6

I work in a small firm of consultants as a Junior. We work in a small office with no more than 15 people.

We get along just fine but I don't think I should cover him up since it's getting in the way of my work and deadlines. He wasn't the one who revealed this to me but a other coworker who is in cahoots with him. I could've just go to my boss and expose him but had no way to prove it; until I sniffed the network and found his method (which I don't think he knows he's using - he's no more than a script kiddie. Not that I'm better but I can grasp what he's doing) of attack which is simply ARP poisoning from his Smartphone. What's ARP poisoning/spoofing? An attack where an user in a network (Called man in the middle) intercepts all the packages, effectively denying communication between two parties (Denial of service) or steal them to get some info, he's doing the first. This is achieved, in this case, with an application whose name I don't know but 'Wifi killer' is an example.

I'm a bit of a coward but don't know if outright tell my boss or simply send him the proofs anonymously. What would people here recommend I do?

Edit: Thanks to everyone for your feedback. I know see that simply by raising this concern and let someone more apt to take it from there is the best course of action, and I will try it.

Improve this question
8
  • 1
    Could you explain in a few words what he is doing for those of us who are not in IT? What are the consequences- a major security risk, or just getting free Netflix?
    – Damila
    Commented Jul 17, 2019 at 16:01
  • Sure, Ill get on my pc to clarify and add more context
    – NoviceMav
    Commented Jul 17, 2019 at 16:03
  • Does your company have an IT Security person (or contracted outsourcer)? They'll be more interested than your boss. Your boss won't care too much unless he's capturing packets which have unencrypted confidential information in them (and even then, it'll take a long time to explain to your boss what is happening, and why it's an issue).
    – PeteCon
    Commented Jul 17, 2019 at 16:10
  • @PeteCon we don't hav one. SHould I try to explain to him what's happening or what I suspect is happening, so he could call one?
    – NoviceMav
    Commented Jul 17, 2019 at 16:12
  • 8
    Why is your co-worker attacking the network? Out of spite against the company or the boss or someone else whose work is being disrupted? Just as a juvenile prank? Trying to make a point about how easy it is or how bad security is at the company? Do you even know why they might be doing what they're doing?
    – filbranden
    Commented Jul 17, 2019 at 16:42

6 Answers 6

Reset to default
13

Just stay factual, do not put blame on anyone. Report what happend: you cannot make your deadlines, because the WLAN breaks down too often. Make sure you have recorded when this happens and why that's a problem for you.

Then let whoever's job it is take the problem from there. Maybe your coworker will be found out. Maybe they'll stop if they know somebody is looking into it. Either way your direct problem is solved, the WLAN is working again.

Improve this answer
3
  • I would be concerned about the IT team that is not able to spot these network problems when it is likely impacting everyone.
    – Joe W
    Commented Jul 17, 2019 at 22:06
  • An office of "no more than 15 people" might not have a IT team at all.
    – GittingGud
    Commented Jul 18, 2019 at 6:58
  • This seems to be far too casual of a response to someone boring a hole in your boat.
    – Ethan The Brave
    Commented Jul 22, 2019 at 15:50
25

I think this a bit more serious than you understand. Let me try to give you an analogy.

You're a cook in a large kitchen. Every once in awhile, you can't cook potatoes because the oven doesn't work - and you just found out that the reason is because another chef is tinkering around the electric transformer for the city block during their breaks.

Your response shouldn't be, "Hey, don't mess around with that transformer because you're setting back my potato cooking." Your response should be, "Holy *#$%, what the *#%% are you doing screwing around with that transformer!" and uneasily wondering what other problems his escapades are causing.

Your coworker is dinking around with the LAN and doing script-kiddie stuff on it. Why on earth are you only worried about your ability to do your job? Why aren't you worried about him intercepting sensitive data? Why aren't you worried about him hacking the databases? Why aren't you worried about him performing malicious acts on the company data and apps? Why aren't you worried about him ransomwaring?

To be honest, this goes way above "coworker" at this point. If I found out about this at any of the companies I would work for, I would:

  1. Actively and aggressively push management for Pen-Testing consultants to come in.
  2. If the company resisted, I would then do a simple white hack example. Show them that, hey, we know we've got vulnerabilities and we need to find out how to fix it - and mention that nearly 75% of data breaches are internal.
  3. If the company still resisted, I would show them evidence of an actual hack occurring. That should be easy, considering your coworker is doing them. You don't have to specify who, just that it's occurring.

Let me be blunt: This isn't a coworker situation; it's not an interpersonal situation. It's a data security situation.

Improve this answer
3
  • I like your attitude and how you are thinking like a possible blackhat. Risk aware is good. However, unless we get a bit more information such as what the OP architecture / IT processes is , 4th paragraph looks a little overzealous right now. Would you consider editing?
    – Anthony
    Commented Jul 18, 2019 at 0:37
  • I agree those are potentially valid concerns and attack vectors, but may or may not be exploitable. A bit more nuance emphasizing likelihood and balance can make this answer stronger
    – Anthony
    Commented Jul 18, 2019 at 0:39
  • 1
    @Anthony - Dunno. I mean, I guess the way I look at it is, the only things OP really knows for sure is that A) one of the 15 people at the company is using hacking scripts to attack the IT framework, B) at least one vulnerability was found, and C) the coworker doesn't seem to be a white-hat. I mean, maybe the vector the OP was told is the only one that's vulnerable, and nothing would come of any of it. But maybe there are more vulnerabilities, and if there are, you don't want a black-hat internal threat. The whole thing struck me as "don't dink around - it's not worth taking risks here."
    – Kevin
    Commented Jul 18, 2019 at 2:24
2

If you don't feel comfortable exposing him directly, at a minimum I'd bring to the boss's attention the method that's being used. If you can point it out without implementing him directly, do it. At that point, it's certainly possible an investigation would be done that would then lead to him.

Improve this answer
2

Maybe don't broadly expose what you've found, but you should consider raising a concern to your manager and confronting your colleague.

Security is a serious issue regardless of domain. If you would report someone compromising the physical security of your firm (maybe damaging locks or copying keys) then you should feel similarly about cyber security.

A few things to keep in mind though:

  • Your report is unlikely to be anonymous. It would be best if your colleague heard your concerns directly from you before learning that you reported him/her to the firm's management.
  • This isn't an appropriate topic for general chit-chat. Share your concern with your colleague and manager, but not others.
  • Offer ideas on how to verify/respond, but let the IT team or your manager make the calls. You've done your part by reporting the issue. Let those in the appropriate roles decide what to do.
Improve this answer
0

Unlike what others have said I think in this case you have to report what you have heard because there are one of two things likely going on and neither of them are good.

Either you are being targeted specifically or the IT team is not able to track down the issue and most of not all of your co-workers are being impacted and not able to work at full capacity. The reason I say this is because if you are having connectivity issues it is highly likely that everyone else is also and that will mean that the team in charge of the network is not able to track down and fix the issue (though I would have concerns if they are not able to)

Something that hasn't been pointed out yet but should be is you might also be in trouble here for your network sniffing that helped you figure out what was going on. Depending on the policies in place at your workplace it can be against policies to do actions like network sniffing and could be something that will result in immediate termination of employment.

Improve this answer
0

I think the issue with being "factual" in this case is that your boss will likely call a meeting to gather everyone to figure it out. Imagine presenting these findings right in front of the person you know who did it? Since your objective is to be discrete, I think this method will backfire.

With that said, I would call your boss over for a private meeting and explain your findings, what proof you have (wireshark logs, router logs, whatever logs) and explain you believe it is X because he revealed to you he used his smart phone to do these attacks.

Also, keep in mind your coworker may not be the actual "hacker." It may be that he's simply trying to look good in front of you by trying to be proficient. So I would double check with him first to verify that he is indeed doing the attacks.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .