Computers
Study: 88% of IT Pros Would Steal Passwords or Data if Fired
Posted by John Mahoney at 11:00 PM on September 2, 2008
If you needed another reason to keep your sysadmins happy: Out of 300 IT pros polled by security company Cyber Ark, 88% said they would steal sensitive data or futz with master login passwords if they happened to be fired. Granted, this is a study publicised by a company that offers services to protect networks against internal rogue operators, but the more data like this that comes out, the nicer our brave IT managers are likely to be treated. Or, the more ridiculous security barriers will be put in place to keep the good ones from easily doing their jobs--one or the other. So perhaps we should have our own informal comment survey--IT dudes: Would you go 21st century postal on your employers if you were let go? [Ars Technica, Image: shearforce]

Comments (AU Comments · US Comments)
Quazi
Posted September 3, 2008 8:37 AM
Punch they guy who fired me? Probably... Mess with passwords, unlikely... Steal data, definitely :)
Joseph
Posted 11:21 PM 2/9/08
We should all just go back to peer-to-peer networks! Everyone is their own IT guy, then no one will screw themselves over.
Joseph
TheWhiteEwok
Posted 11:17 PM 2/9/08
No - if they are stupid enough to fire me they would hurt more than if I was to foobar some pw's or admin what'not.
TheWhiteEwok
Tastic7
Posted 11:15 PM 2/9/08
If it's a revenge thing or something that's just going to piss off a bunch of people, then no.
And if I ever planned on doing it for some other reason, I probably wouldn't admit to it on the Internet.
Tastic7
Mr.DuckSauce
Posted 11:14 PM 2/9/08
If I worked hard at the company and they just fire me without warning then yes, I would.
Mr.DuckSauce
sgt_sm00th
Posted 11:13 PM 2/9/08
already happened in my company (obviously not by me, since I still work here)
sgt_sm00th
Anubis LG
Posted 11:13 PM 2/9/08
I'd shutdown all the software that I've programmed for them, soooo YUP!
Anubis LG
GirlGadget
Posted 11:12 PM 2/9/08
Nope. I've got a good boss. If I were to be fired, it would be because I deserved it or because he had to. If he had no choice, I'd get a nice severance. I've seen how well fired employees are treated.
I've got a hell of a job, an understanding and flexible boss and good coworkers. I wouldn't want to screw with them.
GirlGadget
OMG! Ponies!
Posted 11:11 PM 2/9/08
Study: 88% of companies hired the wrong kind of person to do IT
OMG! Ponies!
DashTheHand
Posted 11:10 PM 2/9/08
Yup.
And @CCNA1AB: Don't get caught then.
DashTheHand
lodleader
Posted 11:10 PM 2/9/08
the guy in CA was a douche...
lodleader
bobojuice
Posted 11:10 PM 2/9/08
too lazy
bobojuice
CCNA1AB
Posted 11:09 PM 2/9/08
Why bother? I dont want to end up like the guy in CA.
CCNA1AB
lodleader
Posted 11:08 PM 2/9/08
have
lodleader
fleebailey33
Posted 11:08 PM 2/9/08
100%
fleebailey33
dzazter
Posted 11:05 PM 2/9/08
You betcha.
dzazter
pj_rage
Posted 11:41 PM 2/9/08
Isn't doing so a punishable crime? I doubt any right-minded person would want that - especially at a time in their lives where they really don't need anymore problems to deal with (that is, besides looking for a new job). Probably doesn't look good for future job recommendations either..
My bet is that alot of people say they would, but actually wouldn't when it came down to it.
pj_rage
DarkHavoc99
Posted 11:26 PM 2/9/08
Naw this happened to someone I use to work with already. Made a shi-ton of work for the rest of us. I dont know If I would do that to my coworkers.
DarkHavoc99
Improbus
Posted 11:59 PM 2/9/08
Our company network and infrastructure is so decrepit (because our management team is CHEAP) that if my co-workers and I were fired the company IT systems would fall apart all by themselves.
Improbus
hackersg
Posted 11:57 PM 2/9/08
I can't copy anything, we use ScriptLogic File System Auditor, and reports are ran on our user ID's on a daily basis.
Anything copied / deleted / moved is reported.
We've had a few incidents where people were accessing stuff they shouldn't have been, so now people with high end access gets audited every day.
I think if a company can be taken down by one disgruntled IT guy, they are idiots for letting it happen.
hackersg
mhlaxp
Posted 11:50 PM 2/9/08
Doesn't everyone just keep a copy of anything they might need on an ironkey anyway? Not saying I'd do anything with it were I actually a sysadmin, but I'd probably keep a copy so after being fired I could complain loudly about how I could bring them to their knees.
mhlaxp
hackersg
Posted 11:48 PM 2/9/08
I don't know about where some of you guys work, but all my access would be turned off before i even knew i was getting fired.
We have what you call, good security.
I know there is a lot of places that have the same passwords for 6 years, but we change ours bi-monthly and also in any case where someone leaves/gets fired.
Would i do it if i could get away with it? No. It could come back and haunt you down the road.
hackersg
middy
Posted 11:47 PM 2/9/08
Hell no. I've got these old fashioned things called scruples. It seems they're not available anymore.
I consider my unbridled access to data a privilege, and I consider it my duty to protect its integrity and confidentiality no matter what my relationship is with its owner.
middy
Curves
Posted 11:47 PM 2/9/08
Nope, its petty. More fun to NOT mess anything up and hear from former co-workers about all the searching they do FOR some revenge-bomb and cant find it. If they cant find anything, it lets them think you are either: 1-a genius for hiding it so well or 2-lets them worry a lot longer that something is delayed and will pop up in the future. Remember that the best revenge is living well. Go on with your life to a better job with a clear conscience.
Curves
icelight
Posted 11:45 PM 2/9/08
This isn't a good reason to start treating IT managers better. No one, in any position, should be fired without cause, but even if they are, that is no moral or legal excuse to harm someone else. And make no mistake, it would be other people one would harm, not some faceless entity representing "the man." A layoff do to "corporate restructuring" or a firing due to poor performance or other justified reason is acceptable for the other 99% of the workforce. IT workers do not form any special class, nor should they have any special privileges merely because they work in a specialty incomprehensible to outsides, nor because their actions don't appear to harm anyone. This is no different than an accountant who siphons corporate money into a private slush fund and then takes it with them when they are forced to leave.
What this sounds like is an excellent cause to start teaching mandatory ethics courses in CS programs at all universities. Such widespread malevolence (and make no mistake, that's exactly what it is) screams that there is a massive cultural disconnect, and I'm going to venture out on a limb and say that the side committing crimes is in the wrong. The fact that Gizmodo, on more than one occasion, has reflexively sided with the crime-committing culprit only shows just how pervasive this is. The fact that they've had to go back on more than one occasion to "revise" their position demonstrates that such actions are never justified.
icelight
PDSM
Posted 12:19 AM 3/9/08
Whats great about being in IT is you can get a job next week.
Plus its more fun just to email everyone salary ;)
PDSM
mrafternoon
Posted 12:19 AM 3/9/08
i wasn't fired, but had such contempt for my old boss that upon my last day, i loaded a simple .exe shutdown script on his desktop, and changed the icon to the inernet explorer icon. nothing too damaging, but just a litte "F U" to 'tha man'.
mrafternoon
MePerson
Posted 12:18 AM 3/9/08
I'd pull the old "desktop screen shot/set as background" trick on all of the computers.
MePerson
ZillionDollarSadist
Posted 12:12 AM 3/9/08
I would not. I did, however, take a screenshot of the former IT chief's KaZaA folder (found on an abandoned PC) and post it on a forum to give my friends a laugh.
Oh, and the folder contained mpeg's named such as "shemale samba mania" and "bodybuilder".
ZillionDollarSadist
Kayway8
Posted 12:12 AM 3/9/08
@Joseph:
I wouldn't say that, there are many people who screw them selves over all the time, even when not drunk.
Kayway8
Zarian
Posted 12:39 AM 3/9/08
Yes because people love getting sued.
I'd rather call people douche bags then fuck with sensitive company data that would get me in trouble.
Zarian
dufus
Posted 12:35 AM 3/9/08
I do the complete opposite.
After any job I leave (either cus I was laid-off or I just moved on) I write a letter with all of my login and password knowledge and give it to my boss. I write in the letter that they have been given specific instructions to change my passwords or disable my logins.
That way, if any of the systems have any problems at all, they can't blame me.
dufus
Ayeco
Posted 12:31 AM 3/9/08
I'd be curious to see what the percentage of non-IT pros would do - not passwords per say, but at least some type of data. As an IT guy, I'd imagine that it would actually be higher. A firing is a firing and a lot of people aren't very happy when they are let go.
Ayeco
Lodril
Posted 12:28 AM 3/9/08
What better way to say to your next employer, 'I deserved to get fired' than an unprofessional and petty revenge on your former co-workers? It really pads out a resume. I say go for it, IT geeks. What've you got to lose?
Lodril
strider_mt2k
Posted 12:28 AM 3/9/08
I just left well enough alone.
Within a month they had to call a guy in, the daffy bastards were so clueless.
Good times! :D
strider_mt2k
reddingofish
Posted 12:23 AM 3/9/08
I heard a story about a UNIX admin who got mad and quit. on his last day he did rem \.
It took them 20 minutes to figure out what he had done.
reddingofish
isgrimner
Posted 12:22 AM 3/9/08
I wouldn't do it for a few reasons. First, like Middy already mentioned, there is such a thing as scruples.
Two it would affect a lot of good people that I work with.
I'm a Net Admin for a lawfirm and hard as it may be to believe, not all lawyers are scum. The lawyers and staff I work with are generally pretty laid back and generous. Though from what I understand our work culture is very different from other firms.
For me to get fired, I think it would take me doing something extreamly stupid. I don't plan on doing stupid things, so I doubt that would happen. Another possible reason would be economics, but unfortunately people like to open lawsuits, so we generally aren't affected by the same factors that hit the general job markets.
Why would I want to burn a bridge? By doing some childish revenge act, you ruin any relationships you have there. There would also be legal recourse against you.
isgrimner
slibville
Posted 12:59 AM 3/9/08
I demand to see this study's methodology. 88% seems beyond ridiculous, swinging all the way into the Union of Batshit Lolwut Crazypeople Land. It also depends on what the upper management considers "sensitive information".
slibville
phorty40
Posted 12:57 AM 3/9/08
Only if i was legitamately screwed over.
phorty40
LastGunslinger
Posted 12:47 AM 3/9/08
No, I wouldn't mess with anything. My company has treated me well and I wouldn't do something petty that would hurt my chances of finding a new job.
LastGunslinger
clarkjw
Posted 12:45 AM 3/9/08
There is a diff between taking the data and exploiting it. If you get fired with a nice severence, no need to pull that card.
clarkjw
godwhacker
Posted 1:16 AM 3/9/08
at our joint, they run thru IT staff so fast, i am suprised that no one has fubared the whole deal yet.
godwhacker
stryder100
Posted 1:16 AM 3/9/08
Nope, I would do no such thing. You'd inevitably hurt the wrong people. There are avenues of recourse for people who are unjustly terminated.
And it's just plain wrong.
OTOH - I guess there are some circumstances where I could see doing this - like if you worked for really bad guys like Nazis, KKK or Al-Qaeda. But then it'd be an act of war and not revenge.
stryder100
Makkuro
Posted 1:14 AM 3/9/08
No I wouldn't, nor most (if not all) of my colleagues. If you have any respect of your own professionalism you wouldn't try to steal or harm what you've been protecting. Not to mention it could cost your next job... (Unless the said I.T. manager is dumb enough to forget there is a thing called *reference check*... nowadays almost a requirement for any high-paid IT job.)
Makkuro
Null42
Posted 1:11 AM 3/9/08
I'd rather keep the possibility that another company would hire me. Ever.
Null42
SgtBeavis
Posted 1:06 AM 3/9/08
No, I would not. I've been laid off a couple of times and I've never done any damage to any system. However, when they call me three days later asking for passwords that they didn't bother to document, I charge out the ass to be a contractor.
SgtBeavis
Thanatos
Posted 1:41 AM 3/9/08
Depend on how the company treated me. But most likely No.
Thanatos
Xavoc
Posted 1:39 AM 3/9/08
And I'm sorry to say, if you don't take security seriously in your company it is only a matter of time before this crap happens to you...
This is why you disable accounts before letting someone go, make sure that you have the passwords to equipment before you do so.
Xavoc
Xavoc
Posted 1:36 AM 3/9/08
Uhm, yeah... No. This is my job and the IT world is much smaller that you think it is. Such behavior will come back to haunt you. Hell, when I was laid off I remembered that I was the only person w/ a few passwords, so I sent them to my former co-worker.
I'd rather walk away from a bad situation as gracefully as possible.
Xavoc
SneakerFiend
Posted 1:36 AM 3/9/08
I dont think i would. I'd rather just misplace information on their servers but never sabotage the whole network....muahahhahaha
In all seriousness though i think that if i wasnt given a heads up i'd probably be an asshole and start misplacing important information. Besides that i wouldn't do nothing that would sabotage the company just something to remember me by. I mean i could just pass it off as being an error. And no i dont mean like company files i mean like OS files so you see the Blue Screen of Death x]
SneakerFiend
sgt_sm00th
Posted 1:31 AM 3/9/08
@DarkHavoc99: agreed
Basically, if you do this, your screwing over your co-workers just as much as your company. That was one shitty month of data recovery, password changes, and locking down everything.
sgt_sm00th
tabaks
Posted 1:30 AM 3/9/08
Definitely. IF deserved on their side. And that's a BIG IF!
tabaks
nutbastard
Posted 1:28 AM 3/9/08
@Rabid Penguin:
it's actually scary the lack of safeguards at my work - i could tank the database and the backups in about 10 minutes, which represents about 10 years worth of work.
nutbastard
tex1ntux
Posted 1:25 AM 3/9/08
I had to break into half a dozen Cisco routers after a former employee changed all the admin p/ws to combinations of my boss's name and various swear words.
...but I thought it was hilarious.
tex1ntux
nutbastard
Posted 1:25 AM 3/9/08
@Curves:
"More fun to NOT mess anything up and hear from former co-workers about all the searching they do FOR some revenge-bomb and cant find it."
ah, that reminds me of the old 4-pigs prank, wherein you get 3 pigs, and paint the number 1 on one of them, 2 on another, and 4 on the third one.
you then release the pigs in a non-pig-friendly area.
you get the idea ; )
nutbastard
Rabid Penguin
Posted 1:23 AM 3/9/08
I never have and never would. Of course the company I'm currently working at changes passwords all the time. Stealing a password would get me nowhere ;c)... well nowhere I wanted to go anyway.
Rabid Penguin
What The Geek
Posted 1:56 AM 3/9/08
Now, I'm a freelancer, so my situation is a little different than an in house IT professional, but I can honestly say that a customer would have to reeeeaaaaaalllllllllly piss me off before I'd steal their passwords, personal info, or data. More likely I'd just drop the client, and move on with my life. Maybe if I worked in an office and had dedicated a couple of years of my life to ensuring that the office's network ran smoothly I'd feel differently.
What The Geek
dmenafro
Posted 1:54 AM 3/9/08
If I got fired it would be a blessing in disguise. So no I wouldn't cause problems. Although I've never been fired...
dmenafro
mikeg916
Posted 1:52 AM 3/9/08
newsflash....
a company that specializes in security makes up statistics to try and sell their products to corporations....
imagine that....
mikeg916
likefry_likefry
Posted 1:50 AM 3/9/08
definitely. even if they changed the root pw, which they would be retarded not to, i have a photographic memory and remember logins and passes of almost everyone in the ny office.
likefry_likefry
freelunch
Posted 1:42 AM 3/9/08
I think the value of a good job reference would be better.
freelunch
OMG! Ponies!
Posted 1:42 AM 3/9/08
In general, you shouldn't burn any bridges career-wise. Gaps in your resume raise red flags. And if you don't offer your last job as a reference, your prospective employer will wonder why - and probably call to find out.
OMG! Ponies!
hypereric
Posted 2:21 AM 3/9/08
Working for someone else? Nope. But I did walk out with the servers, switches and router one day about three months ago from a business I owned 49% of (and the equipment was bought on my credit, as was practically everything else in that office).
If I had to do it over, I would do the same d@#mn thing, but this time, I wouldn't give the stuff back.
hypereric
twylight
Posted 2:14 AM 3/9/08
I think this is BS - You have to be very young and very dumb to do this.
1. You will go to jail. This is all federal level stuff.
2. IT is small industry - your rep is everything - you will never work again if you did this
3. Why? Go home and have a few beers, go get another job.
twylight
wizardofpants
Posted 2:06 AM 3/9/08
no cause i wouldn't be fired in the first place cause i do my job and i do it well.
wizardofpants
xint
Posted 2:02 AM 3/9/08
if the info is in my head, I dont know how that would be stealing............?
ROTFLMAO
xint
jswilson64
Posted 2:37 AM 3/9/08
No, but I'd start using all the credit card and identity information I've _already_ stolen from them...
;-)
jswilson64
FireBALL
Posted 2:34 AM 3/9/08
what happened to makedisk or format /u/a or format or zfs or simple demagnetizer? better still "step outside"...
FireBALL
rrwakc
Posted 2:23 AM 3/9/08
you can still steal the data, and not do anything with them (till the moment is right)
rrwakc
HellTempest
Posted 2:48 AM 3/9/08
Definitely. Just for a quick laugh.
HellTempest
Flugenhiber
Posted 3:12 AM 3/9/08
No - if I got fired it would be because either
A - I deserved it, or someone else can do it better, and therefore it's my own damn fault.
B - They're being idiots, and if the company's already run by idiots (that fired me) then let them sink - they're only hurting themselves.
C - I might screw with them anyway, but if I did, it would be to force them to rehire me - like, if they were almost ready to fire me, but all the guys under me couldn't really handle it and they were scared.... course, they'd probably quit when i get fired.
Flugenhiber
SSRPaulO
Posted 3:08 AM 3/9/08
No.
For those that would… Your integrity is the only thing no one can take away from you. It's a pity that you are willing to throw it away so casually.
SSRPaulO
iomegaman5
Posted 3:06 AM 3/9/08
Definitely, but i'd write a script to execute in 3 months or so and bury it deep with special permissions and no secondary logon. That way when the Fit hits the Shan they'll be begging for me back cause the new guy screwed up. Bigger salary! plus benefits! w00t!
iomegaman5
Blastfemur
Posted 3:05 AM 3/9/08
I might be tempted, but ultimately, ethics win over. I have a strong guilt reflex. I have already given them a book with instructions on how to maintain all of our systems, their common issues and how to resolve them, just in case I get hit by a bus. I could always change passwords and not update the sealed password list, but then they would just hire someone to hack them and nothing would be gained other than a stronger conviction on their part that they did the right thing by firing me.
Blastfemur
wills916
Posted 3:46 AM 3/9/08
I wouldn't, but know people that have. I'd say its more like 10%, if that, than 88%. IT guys are mostly all talk :)
Besides, I'd be on the phone lining up my unemployment benefits the rest of the day.
wills916
Miguel Valdespino
Posted 4:17 AM 3/9/08
The people who do this had better have alternate identities lined up. Because word gets around about things like that.
Miguel Valdespino
pobox90210
Posted 5:20 AM 3/9/08
I do anyway :-D
My details are
Aidan M. Simpson
50 Graham Road
WS6 4LH
CHESLYN HAY
Email Address: AidanMSimpson@audiodyn.com
Phone: 079 1878 2840
Birthday: October 17, 1977
thanks fale name generator :-D
[www.fakenamegenerator.com]
pobox90210
infmom
Posted 5:29 AM 3/9/08
Where I used to work, the computer most often used to browse adult web sites was the server. I doubt those guys would unlock the door long enough to get fired.
infmom
KristenBal
Posted 6:07 AM 3/9/08
Naaaaa, nop use getting the info, its better messing their systems.
Thats wahy, i'm always putting a safelock on many thing I do. Only used it once, when the dick didn't wanted to pay me full price, i made his system go highwhire till made him pay what he owned me with tax, xDDDDDD
KristenBal
Quatre707
Posted 7:02 AM 3/9/08
You can do more time in a Federal prison for intentionally screwing up computer systems, than shooting someone in the face.
Quatre707
megaforte
Posted 7:21 AM 3/9/08
Already did
megaforte
somekindarobit
Posted 8:10 AM 3/9/08
I would do no such thing. If you are good at your job then you aren't going to get fired in the first place. I.T. is pretty much the last thing to get cut in a budget crisis. You can't do business with failing servers now can you? Like some of the other commenters, I work with great people and have a flexible boss. I would only be let go if the company was done. Just be a good admin and you don't have to worry about stuff like this.
somekindarobit
doofusgumby
Posted 9:27 AM 3/9/08
wouldn't.
if they fire me, they'll have to hire three more to replace me. and since they hire off craig's list now, they'll get punished enough, so I don't have to.
doofusgumby
namabiru
Posted 9:46 AM 3/9/08
I didn't steal passwords, but once my previous employer removed my account from the system they found my login and password were necessary to make things run, especially databases.
Opps!
Should have charged a consulting fee to get them up and running.
namabiru
compuboy
Posted 9:57 AM 3/9/08
It depends on why I was fired. If there was no good reason for being fired, I would most probably take information in order to threaten them and settle, so that the firing does't do as much damage.
I would NEVER give that information to another source. Because then I would actually be hurting people.
Do I make sense?
compuboy
e-gadgetjunkie
Posted 11:55 AM 3/9/08
Though not an IT job, I can tell you that the day I put in my two weeks notice at Office Depot was also the day we were rolling out a new series of computers. The new display models were all password protected, and only I knew the passwords.
e-gadgetjunkie
midwestkel
Posted 12:17 PM 3/9/08
@Curves: I completely agree with you on this.
midwestkel
FrankReality
Posted 3:00 PM 3/9/08
Other than my personal records, everything stays.
Of course if they fire me, I won't get opportunity to train my replacement, so there's no need to vandalize anything - things would get screwed up fast enough on its own once I'm gone.
FrankReality
FritzLaurel
Posted 3:30 PM 3/9/08
@GirlGadget: Where do you work?? Are there any openings??
FritzLaurel
jlizard
Posted 9:49 AM 3/9/08
Hey, that's me...and I would never breach the ethical trust I have with my employer that I feel is part of being a good sysadmin. Seems to me that 88% of the ridiculously small sample size for this survey are shitty at their jobs and should be pumping gas or, more likely, the data was processed in a way that works best for the folks funding the research.
Either way, can I get a free shirt or something for having my image used with such an unflattering article…or how about an old netbook or something?
www.ratfinkbastard.com
jlizard
dropdeadcriminal
Posted 3:47 AM 3/9/08
You dont need to screw with anything if your fired/layedoff , just dont document anything you do. That way if you do get fired/layedoff no one has any idea what you did, how you did it, how to keep it running, or how to fix it.
I had a firend who got layed off for a certian cellphone company because they were downsizinf the IT department. They ended up having to call him back in and pay and a hell of a lot more for his consultant fee because no one knew how to keep his stuff running and up to date.
dropdeadcriminal
almostlucid
Posted 5:29 AM 4/9/08
No. I'm what you call "employable".
almostlucid