Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×
Security It's funny.  Laugh.

Is it Just Me, Or Is Our Mainframe Missing? 606

xnuandax writes "Here's a salient lesson for those system security personnel who spend their time fretting over the theoretical crack-ability of their 1024 bit encryption keys. Australian Customs have recently suffered a rather unfortunate set back in their "War Against Terror" with the admission that two of their secure mainframe servers have been wheeled out of the building by persons unknown. I'll bet my $2 that the root password on those boxes was 'trustno1'."
This discussion has been archived. No new comments can be posted.

Is it Just Me, Or Is Our Mainframe Missing?

Comments Filter:
  • by B3ryllium ( 571199 ) on Friday September 05, 2003 @01:33AM (#6876968) Homepage
    ... when you don't do retinal scans on pizza delivery people.
    • by dekashizl ( 663505 ) on Friday September 05, 2003 @02:43AM (#6877235) Journal
      Do not forgot -- you now must check all pizza delivery people for neck-mounted bomb collars as well. The risk for data loss is more severe, for it generally cannot be recovered. ...
  • by Capt'n Hector ( 650760 ) on Friday September 05, 2003 @01:34AM (#6876970)
    *starts looking for cheap parts on ebay*
  • by tekrat ( 242117 ) on Friday September 05, 2003 @01:35AM (#6876983) Homepage Journal
    Isn't that how they always did it on Josie and the Pussycats cartoon? They'd dress up as "computer repairmen" and then wheel the computer out the door, which would then infuriate the bad guy and they'd have the chase scene set to a song.

    I kept saying that's how I'd get my SGI Onyx that way, but it never seemed to work out. Anybody that steals a mainframe is either looking to part it out and sell it on Ebay, or they are going to melt it down for the valuable metals.
    • Read the article. It states that the theives were likely after information instead of hardware. The value of the hardware is nothing compared to the information that *might* be on the servers.
    • by Large Green Mallard ( 31462 ) <lgm@theducks.org> on Friday September 05, 2003 @03:58AM (#6877447) Homepage
      I have an SGI Onyx in a cupboard at work, turned off and doing nothing.

      No you can't have it, I thought I'd just taunt you tho :)
  • Physical security (Score:5, Interesting)

    by HermanAB ( 661181 ) on Friday September 05, 2003 @01:35AM (#6876984)
    is more important than anything else. Some years ago, people stole from Harrods in london, by simply taking a whole cash register, while disguised as maintenance men.
    • I've seen something similar on TV. One of those cop shows had video tape of a woman dressed as an ATM security company security guard take an ATM out of a convience store. Said that the machine needed "maintenance". She chatted away with the store owner and customers as her accomplice posing as a maintenance person hauled the ATM out the door.
  • PC (Score:5, Funny)

    by Timesprout ( 579035 ) on Friday September 05, 2003 @01:36AM (#6876985)
    The men, described as being of Pakistani-Indian-Arabic appearance

    Thats PC for terrorist isnt it ?
    • Re:PC (Score:5, Funny)

      by Edgewize ( 262271 ) on Friday September 05, 2003 @01:50AM (#6877047)
      The men, described as being of Pakistani-Indian-Arabic appearance

      Thats PC for terrorist isnt it?


      That's not PC at all! It's like describing someone as Scandinavian-Russian-French.

      "All you fsckers look the same to me!"
      • Re:PC (Score:4, Funny)

        by hype7 ( 239530 ) <u3295110@noSPam.anu.edu.au> on Friday September 05, 2003 @01:58AM (#6877080) Journal
        "All you fsckers look the same to me!"


        Ha ha! After reading the description of "pakistani/indian/arab", I'm betting that the person whose job it was to look after these things didn't see anybody at all.

        Tell an Australian that a person from any one of these three sub-cultures stole something, they'll instantly believe you.

        -- james
        • Re:PC (Score:3, Funny)

          by Trejkaz ( 615352 )
          You'd convince more Australians if they were Lebamese, but then with thinking a bit harder you'd realise that a mainframe can't be used to soup up any sort of car, and thus it couldn't be a Leb who did it.
    • Yeah, like Timothy McVeigh.
    • Re:PC (Score:3, Funny)

      by clambake ( 37702 )
      The men, described as being of Pakistani-Indian-Arabic appearance

      No no no! It's not like that at all... These men CLEARLY came from a mixed Pakistani, Indian and Arabic heratiage (20%/15%/65%, respectivly). What else are people who majored in Physical Anthropology in Austrailia going to do if they aren't going to schlep it as security guards? They have to make a living somehow, as there are only so many days that you can eat spit-roasted kangaroo in a row before you need a decent chicken wing or two..
    • Re:PC (Score:5, Funny)

      by Brad Mace ( 624801 ) on Friday September 05, 2003 @02:45AM (#6877244) Homepage
      A Pakistani, an Indian, and an Arab walk into a server room...

      I forget the rest, but the Australian government ends up looking like a bunch of tools

    • Re:PC (Score:5, Funny)

      by ozbird ( 127571 ) on Friday September 05, 2003 @08:53AM (#6878957)
      Thats PC for terrorist isnt it ?

      It's a slightly more PC version of the previously used description "of Middle Eastern appearance", which non-Middle Eastern people found offensive, especially those born in Australia. A more accurate description would be "two smug looking guys, each with a server on a trolley."

  • security? (Score:2, Insightful)

    by chuckfucter ( 703084 )
    yeah, that's unfortunate, but i'm sure that the fault lies with their security gaurd not the admin's
    • Re:security? (Score:3, Informative)

      by Detritus ( 11846 )
      Blaming the guy at the bottom of the totem pole is the easy way out. What sort of guards did they hire? Minimum wage rent-a-cops? Were they properly trained and supervised, given clear orders, have the backing of management?

      At most places, security is an underfunded joke. The only serious security that I have seen is at some military installations, where sensitive areas have MPs with weapons, who actually look at IDs and access lists, and have clear orders to shoot any idiot who tries to breeze through th

  • by balthan ( 130165 ) on Friday September 05, 2003 @01:38AM (#6876993)
    Let this be a lesson...

    When you're caught being grossly negligent and incompetant, blame terrorists.
  • by erfmuffin ( 192451 ) on Friday September 05, 2003 @01:38AM (#6876995) Homepage Journal
    .. bah.. bloody idiots. And I bet these are the same people that call me up and expect me to tell them their passwords over the phone and then get pissed off because I want their details..

    Simple security procedures.

    Didn't anyone learn anything from losers like Kevin Mitnick?

    • by 1lus10n ( 586635 ) on Friday September 05, 2003 @02:03AM (#6877103) Journal
      Didn't anyone learn anything from losers like Kevin Mitnick?

      Nope. if they did social engineering wouldnt be as easy as it is, and believe me it is EASY. i work for an outsourcing company (3000 employees, dual OC 192 connections, and two brand new V880's) and they dont employ ONE security person, they have no security policy. and we are doing work for some of the top companies in the telecom/datacom industry. amusing from my perspective anyway.
      • Comment removed (Score:5, Interesting)

        by account_deleted ( 4530225 ) on Friday September 05, 2003 @03:04AM (#6877303)
        Comment removed based on user account deletion
        • This means that (Score:5, Insightful)

          by poemofatic ( 322501 ) on Friday September 05, 2003 @03:49AM (#6877424)
          to access your data, I have to know your publicly available ID and I have to have access to the phone in your (unlocked) cubicle.

          How well does your company pay their cleaning/janitorial staff? Suppose a coworker went into your cubicle and called IT from your phone -- how would security find out who did it?

          I would assume that they would need to see your ID (as well as you) before resetting your password. If that is too burdensome, then have a system in which you contact your manager or HR. One of these can then log in through a secure connection and file a password reset request with your ID to the remote IT support site. The fact that they are logged in (with their password) at least ensures there is a starting point for an audit, and the odds of impersonation are less likely.
          • Re:This means that (Score:5, Insightful)

            by Jerf ( 17166 ) on Friday September 05, 2003 @08:42AM (#6878833) Journal
            to access your data, I have to know your publicly available ID and I have to have access to the phone in your (unlocked) cubicle. etc. etc. etc.

            He didn't claim his security was perfect. There's always a way around security; mere existance of a way around it does not automatically mean its worthless. It raises the bar, I'd bet money it provides a paper trail, and as long as the employee isn't on vacation, the employee will detect it when they try to login next and can't because the password changed. (Detection isn't instant but should average less then a day.)

            I post this because this is one of the common mistakes made in security, not doing a risk analysis and just assuming you need "more". I strongly suspect that unless the grandparent poster is working for the NSA, that they've successfully raised the bar past what anybody who cares can hurdle. Spending more on a more restrictive regime would just be a waste of money.
  • we thought you'd arranged it. they were wearing overalls.

    overalls!?
  • by paganizer ( 566360 ) <thegrove1&hotmail,com> on Friday September 05, 2003 @01:39AM (#6877000) Homepage Journal
    My last contract at a bank we did that; I won't mention the city, but the bank owned the buildings all around it and used them for storage. We had a bunch of contractors coming in for a workstation rollout, and the first day on the job I had them wander around the building, without ID of any kind, and just grab random computers and haul them across the street, using whatever explanation for it they felt like.

    it was the NEXT DAY before any inquiries came in.

    Oh, they also used the signs on the buildings you could see through the windows as admin passwords.

    • by Halo- ( 175936 ) on Friday September 05, 2003 @08:19AM (#6878630)
      I had to visit the data center for a major financial center in Jersey City, NJ shortly after WTC. (A lot of the big iron is across the river from Manhattan... for price reasons more than security) Because of the sudden lack of available downtown office space, every available empty space in Jersey City was suddenly rented out.

      So... I walked into see my customer. I was surprised a the new security in place. I showed my company badge, signed in, and was lead to a desk under a sign marked "High Value Transactions". Plopped me right down in front of a terminal. I was really confused. The setup was totally different than what I was expecting from previous visits. So I started looking around for people I knew, etc... After about 10 minutes I realized I was in the data center for the WRONG company!

      So I got up and left. I have no idea how long I could have stayed there, or what I could have done. I suspect that if I had gotten out a screwdriver, I could have likely started shopping for hardware.

      Moral of the story: chaos breeds insecurity, and an "official" plastic badge with your picture on it is shockingly powerful.

  • by PerryMason ( 535019 ) on Friday September 05, 2003 @01:40AM (#6877004)
    The big question has to be; what have they left behind? The guys who knicked the servers were floating around the Customs building for the better part of 5 hours. I'd bet a penny to a pound that they left backdoors open to get back in when they feel like it.

    From my perspective as a former sysadmin/security guy, how could someone not notice that 2 main fileservers were suddenly offline? Alarm bells should have been ringing the second they came offline. Where's the monitoring? I suppose at the very least that its a kick in the ass to anyone who thinks that physical security and good procedures are any less important than firewalls and network intrusion detection.
    • How about records from the security cameras?

      You mean it was all stored on the hard drives of the stolen computers? ...
    • Perhaps they weren't "main fileservers". Taken from the Sydney Morning Herald [smh.com.au]:

      [The representative] said the stolen servers did not contain sensitive information.

      "They did not contain any personal, business-related or security information, and they are not servers that are used to communicate with law enforcement or security agencies," [she] said.


      • by PerryMason ( 535019 ) on Friday September 05, 2003 @02:10AM (#6877126)
        [The representative] said the stolen servers did not contain sensitive information.

        Because you'd expect them to say anything different? Hell, the theft took place on the 27th of last month and since then the very woman whose job it is to ensure physical security of the site has been involved in a Parliamentary review of National security. She managed to appear a few times and didn't mention the theft once.

        The short answer is that they'll tell you nothing if they think they can get away with it, then tell a lie when caught out telling nothing and then when caught lying, they'll claim they had to lie for the protection of "National Security".
  • by silverhalide ( 584408 ) on Friday September 05, 2003 @01:46AM (#6877030)
    This just reminds us what the greatest risks are to any secure system: social engineering and inside men. If you look authoritative and dress up in a serviceman's outfit, very few people will question your actions. You can steal furniture, computers, machinery, tools, whatever by just looking important. By imporsonating a sysadmin on the phone, you can easily talk passwords out of gullible people. With a fake service order "signed" by the right people, the odds are endless.

    On the same note, people inside an organization are often responsible for hacks, stolen information, and other things since they have the keys already!

    It just goes to show the weakest portion of any system is the people.
    • by cei ( 107343 ) on Friday September 05, 2003 @02:09AM (#6877121) Homepage Journal
      Heh. I had friends who used to do A/V work at various hotel ballrooms for conventions and the like. Even when they weren't working, they could put on black t-shirts, throw a wrapped up extension cord over a shoulder, and waltz in through the service entrance, straight through the kitchen, and nab a LARGE drum of Hagen Daas from the freezer without breaking a problem.
      • A friend of mine used to get into amusement parks with his College ID, a labcoat, and a clipboard.
    • The fastest way to look like someone important: Carry a clipboard.
    • by MikeFM ( 12491 ) on Friday September 05, 2003 @03:01AM (#6877295) Homepage Journal
      I usda be a computer tech at a girls school (nice job for a geekboy if you can get it) and they not only gave many of their staff (myself included) a copy of the master key the very first day they began working there.. they also had spares that they'd just leave out for any repair people that came in to fix something. These keys would open anything on campus. Classrooms, server rooms, shower rooms, girls dorms, etc. I can't imagine being that trusting. If the wrong person got ahold of that key they could not only damage or steal property but could rape, kidnap, or kill students. Brilliant security.
  • by heironymouscoward ( 683461 ) <heironymouscowar ... m ['oo.' in gap]> on Friday September 05, 2003 @01:48AM (#6877035) Journal
    Like for ages IBM's mainframes has a standard privileged technician account with the password "musigate", very useful when some BOFH expired my accounts. Ooops, you mean it's still musigate now?
    • Re:Yeah, typical (Score:3, Insightful)

      by sql*kitten ( 1359 ) *
      Like for ages IBM's mainframes has a standard privileged technician account with the password "musigate", very useful when some BOFH expired my accounts. Ooops, you mean it's still musigate now?

      Oracle's default SYS password is change_on_install. You'd be surprised at how many people will type that every day, and not change it.
  • by cybermace5 ( 446439 ) <g.ryan@macetech.com> on Friday September 05, 2003 @01:48AM (#6877040) Homepage Journal
    Sysadmin: "HA! I have patched all my software, yelled at all the users with weak passwords, locked down every possible port and continously monitor the allowed ones, and with this keystroke I will enable UNBREAKABLE encryption on every critical data file!"

    *slams hand down to hit Enter key*

    *hits bare desk*
  • I must say, that was one of the funniest, best written story summaries I've ever read here. I'm still chuckling. I'm afraid that in this case, actually reading the article would only be a let down. What a gem.
  • by nagora ( 177841 ) on Friday September 05, 2003 @01:54AM (#6877062)
    of the three guys that walked into a Belfast pub and stole the newly fitted carpet while the pub was open. They just said the wrong stuff had been delivered and apologised to the customers as they worked around them.

    TWW

    • by Timesprout ( 579035 ) on Friday September 05, 2003 @02:42AM (#6877233)
      Bit like the one about the guy in Dublin walked into a bar/offie just before Chrismas with two kids. Sits the kids at the bar, buy them coke and the prodeeds to order his christmas drinks list. He as asks the barman to keep an eye on his kids while he puts the two crates of spirits in the boot of his car. 5 min later the barman asks the kid where their dad is.

      "He's not our dad. He just asked us if we wanted to come in and have a coke"
  • by OMG ( 669971 ) on Friday September 05, 2003 @01:54AM (#6877064)
    Hey, why all the hassle ?

    A good sysadmin has all important stuff backed up. And if you do it properly the backup is sent to a offsite location. Isn't it easier to steal those backup tapes or discs? If you are lucky the outsourced company doesn't even notice the theft or someone who does not want to loose his job does not tell anyone.

    So my question is: Do *you* encrypt your backups?
    • So my question is: Do *you* encrypt your backups?

      I run several GB of postgres dumps through GPG before they hit the disk every night. They are then shipped off with rsync. Anyone want to receive a copy of my sensitive databases periodically (just over 2GB nightly)? :)

      And no, I don't believe it's impossible to break GPG, but the goal was to be able to put them wherever I wanted them without worrying much about how they got there or whether they leaked.
  • No official BS (Score:5, Insightful)

    by jsse ( 254124 ) on Friday September 05, 2003 @01:55AM (#6877065) Homepage Journal
    The Australian Customs Service has admitted the security blunder, but told customs officers in an email that no sensitive operational information was lost.

    As we can see it's a well-planned action, and there's almost no way to sell the two mainframe for good profit. The major cost center of a mainframe lies mainly in the operational and maintanence, which are not applicable to stolen hardware.

    Obviously, their target is the data within. If the authority do not start investigating what information the thieves are looking for and the possible use of the information within the stolen hw, the consequence might be very serious.

    No more official BS. Do something before too late.
    • Re:No official BS (Score:5, Insightful)

      by wagemonkey ( 595840 ) on Friday September 05, 2003 @04:53AM (#6877620)
      They weren't mainframes, they were servers.

      1) If it was a mainframe there'd be no point stealing the CPU, there's no hard drives in it, you need to take the DASD.
      2) If it was a mainframe CPU and/or DASD 2 guys couldn't hack it - you'd need a crane or possibly a forklift- if it's a small box. They are big+heavy.
      3) Of course the bigger mainframes are water cooled as so they'd need more time for the plumbing or someone would have noticed the leaks...

      The article says they were let into the mainframe room and put the computers on trolleys, then later they refer to "mainframe servers". It doesn't add up-what a surprise the reporting is vague.

      Still, in my opinion (fwiw) the most likely thing stolen is big HP/IBM/DELL servers. These are often put in mainframe rooms to take advantage of the (ha!) physical security, air-con and halon systems. You'd also be a lot more confident of being able to actually hack in to one of these, without the dedicated power supply and other costs you mentioned.

  • by stray ( 73778 ) on Friday September 05, 2003 @01:56AM (#6877066) Homepage
    qouth the fa:


    Customs has been advised that the servers did not contain personal, business-related or national security information.


    So, the servers had neither personal nor business data on it. So what's left? The server must have been empty then, good riddance.
  • ... that my closet is more physically secure than the Customs department of the country of Australia? Next you're going to be telling me that it has more illeg^H^H^H^H^Hperfectly legal music too!
  • With national security uses is the unclassified emails like the grocery list from your wife. Sure you may be blacknight62@gman.gov, but when you get[or send] an email to myhouse@myisp.com you're pretty much hosed!

    How are secure mainframes for national security without any top secret data. Do the Aussies allow their public officals to play Quake on govt machines? Come on, everything is clasified because it leads to something else! Maybe it only had names and addresses of terrorists [better yet, just t

  • by Catharz ( 223736 ) on Friday September 05, 2003 @02:02AM (#6877096)
    The Community and Public Sector Union, which represents customs officers, has asked for guarantees that none of its members is at risk as a result of the theft.

    They've got to be kidding.

    IMHO there should be some investigation into this level of incompetence. Procedures should be in place and followed. If procedures were followed, the person responsible for security (and the procedures) should be put out on their arse with zero chance of another job in security. If procedures weren't followed, the staff that didn't follow them should get their arses kicked.
    • by cyril3 ( 522783 ) on Friday September 05, 2003 @02:07AM (#6877114)
      It's worse than that. They want guarantees that their members are not at risk from terrorists.

      No one will lose their job. Bureaucrats are good at setting it up so that everyone is doing their job perfectly well and can only be complemented on their good work even though everything is fucked up beyond belief.

      How mwny american civil servants lost their jobs because of 9/11 (except the ones who actually tried to warn people). So why would a little mainframe theft lead to dismissal.

  • Customs has been advised that the servers did not contain personal, business-related or national security information.

    Okayy.... So just what was on them, then? Somebody's pr0n collection?
    • by clambake ( 37702 ) on Friday September 05, 2003 @02:28AM (#6877184) Homepage
      Customs has been advised that the servers did not contain personal, business-related or national security information.

      Okayy.... So just what was on them, then?


      They were completely empty. Completely. They never were used to and never inteded to be used, ever. Ever. Seriously. They were shut off since they were bought in 1982 and never, never, ever used for anything secret or anything. Especially not for anything secret at ALL... I SWEAR! This is a complete non-story, please stop asking about it. Nothing to see, nothing to write about, just normal EDS maintence contract gone wrong on some completely unused servers, pretty standard stuff. Here, look at the monkey.
  • Relax (Score:5, Funny)

    by Timesprout ( 579035 ) on Friday September 05, 2003 @02:05AM (#6877110)
    It was the just RIAA removing a couple of infringing servers
  • by Anonymous Coward
    Just so people dont think we are complete nutters down here....

    No mainframes were taken... they were two win32 computers taken from a semi secure? area.

    I'm a little happy that they didnt leave a bomb in place of the two bombs that they took.

    And a word of praise for the IT support staff. They had our systems back up in no time at all.
  • How is this unusual? (Score:5, Informative)

    by bertok ( 226922 ) on Friday September 05, 2003 @02:20AM (#6877159)
    I can relate to this with personal experience. One of my first IT contracting jobs was a two week Windows 2000 rollout at a 110 user company. My job was to pick up every desktop one by one, take it up to the IT cubicle, Ghost six of them at a time, then return the computers. I liased exlusively with the sole IT administrator there.

    It was only on the second last day that someone questioned my actions. Until then, nobody thought twice about an unfamiliar person sauntering up their desk, unplugging their desktop PC, and walking off. Because the old PCs were so dusty, I wasn't even wearing my normal business attire -- instead, I was wearing jeans and a t-shirt.

    This is by no means unusual. I've been to places where the IT employees did not know which servers do what, how many servers they actually have, or what the passwords are. In a place like that, a missing server may not be noticed for days!

    • True, in a previous job the office was broken into at night and a few computers were stolen: took us about a week before we discovered that one of the obscure, rarely used Mac servers was among them.
    • by MKalus ( 72765 )

      This is by no means unusual. I've been to places where the IT employees did not know which servers do what, how many servers they actually have, or what the passwords are. In a place like that, a missing server may not be noticed for days!

      Oh,

      that sounds like a place I worked once. The DBA and I were joking that we could just roll out the main database server and put something cheap like a desktop PC in the backend, nobody would know, because besides him and me none knew what we were doing nor on what har

      • by surprise_audit ( 575743 ) on Friday September 05, 2003 @07:19AM (#6878124)
        I seem to remember a while back reading about some college (don't remember which one) where they couldn't find a server. The server was up and running, they just couldn't locate it... Turned out that part of the server room had been walled off, and the server was completely enclosed in a room with no doors or windows. Apparently the wall had been put up some 4 years previously and nobody had had to touch the server in that time.

        Not in quite the same league as walking out the building with a server, but it still took a special brand of stupidity to forget to put a door in the new wall... :)

        • Someone once told me a highly amusing story about serving on a new US naval ship of some sort, something large. They were building their own floor plan to see how the ship had changed from the blueprints they were provided and ended up finding a sizable room which had no entrances (nor, put another way, exits.) So they cut through a bulkhead (fun fun) and discovered a fully equipped machine shop.

          Screw a server, we're talking probably a quarter million dollars in equipment, given how the military does busi

  • by Brad Mace ( 624801 ) on Friday September 05, 2003 @02:20AM (#6877160) Homepage
    Customs has been advised that the servers did not contain personal, business-related or national security information.

    Really? Then what the hell were they for?

    They say

    "They would have personal internal email accounts, probably the passwords for those accounts, and any information harboured within them.

    hmm. 'personal email' sounds like personal information, and probably business and security related too. But then say:

    The Australian Customs Service has admitted the security blunder, but told customs officers in an email that no sensitive operational information was lost.

    So I guess they're just using their mainframes to advertise penis enlargement pills

    "Customs officers use the accounts to communicate volumes of sensitive operational material and intelligence to each other, including information from other agencies such as AFP and ASIO. This would be at risk."

    I give up.

  • by insecuritiez ( 606865 ) on Friday September 05, 2003 @02:21AM (#6877163)
    I hate to give MS any credit, but even they figured that one out. Check out their Ten Immutable Laws of Security [microsoft.com]. -- "Law #3: If a bad guy has unrestricted physical access to your computer, its not your computer anymore."
  • by Mulletproof ( 513805 ) on Friday September 05, 2003 @02:26AM (#6877175) Homepage Journal
    Imagine a beowolf cluster of-- FUCK, they're gone!!!!/I>
  • by fwc ( 168330 ) on Friday September 05, 2003 @02:41AM (#6877224)
    The tech guy didn't just replace them [mplug.org] with one of IBM's linux servers?

    (Google for heist60.mpeg if above if slashdotted)

  • by klevin ( 11545 ) on Friday September 05, 2003 @02:42AM (#6877231) Homepage Journal
    If, as described, they were actual mainframes, the Customs people's statement that no sensitive info was lost/stolen might not be too far from the truth. In servers & other high end systems, it's not uncommon for the hard drives in the computer to contain only the OS & applications. The data used/created by the applications would be on a RAID attached to the computer. If that was the setup of the systems, the only actual data would system passwords and possibly temp data currently in use at the time of shutdown.

    If, however, one or more of the systems was a RAID or some such data storage system, then the Custom's people are (as expected) lying through their teeth. The next question would be whether or not some form of encryption was in use (fs or application level).
  • by pyrrho ( 167252 ) on Friday September 05, 2003 @03:08AM (#6877320) Journal
    It's just been replaced by this little linux server over here.
  • by harlows_monkeys ( 106428 ) on Friday September 05, 2003 @03:18AM (#6877354) Homepage
    Repo men can do amazing things. I worked once at a small Unix workstation company in the early 80's (Callan Data Systems, if anyone remembers them). We were having some financial trouble, and our blueprint machine was repossesed. That thing was huge...about the size of a small piano (acoustic, not digital).

    It was in a central room, which had one door and no windows. The door opened to a hallway. From that hallway, you could either go out past the receptionist, past one of the company founder's office, to get out the front door, or you could go the other way, past my office, and the offices of a couple other programmers.

    We noticed the machine missing at noon. It had last been used at 11am. Between that time, the receptionist had been on duty, the founder had been at work in his office with the door open, and four programmers had been at work with their doors open, facing the hallway.

    There had been the usual bathroom breaks, trips to the printer, and stuff like that, but still...it seems like it would require amazing timing to find an opportunity in there to sneak the thing out...and there was no vantage point outside the building from which one could see that the route would be clear.

  • Heh... (Score:5, Funny)

    by BJH ( 11355 ) on Friday September 05, 2003 @03:22AM (#6877369)
    This reminds me of a story...

    I live and work in a certain large Far Eastern city, which has quite a few major financial institutions.
    Several of these institutions use Sun hardware.
    One of these institutions found that on Monday morning, their production system didn't work.
    A bit more investigation found that the CPUs (8, IIRC) had all been removed. Apparently, someone walked in over the weekend and then walked out with several thousand dollars worth of UltraSPARC IIs under his arm.
    They made a bit of fuss about this, boosted their security, and bought a bunch of new CPUs.

    Then, a couple of months later, they found that their production system wasn't working on a Monday morning...
  • Three words (Score:3, Funny)

    by Erik Hensema ( 12898 ) on Friday September 05, 2003 @04:49AM (#6877600) Homepage
    Encrypted root filesystem.
  • by shippo ( 166521 ) on Friday September 05, 2003 @05:20AM (#6877711)
    At a previous employer, one of our customers had their main Netware server stolen during the working day.

    Two men dressed as couriers wandered into the reception, said that had a faulty machine to pick up, were let into the machine room, and walked out with the 3000 file server.

    It took the network admin over an hour to realise that the server had been taken - they had even logged a fault call with us stating that users were having problems accessing their data.
  • ROFL (Score:5, Interesting)

    by Bruha ( 412869 ) on Friday September 05, 2003 @06:25AM (#6877894) Homepage Journal
    Reminds me of that ATM machine that was stolen from Snow Hall on military base, they didnt find it for 2 years until a long dry spell let a pond get real low.

    For those that dont know Snow Hall is a tech training center and has 24 hour security and video cameras. The machine was quite large and bolted to the floor and since it was the day before payday it was full also. 250k was in it I believe.

    Only bank robbers I know of that got away with it AFAIK.
  • by Badgerman ( 19207 ) on Friday September 05, 2003 @07:04AM (#6878025)
    They presented themselves to the security desk as technicians sent by Electronic Data Systems, the outsourced customs computer services provider which regularly sends people to work on computers after normal office hours.

    Another reason you should be damn careful about how you outsource, who you outsource with, and the security involved. People need to know who they're really dealing with and how to check.
  • by eaddict ( 148006 ) on Friday September 05, 2003 @10:26AM (#6879898)
    When I was in college I worked for the computer lab. One day we set out to upgrade all the PCs. What we had to do first was get the old ones out of the way. We backed an unmarked white van up to the computer lab, opened the doors to the lab, and started taking the machines. It was during a school day. Students and faculty were walking by watching us. Occasionally one would even lend a hand (hold a door open a bit more, pick up a dropped mouse, etc... ) No one questioned us. Not even the student worker running the lab. We had not even made conversation with the worker during the entire time. After we loaded up the 20+ PCs and headed out our boss decided to call the lab and 'warn them against people stealing PCs'. The worker freaked! He said he was there when it was happening but since "they looked like they knew what they were doing so I didn't question them." The boss then let him in on the real story.

    The key: just look like you know what you are doing.

"An idealist is one who, on noticing that a rose smells better than a cabbage, concludes that it will also make better soup." - H.L. Mencken

Working...