Hacker News Reader

Comment by coffeebeanHH | Hacker News Reader

That's teaching people to lock their machines on leaving the desk.

Could also be a thing like redefining while with if.

Just one thing should aways occur. Tell the people what you messed up after they got confused. Pranks should not be harmful.

View on HN

There is a OPSEC fairy at work who will rotate your desktop 90 or 180 degrees or some other benign reminder that you failed to secure your workstation before leaving your desk.

We would send a mail from their pc to the whole team with a text along the lines of "Hey together, I will buy croissants for everyone tomorrow."

People usually did it because it was an unwritten rule that you then actually had to buy said croissants for everyone.

see, now that's more like it -- croissant supply pranks I can get behind; meddling (however slight) with tools, not so much.

Well, we had both extremes, just to disclose that.

The mild version was promising croissants with another mail account, but I also once came back to see that my wallpaper had been changed to a still from a gay porn movie. I think my visible confusion and slight shock was quite entertaining.

Of course the second prank can only be done with co-workers you know well, otherwise you could probably end up having to talk to HR.

Secure from what? Do you have random people walking around your office?

I've worked in offices big enough that the people who worked upstairs looked were total strangers to me. Social engineering into a building is often not that hard.

For anyone who reads this and think it's funny, it is, but do this in the wrong workplace and you'll be the unemployed OPSEC fairy.

If someone is in OPSEC they generally have a broad license to actually, you know, do their job.

The "OPSEC fairy" as referenced in previous post is typically a random coworker, so no, they generally not have a broad license do tinker with your workstation.

An actual OPSEC person would not go and change your desktop's background, or send an email for free donuts to all your coworkers. An actual OPSEC person would just write you up for a security violation.

People did something similar to this at my previous job and I always thought it was security theatre. For one thing, there are card swipe in. Second, engineering was upstairs in a restricted area. So you're concerned about a tailgater who opportunistically puts malware on your laptop when you're 100 feet away for a couple minutes without anyone noticing? Or you're concerned about a colleague who's an insider threat... Who is already an insider threat? It's not like there was anything on my laptop which was more sensitive than any other engineer there anyway. It was classic busywork.

It's often easier to build a norm for everyone than just the people it really needs to apply to. Managers, salespeople, corp dev, customer representatives all might have sensitive information on their machines. Information that even other employees aren't supposed to see. Rather than trying to enumerate who those people are and teach them, you might assume everyone will eventually have sensitive information, and encourage the mild prank.

> That's teaching people to lock their machines on leaving the desk.

No, that’s being a dick. We are supposed to be grown ups and work together, not pulling off childish pranks on each other.

Who said you're working or grown ups? It's a great prank for college students as well.

Well, we've had a rule between grown ups at some places I worked at that whenever someone left a machine unlocked a minor prank was acceptable and even encouraged.

Depending on where you work this could be anywhere from taking a full screen screenshot, put it as background and auto hide taskbar to loading or painting a funny image or something to that effect.

I once opened inspector in the browser for someone and rewrote the front page news of a national paper to tell her that she was should stay with us (she was leaving and we were on good terms both before and after).

Most of the places I've worked at have had a their own theme for what your desktop background should be set at. One place it was Justin Bieber. Another it was a footballer. It was never anything offensive but still generated a laugh whenever anyone came back and realised they'd been "beibered".

I've had my personal computer's background be this picture for about 5 years now, since I forgot to lock it once, and just haven't bothered to change it

https://www.google.com/url?sa=i&url=https%3A%2F%2Fwww.reddit...

The solution is obviously to use a tiling WM with all default keybindings changed, and a keyboard with blank keycaps and obscure non-QWERTY layout.

That's almost exactly the setup of someone I used to work with. Used i3, blank keycaps on a 60%-keyboard and Dvorak-layout.

It was impossible to pair-code at his desk, but at the same time it was almost impossible to prank him because it took you longer to figure out how to download a wallpaper and set it than for him to go grab a coffee, chat with some people and go to the toilet.

That's what you bring a usb keyboard for.

Isn't the kb-layout handled by the OS, and not the keyboard itself?

But you'd be able to bring one with the proper layout and without blank keycaps. Or one able to remap in the keyboard.

> Isn't the kb-layout handled by the OS, and not the keyboard itself?

The OS can remap a traditional layout for you, but a lot of keyboards can store a configured layout that is used when determining which keycodes to send. Chances are pretty good, given the described setup, that they were probably using a keyboard that managed its own layout.

Could be, yeah. I know that his kb had some tiny switches on the underside to configure some things, so you're probably right.

I hope you enjoy reverse-engineering the three-way handshake through vendor/product-IDs in the QMK firmware to activate the HID.

Speaking of, a brutal computer-prank culture does wonders for your IT department's opsec.

In which case you bring another computer, and if necessary another monitor and replace the real one. There's always a way if you truly want to.

Of course, I guess this is how you do end up with a paranoid IT department.

I was the first person in the office every morning, and my co-admin was the last one out every day. On April Fools Day 2014, I came in to find my desk, chair, monitors, keyboard, and mouse wrapped in bubble wrap. Several layers, taped with clear shipping tape. The night before he and our sales engineer had stayed late and wrapped it all. They also taped a terminator pic over the red laser on my mouse.

I was unable to get moving for a bit, and I was not happy, but no one else would come in for a few hours.

I knew his Windows password so I:

- turned his screen upside down with the background right side up

- Turned the logon background upside down

- changed his keyboard layout to Dvorak Southpaw

- disabled the login screen Lang/KB selector in registry

- as well as his taskbar volume control after turning it up

- set the mouse angle 30° to the right, since he used a trackball mouse.

- removed the knob from his speakers

I wrote a script to speak at intervals to annoy the fuck out of him throughout the morning, hid it, and ran it 30 minutes before he came in.

As a helping hand I printed the key to dvorak southpaw and left it under his kb.

    <script>
    Dim sapi
    Set sapi=CreateObject("sapi.spvoice")
    wscript.sleep 2700000
    sapi.Speak "Click"
    wscript.sleep 500
    sapi.Speak "This is halloween"
    wscript.sleep 510000
    sapi.Speak "auntie em, auntie em, it's a twister"
    wscript.sleep 480000
    sapi.Speak "no smoking"
    wscript.sleep 3000
    sapi.Speak "do good work no error"
    wscript.sleep 720000
    sapi.Speak "what did the lawyer say to the other laywer? we are both lawyers"
    wscript.sleep 480000
    sapi.Speak "yah moohlah baby"
    wscript.sleep 300000
    sapi.Speak "win ning"
    wscript.sleep 50
    sapi.Speak "ha ha ha"
    wscript.sleep 180000
    sapi.Speak "typing"
    wscript.sleep 840000
    sapi.Speak "I'm Rick James, biitch"
    wscript.sleep 50
    sapi.Speak "I was banging twenty gram rocks cause that's how I roll"
    wscript.sleep 240000
    sapi.Speak "nullified depolarized phooey"
    wscript.sleep 653891
    sapi.Speak "insurmountable fractionate fast"
    wscript.sleep 15000
    sapi.Speak "you are, fired"
    wscript.sleep 120000
    sapi.Speak "The same thing we do every night pinky, try to take over the world"
    wscript.sleep 300000
    sapi.Speak "get Back to work"
    wscript.sleep 840000
    sapi.Speak "I'm sorry dave, I'm afraid I can't let you do that."
    wscript.sleep 50000
    sapi.Speak "click"
    wscript.sleep 360000
    sapi.Speak "touch me"
    wscript.sleep 180000
    sapi.Speak "sweat, baby sweat, baby sex is a texas drought"
    wscript.sleep 540000
    sapi.Speak "ba dah ba ba ba. I'm loving it"
    wscript.sleep 420000
    sapi.Speak "I wish you would upgrade me to Windows 8"
    wscript.sleep 60000
    sapi.Speak "leh go"
    wscript.sleep 480000
    sapi.Speak "science biitch"
    wscript.sleep 30000
    sapi.Speak "can you hear me?"
    wscript.sleep 15000
    sapi.Speak "Do you get it yet?"
    wscript.sleep 90000
    sapi.Speak "quoth the raven, never more"
    wscript.sleep 1000
    sapi.Speak "ha ha ha ha ha"
    wscript.sleep 500
    sapi.Speak "I think you are getting the idea here."
    wscript.sleep 50
    sapi.Speak "I got you, April Fools"
    wscript.sleep 50
    sapi.Speak "April Fools"
    wscript.sleep 50
    sapi.Speak "April Fools"
    wscript.sleep 50
    sapi.Speak "April Fools"
    wscript.sleep 50
    sapi.Speak "April Fools"
    wscript.sleep 50
    sapi.Speak "April Fools"
    wscript.sleep 50
    sapi.Speak "April Fools"

This sounds like great revenge and I enjoyed reading your comment :D

However, something took me by surprise,

> I knew his Windows password

This is...strange?

It was a very very small shop (3 in IT, 2 in Accounting, 2 in Sales, 4 in Billing, and the Owner) owned by a dude in his late eighties. He made his son CTO and he set all the infosec policies, until his dad let him go because my co-admin and I convinced him that our practices were bad and outdated.

His health started declining and he got more nervous about changing things and losing control until he passed. So while we were modernizing the server room to virtualize and containerize servers (his son had every service running on its own late 90s/early 00s machine), he didn't want to have his cheese moved (ironically, he made every new employee read Who Moved My Cheese). That included the password to his son's Domain Admin account, which he used to log in to a few things and was the only Domain Admin account he wanted on the network. My co-admin was required to use this account to manage many things and often left his PC locked on that account.

His son inherited the business after he passed and put a freeze on any more changes to "his" network, so our hands were tied until I left.

My coworker and I were both in our early 20s and were naïve to say the least.

> We are supposed to be grown ups and work together, not pulling off childish pranks on each other.

Uhm... no.

I want to work with people who don’t have a stick up their ass. I would find this hilarious.

good luck!

Sure. That’s always great. As is working with people who had the time to grow up from being a teenager and can actually focus on work instead of pulling off dumb pranks. What is it with some who need to mess with other’s work equipment? Find a better way to satisfy your inner child.

I don’t think we will be working together

Dwight is that you?

The standard way, where i worked for, was to invite whole department/company (depending on size) to a beer. And we held them to it.

Where I worked before it was normal to send resignation mail to $manager of user.

more modern day is to make asinine posts on whatever social platform user left open

Reply on news.ycombinator.com