IBC
Thu Feb 12 11:36:17 CST 2004
Far to little information here for even a lawyer to give you a clear answer.
From your post, it seems clear that your firm installed servers at & for
another firm ('firm a' from here out) and have a service contract in
maintaining them. "Firm A" seems to have hired another consultant ('firm b')
for another reason. (could have been to install proprietary software, an
accounting system, etc.)
What happens from here is completely unclear, but I'll assume the owner gave
them physical access to the machine. Its the owner's right to do so. If
"firm b" cracked your passwords with the owners knowledge to complete an
install then what they did is unethical, but not necessarily illegal.
Ideally, you would have had boot from flopp/CD disabled and the machine
locked so getting anything changed on it would be difficult at best. I think
you learned a cheap lesson in security at this point.
I'd take a couple deep breaths, survey for any ACTUAL damage and if there
isn't any proceed with discussing with your client the problem and danger of
letting somebody run cracking software on the network. I'd also reset all
passwords to something new and potentially rename important accounts.
"Mark Mancini" <info@NOSPAMmcse2000.com> wrote in message
news:OW#gwsR8DHA.2044@TK2MSFTNGP10.phx.gbl...
> Well, the Libertarian in me is going to come out (I'm in IT, not law
> though!). First, someone not in your company was able to access a server
> and put in a CD. I think you first need to look in the mirror. If you
have
> the ability for someone that is NOT supposed to touch a server to do so
and
> thus change the password then you first need to take some responsibility
and
> realize that YOU left the security breach. If this person was an IT guy
> hired by your company and he did this to do his job then you need to let
it
> rest. If this was some guy off the street then yes, this would be illegal
> but again....why was he able to do it. If you hire a consultant (and I
> think this is what happened) and you don't define what he can an can't do
> and you hand over your server to him then you would have to prove then he
> intended to be malicious. So, we would need more info on "this guy" and
> what his role is. Not looking over what he is doing and asking him what
he
> is doing is the responsibility of the person hiring him. My 2 cents....
>
> --
> Sincerely,
> Mark Mancini, CCA, CCNA, Master CIW&CI, CNE 4&5, MCSE+I 4&2000
> www.MCSE2000.com
> www.AppLauncher.com
>
>
>
> "James" <anonymous@discussions.microsoft.com> wrote in message
> news:ede301c3f0fa$78e54f10$a401280a@phx.gbl...
> > I have a server at a job site that my company installed
> > and is maintaining and someone not in our company used a
> > Password recovery CD to change all our password on our
> > servers. I need to know if what they did can be called
> > Illegael by Microsoft or criminal. We know who did it
> > and outside company.
>
>