15

Like Windows, Mac has a feature that allows users to remotely login to their system from another system. Yesterday, my coolleague asked me to remotely login to my Mac using his system. I did just that and went back to work.

A few seconds later, I saw his computer screen. He had keylogging software running on his system. He hid it immediately when he saw me looking. What should I do? How do I confront this guy?

I would have complained to senior management, but my problem is this guy is my biggest supporter in the company. Also, it's my first job, and it's been only 4 months since I joined this company. This guy could get me fired simply by saying that I am not productive or I am a bad employee or I don't perform so good. He is responsible for all my reviews.

The project manager and CEO both ask him whenever they wanna know about my performance. They have no other way to evaluate me, and it's a two man team. So I don't have any other members in my team.

Improve this question
8
  • 2
    Hello! I'm not 100% sure the question title matches what you describe as the problem? Is the team lead trying to steal your password, or is the company simply trying to monitor what you're doing on the computer while at work?
    – jmort253
    Commented Mar 22, 2013 at 5:29
  • Why would they monitor me?
    – anon
    Commented Mar 22, 2013 at 5:44
  • 12
    I got it now. The keylogging software was running on his computer... this does seem... odd... Did you change your password? Definitely be sure not to use the same passwords at work that you use for personal stuff.
    – jmort253
    Commented Mar 22, 2013 at 6:11
  • 2
    Are you 100% sure that it was even keylogging software? From the sounds of it you only got a brief glance at it if he hid it, is there no room for uncertainty about what it was?
    – user5305
    Commented Mar 22, 2013 at 9:19
  • 3
    Not to read too far between the lines, but it sounds like there is a totally unrelated issue that makes you assume that a brief glance at a computer screen indicates keylogging from the one person who supports you. Strikes me as paranoid and/or an indication that you have separate issues in the workplace. Perhaps I'm wrong, but...
    – jmac
    Commented Mar 22, 2013 at 16:28

2 Answers 2

Reset to default
40

First things first, change your password.

Second, change every single password on every account that used the "exposed" one.

Lastly, don't confront him about it without hard evidence. There really is no point and all you end up with is lots of drama and very little gain.

Also, don't assume anything. Maybe he just discovered the keylogger himself and didn't want you to see it because it would have been hard to explain. Maybe it was installed for some other purpose and your password wasn't really the target.

In any case, you can never be 100% sure.

Just try to be careful and it if happens again, talk to him about it the second it takes place, not hours after the event. Once you let him get off with your "pretending not to notice", its very hard to channel the conversation that way again and you will have lost the best chance to get to the bottom of it.

Improve this answer
5
  • If you want to collect hard evidence, changing your password is the last thing you want to do!
    – Michael Zedeler
    Commented Mar 23, 2013 at 21:26
  • 18
    If you want to protect yourself from potential damage done in your name, changing your password is the first thing you want to do.
    – huntmaster
    Commented Mar 27, 2013 at 13:55
  • 1
    @huntmaster is right - defend yourself FIRST. Change all your passwords related to work (especially any ones that are the same as the one that got logged). Using your password he could do anything and make it look like it was you.
    – Michael Kohne
    Commented Mar 27, 2013 at 19:02
  • Also, make sure that all your passwords are DIFFERENT. That way compromise of, say, the login for your computer, won't give him everything.
    – Michael Kohne
    Commented Mar 27, 2013 at 19:04
  • OSX has an app called Keychain Access that stores credentials (WiFi, website passwords, etc.). The default keychain is unlocked with the user password. If there's anything saved there better change those passwords too.
    – jcm
    Commented Sep 13, 2014 at 11:52
13

As mentioned already change all your passwords.

There should be no expectation of privacy on company resources. Although that may vary depending on what country/state you are in.

So the next thing to check is if this is authorised behaviour. So I would go to a senior manager (or security department if you have one) and explain the situation.

If it is authorised monitoring then you need to live with it. I doubt very much it is based on what you described, as they would just give him an admin account to your machine to monitor/review.

The main point is, if someone is liable to circumvent the security process to access resources under another users details, they are liable to do it to others as well (ie. your CEO/senior management). That should be the point you are getting across, not that you have an issue with the team lead directly.

Improve this answer
5
  • 3
    I urge caution when accusing someone (especially your boss) based on conjecture with no proof about something this serious. And this isn't just a casual, "Hey IT guy, recently I think my boss stole my password using a keylogger on his computer. Is that company policy?"
    – jmac
    Commented Mar 25, 2013 at 7:35
  • 1
    Yea, wording it should always be non-confrontational.
    – Simon O'Doherty
    Commented Mar 25, 2013 at 7:40
  • 1
    It's not about the wording, it's about the concept of making very serious accusations without any solid proof. That is really really dangerous no matter how you dress it up as something else. Hopping over the boss' head implies you think they are guilty from the start, and shifts responsibility for proving that to someone else who is bound to actually look in to it. That is a serious thing and should not be done lightly.
    – jmac
    Commented Mar 25, 2013 at 7:45
  • 2
    But you don't make an accusation. You just state the facts as you see them. For example: "X asked me to log in from his machine to mine with my login. I saw what looked like a keylogger when I did this. Should I be worried?".
    – Simon O'Doherty
    Commented Mar 25, 2013 at 8:37
  • 3
    What would this person do about it? If they check the boss' PC on your comment, the boss gets pissed. If they don't check the boss' PC, then you don't get an answer. They are put in a situation where your "comment" made them have to either imply the boss is guilty (by requiring the boss' PC to be investigated), or ignore a request that could be a huge breach of company policy. This is 100% an accusation and it will put whoever is asked in an awful situation. This is not something to be done lightly.
    – jmac
    Commented Mar 25, 2013 at 8:45

You must log in to answer this question.