0

I am a developer working for a small company. For my own purposes, I have developed a small VS desktop program that allows me to cycle through some favorite web sites through the company's network. The URLs are contained in a database, and a click will move to the next URL or the previous URL. I've had this setup for a couple of years with no problems until now.

Earlier in the week, one of the sites in the rotation was inexplicably and consistently redirected to localHost (127.0.0.1). The next day it was fine.

Today I find that another of the sites in the rotation is redirected to local host. I checked on different browsers and on different machines, and it happens on all of them.

My situation here is that the network administrator has a grudge against me, for whatever reason, other than the fact that he is extremely childish. Not being a network expert, I am wondering if there is a way that this guy could be playing tricks with me by blocking and unblocking the URLs that I frequently go to. And is there a way he knows if they come specifically from my machine?

It needs to be pointed out that these sites are in no way restricted or controversial, i.e., not porn or any other kind of contraband. In the case of the blocked URLs they are standard comics pages that are no different than ones seen on a newspaper page.

How should I address this issue with my employer?

  • Probably better off at serverfault.com -- this is a technical, not a workplace problem. – mustaccio Oct 13 '17 at 14:07
  • 1
    I thought as much. I will try serverfault.com. Thanks! – okcdev Oct 13 '17 at 14:12
  • 1
    If you're not sure on which site to post a question, you can ask for a recommendation using the "site-recommendation" tag on Meta Stack Exchange. – Dukeling Oct 13 '17 at 14:12
  • @okcdev lease go through their serverfault.com/help/how-to-ask first and make sure, that your question is a good fit for their site and includes all necessary information. – Sebastian Proske Oct 13 '17 at 14:16
  • Redirecting to localhost is actually consistent with the server being misconfigured at the host side. – IDrinkandIKnowThings Oct 13 '17 at 14:19
6

Yes, all the requests for a website coming from your machine carry your IP-address, which the admin knows. You are transparent to them, as long as you don not vpn-tunnel out.

This kind of attack is called DNS-Spoofing - here is a technical explanation what is happening

I would compile an e-mail to the admin, describing the problem neutrally without blame. Copy in your manager or/and his manager so he´ll be put in a public spot. If the problems continue he´ll have to answer to his manger why he was not able to fix it.

Edit: Just wanted to add that it could theoretically also be malware on your computer or in the company network that causes such an behavior. So you have kind of an obligation to report this because it could be a security breach.

  • If it's malware, it would also have to be on my other machines, including an iPad and a MacBook. This happens on all of them. – okcdev Oct 13 '17 at 14:31
  • Fact is, that DNS is not working correctly. DNS is usually relayed by your company´s firewall so there is the point where the wrong address gets injected. You have a suspicion why, but it´s hard to prove without escorting the admin out of the building and having an it-forensic inspect the firewall at the moment it happens. – Daniel Oct 13 '17 at 14:35
  • unless the logs have been purged their will be evidence of the change that would not be that hard to find. Its all encoded so while not hard to decode finding the record, removing just the one record, and figuring out the correct hash to add to the log file is nearly impossible. – IDrinkandIKnowThings Oct 13 '17 at 14:37
  • @IDrinkandIKnowThings: you are probably right, but we are making a lot of assumptions on the company´s IT-Setup here... – Daniel Oct 13 '17 at 14:40
  • There is a simple test to determine maliciousness - ping the URL from another private machine at home/outside the office and then use the IP address in the office to access the websites. If the IP goes through, the DNS is being messed with which would be misuse of business property/privileges on the part of the network admin. – toadflakz Oct 13 '17 at 14:59
4

Yes, a network administrator can certainly be doing such things.

However - unless being blocked in this manner is interfering with your ability to work, there's little you can bring to management.

You could possibly call this harassment, but, either way, you would need to prove the existence of the problem (possibly record the issues as they come up and have a colleague back you up on them).

  • To be clear, yes, this is for personal use, but the culture in my company is such that I know that management would not have a problem with this, as long as it does not interfere with my work. It's the kind of thing I do on break time. – okcdev Oct 13 '17 at 14:11
  • Which is why I mentioned harassment as an option. You could argue this is creating a hostile work place for you. – Oded Oct 13 '17 at 14:12
  • 2
    Openly accusing him could backfire, as long as you can not prove it. I would try a softer approach first. – Daniel Oct 13 '17 at 14:16
  • @okcdev - Yes but once you put in a trouble ticket about not being able to surf a non work site... it begins to interfere with doing work. Not just you but who ever gets assigned that ticket – IDrinkandIKnowThings Oct 13 '17 at 14:24
  • It depends on what company you work for, if someone in my company was doing something petty like this it'd be more the principle of the pettyness that caused issues than the actual websites being blocked. – enderland Oct 13 '17 at 14:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.