few of those types of calls. It was not unusual to see these situations during the migration process. However, a quick diff showed that the only missing files for this guy were in a directory called (believe it or not) “PORN”. Inside the directory was a rather large cache of pornography. Myself and another LAN guy were called over, and the Help Desk employee says, “How do I handle this?” We took a look. It seemed one of our co-workers had migrated this guy’s data, and, in an effort to give the guy a break, decided to exclude the pornography which saved the guy’s job. Now it seemed to be the reason the guy was calling. Were we missing some critical railroad document? We weren’t sure. We urged the Help Desk person to call the guy to ask exactly what was missing. At best we figured this would shame the guy into realizing he had been done a huge favor, or we simply missed an important file. Either way, the problem would go away.

The Help Desk person called the guy and asked him to tell him exactly what was missing. We watched the Help Desk person nod, say yes and uh-huh a couple of times, hear him say, “Ok, I’ll have the LAN guys look into this”, and hung up. Well, of course it must have been a mistake, some critical business file we overlooked, right? The Help Desk person looks up and says, “He says he’s missing his porn files.” Good god you are kidding. “He also says he wants them copied over today, not some time next week. Today.”

I’ll let the boldness of that sink in.

We then had to go to our supervisor and tell her. Now, my boss was one of the nicest young women you might ever meet. She was fair, always pleasant, a great boss. Her thin and tiny frame may have barely been five feet tall, but she was tough and stuck to the rules. We explained the situation to her - the PORN directory, the non-migration where someone gave him a break, the department involved, and the Help Desk request. Without batting an eye, she said “I need to see the files. We have to know that it is actually pornography before I talk to HR.”

Ok, another tough situation. You see, our boss was sooo sweet and nice. A devoted wife, mother, and Christian, and we had to show her pornography. It might as well have been your own mother, grandmother, and daughter all at once. An attempt had been made to prevent this from happening, but she said, “Show me the file.” A file was picked at random and brought up on screen in frightfully high resolution. Fortunately, it was just the picture of a single naked woman posing and nothing involving other porn models. Her face turned beet red, but she kept her composure and stared unflinchingly at the image until it was displayed in full upon the screen. Calmly, she said, “Okay, well, that is definitely inappropriate for work, I will take it from here.” Image file closed, she called HR. To her credit she never broke character or reacted outside of blushing. None of us ever discussed it in front of her again.

Now, one had to do a lot of bad stuff to get fired from the railroad. I worked with a man that had been arrested and sent to prison for several years for dealing cocaine yet managed to get his job back after he served his sentence. Like I said, a different time.

Despite his standing in the company as a competent employee who completed his job quickly and efficiently, being a member of a good ol’ boys network of railroad men whose background stretched back to the civil war, the porn guy was not as lucky as the coke dealer. Even with his years of tenure, and still in good standing with the union (he came up from the union ranks), he was not only fired, but he was unable to bump back into the union. It was that much porn. And this was a couple of decades before #MeToo.

I was not there for the file viewing. I heard about it. It was legendary. I mean, she was a rock working in an organization that was trying to be more inclusive to women and minorities, but there were pockets of ugliness. I don’t know how this religious woman dealt with this, but the way she handled it made every single person on staff respect her even more.

Anyway, I hope your Friday is going well, and if you work for a Help Desk, you have my undying respect forever.

The Game of Risk

The Game of Risk

A New Year

A New Year