I asked a contractor to run and install some new fiber cables.
They did, but 2 slight problems:
No connectors and no cable labels. whoops!
Found a box with Conficker running internal. Had several hours of meetings over a couple days trying to explain that no, applying the patch for MS08-067 was not enough.
Finally convinced them to go into Incidence Response mode.
Learned later the whole network was full of cryptominers.
What joy!
I had to MiTM an endpoint with a self signed cert and ended up snagging the credentials for an admin user.
Their password? {Boss’sFirstName}IsaDoucheBag0
Yeah, real secure password too ! (but funny)
I once did 6 hours of forensics on myself trying to figure out how I got hacked, after finding a second sshd spawning from inetd on port 666.
Turns out, I'd installed it myself years earlier as a backstop for failed ssh upgrades & forgotten I did so. DUH!
