well everyone I have just witnessed the worst opsec of my entire life, and it's at the company i work for
so, first off, this company uses a ticketing system for service desk requests where anyone who has rights on the ticketing system can see all tickets past or present. not surprising.
however, they do password resets in the tickets. as in, you need a new PW, so they reset it and put the new PW *in the resolution*. so it's stored in perpetuity.
i'm sorry, this isn't the big opsec violation. i apologize if you blew already
so i filtered the ticket log for "resolution contains 'password'" and found like 1800 tickets, checked a few, confirmed that service desk here uses a standard format for PWs. I can guess almost anyone's account within 3 tries.
then I clicked on one and it was for a linux system, and in the resolution notes they had pasted the SSH log as they reset the password. now, if you have used *nix you know that when you reset a password it doesn't print the characters you're typing
you also can't pass a password to the reset command on the CLI. so nobody can shoulder-surf you, screenshots don't expose passwords inadvertently, and reset PWs don't end up in the bash_history
well, the brain geniuses here have figured out a way past that extremely good built-in automatic security. folks, let me introduce you to: echo -e 'Newpass1\nNewpass1\n' |& sudo passwd jnichols
I have never seen a "blocked open fire door" this bad in anything, anywhere, ever. This is the worst thing I've seen in corporate IT. I am dumbfounded. I can't figure out who it benefits or why someone spent THIS MUCH EFFORT "solving" this unproblem.
This is that xkcd comic "undoing." It breaks all the security features built in to the tool: passwords can be shoulder surfed, they show up in screenshots and they're in the bash_history.
