Tech warning - Norton Password Manager breached

[Nosferatu]

I opened a test email like that once, while I worked with a bunch of networking and security people. As a developer. I didn't click on anything, and all that happened was I got an email from security saying that was a test and don't open stuff like that. My boss never said anything. But I felt like a complete idiot. I totally knew better.

We have a SQL dev that we need to keep on a short leash because we found an app he 'developed' that used plain-text passwords. Yes, it was available to the outside.

 

[TTSX]

I opened a test email like that once, while I worked with a bunch of networking and security people. As a developer. I didn't click on anything, and all that happened was I got an email from security saying that was a test and don't open stuff like that. My boss never said anything. But I felt like a complete idiot. I totally knew better.

One of those was the very first email I received on my company account. The VERY FIRST. And it says it was from HR so of course I clicked on it. Then immediately I get a message saying I wasn't supposed to click on that for reasons. A few minutes later I get the "training" I was supposed to get beforehand. Now I don't open any of their emails because they poisoned the well on day one. Phone calls only if I see someone tried to contact me.

 

[Flopsweat]

One of those was the very first email I received on my company account. The VERY FIRST. And it says it was from HR so of course I clicked on it. Then immediately I get a message saying I wasn't supposed to click on that for reasons. A few minutes later I get the "training" I was supposed to get beforehand. Now I don't open any of their emails because they poisoned the well on day one. Phone calls only if I see someone tried to contact me.

"So, tell us why you're leaving the company so soon"...

 

[Nosferatu]

One of those was the very first email I received on my company account. The VERY FIRST. And it says it was from HR so of course I clicked on it. Then immediately I get a message saying I wasn't supposed to click on that for reasons. A few minutes later I get the "training" I was supposed to get beforehand. Now I don't open any of their emails because they poisoned the well on day one. Phone calls only if I see someone tried to contact me.

That sucks!

I just made a note to check ours on Monday. We automatically enroll new users in a training campaign, but we also have a continuous testing campaign that I'm pretty sure they get tossed into as well.

I'll probably need to modify it so any accounts under 30 days old don't get tossed into the testing campaign.

Thanks!

 

[lucusloc]

Ugh...don't even get me started on Providence. You'd think with the money they have they could sink a bit more into data connectors that effing work most the time.

We have a health clinic that relies on parts of Providences' systems. Unreliable is being polite.

That is the worst. I hate it when I know what the problem is but am powerless to fix it. All you can do is send off another email asking "please fix" or "what is the status of that fix?" or "can I just please talk to the guy who can actually fix this, not some middleman who may or may not be relaying my problems accurately?"

The worst part is when you actually do get through to the engineer who can fix your problem and you spend five minutes on the phone with them and the problem is solved. You mean I just spent 2 months chasing bureaucracy only to walk thorough a 5 minute configuration change that the engineer in charge knew about but never fixed because he didn't think anyone was impacted?! My kingdom to be made admin of everything. I'll do it myself.

 

[Nosferatu]

That is the worst. I hate it when I know what the problem is but am powerless to fix it. All you can do is send off another email asking "please fix" or "what is the status of that fix?" or "can I just please talk to the guy who can actually fix this, not some middleman who may or may not be relaying my problems accurately?"

The worst part is when you actually do get through to the engineer who can fix your problem and you spend five minutes on the phone with them and the problem is solved. You mean I just spent 2 months chasing bureaucracy only to walk thorough a 5 minute configuration change that the engineer in charge knew about but never fixed because he didn't think anyone was impacted?! My kingdom to be made admin of everything. I'll do it myself.

We've had that phone call numerous times with them. Every switch and firewall update they install breaks it.

Luckily, we hired a new guy a couple months ago. Providence is his problem now!

 

[TTSX]

We've had that phone call numerous times with them. Every switch and firewall update they install breaks it.

Luckily, we hired a new guy a couple months ago. Providence is his problem now!

Hahaha SUCKER

 

[lucusloc]

One of those was the very first email I received on my company account. The VERY FIRST. And it says it was from HR so of course I clicked on it. Then immediately I get a message saying I wasn't supposed to click on that for reasons. A few minutes later I get the "training" I was supposed to get beforehand. Now I don't open any of their emails because they poisoned the well on day one. Phone calls only if I see someone tried to contact me.

Yeah, I really don't want to do that to any of my users. That can be a really hard thing to un-train. And then they get even more "creative" with work processes because they got burned on one I had set up for them.

I swear, I don't actually expect you to know all this stuff, but I need you to know all this stuff so you stop creating new gaps in our infrastructure! It's either that or I have to lock down literally everything and you only get to do work if you ask specific permission to do it.

Or to paraphrase the old adage; I can make a perfectly secure system, until you tell me I have to let someone else use it.

 

[lucusloc]

We've had that phone call numerous times with them. Every switch and firewall update they install breaks it.

Luckily, we hired a new guy a couple months ago. Providence is his problem now!

I love hiring new monkeys! My problem is they always learn stuff and then graduate from being a monkey to a colleague and then I feel guilty about giving them all my trash. And eventually HR wises up and puts the kibosh on hiring new monkeys and I don't have the excuse of foisting off a "learning experience" to them anymore. Problems are infinite, pawns are not

 

[Nosferatu]

I love hiring new monkeys! My problem is they always learn stuff and then graduate from being a monkey to a colleague and then I feel guilty about giving them all my trash. And eventually HR wises up and puts the kibosh on hiring new monkeys and I don't have the excuse of foisting off a "learning experience" to them anymore. Problems are infinite, pawns are not

We don't have much turnover here so it's pretty rare we get a FNG. I have the highest seniority and get to decide who does what at this point. (more like decide what I don't do!) My focus needs to be on engineering projects, so I'm handing off all the support and helpdesk escalation stuff.

 

[Alexx1401]

As an update the sibling of Wife did get the money back. Bank put all of it back and are going to go after the scum, who it turns out lives only a few miles from us, not in another state as first thought. In any case I told Wife her sister should consider herself lucky, VERY lucky that it was at worst a good fright. Hopefully she learned something from this close call.

 

[Flopsweat]

As an update the sibling of Wife did get the money back. Bank put all of it back and are going to go after the scum, who it turns out lives only a few miles from us, not in another state as first thought. In any case I told Wife her sister should consider herself lucky, VERY lucky that it was at worst a good fright. Hopefully she learned something from this close call.

That's a fantastic outcome. I hope they come down on the thief with both feet.

 

[Benchrest]

Why would anyone, with 1/2 1/4 1/8 1/9,427th of a working brain, use a password manager?

There's no way people can be this stupid - oh wait, they made a movie...

 

[Paolung]

Gen Digital, formerly Symantec Corporation and NortonLifeLock, informed its customers that threat actors have breached Norton Password Manager accounts in credential-stuffing attacks. The company detected an unusually large volume of failed logins to customer accounts on December 12, 2022, and launched an investigation to determine what has happened.

NortonLifeLock: threat actors breached Norton Password Manager accounts

Gen Digital, formerly Symantec Corporation and NortonLifeLock, warns that hackers breached Norton Password Manager accounts.

securityaffairs.com

 

[Paolung]

Why would anyone, with 1/2 1/4 1/8 1/9,427th of a working brain, use a password manager?

There's no way people can be this stupid - oh wait, they made a movie...

I have worked in I.T. for over a decade. I use them, my company uses them, and a lot of really smart people I know use them. The key is to use them correctly.

 

[Alexx1401]

That's a fantastic outcome. I hope they come down on the thief with both feet.

Since some bank has to eat the cost of the stolen I have to "guess" this is going to be a Federal "thing"? If so that would be nice. State of WA loves criminal scum but hopefully the Fed's may still not be into lets all hug the scum.

 

[ATCclears]

 

[PiratePast40]

View attachment 1875201

I hear ya, some IT types can get to be pretty passive aggressive.

 

[Tony617]

I have been using Oracle Databases for years and there used to a default user of "scott" with a password of "tiger".

https://community.spiceworks.com/t/...iger-the-default-login-pass-for-oracle/329758

 

[Provincial]

My, how deeply is the Deep State entwined with Big Tech! Not surprised.

BTW, Oracle is advertising a new product where your put all you business information in and it "manages" it for you!