Possibly the only *good* example of identity theft



This isn't a security post per se... in fact, it isn't even close. I'm sharing this purely because it still makes me laugh a year after it started. I could labor to make some point about facial recognition or authentication factors but ultimately this is what happens when two security guys prank each other and one of them beats the other hands down.

At some point in the not so distant past, I started a *game* with my good friend Andy where we would set our Facebook profile pictures to one of each other and rename our accounts to match. As you can imagine, this got confusing for everyone who knew us both and hilarity prevailed. After a while I started to 'shop the profile pics to look more like me (above). It was fun for a while, but in the end Andy called time on it and I thought I had won. 


Time passed, and about a year ago to this day, I sat down for dinner with him and around twenty friends after an afternoon touring the bars of Leeds for my birthday. At some point, I left the table to use the bathroom and upon my return almost everyone in the restaurant was sporting a high-res, life-sized cardboard rendition of my features. Everyone was in on it, even the staff and by the time I got back most of the other patrons too. After a few moments, my brain rebooted and I realised what was going on. It was hilarious and it made that birthday the most memorable I can recall. I knew then that he'd won the battle, but what I didn't realise was that he'd probably won the war too.

Some airport that I've never been to...
You see, Andy works in pre-sales. He's one of those really smart guys who also scrubs up well and can "talk shop". That means he has to travel, like many in our industry do. He's maintained that in the first case, he "just happened" to have one of the masks in his bag. He's never offered an explanation for any of the others.

Some conference I didn't speak at...
Some hotel I've never worked in...
Some country I've never visited...
And another...
I think that's basketball, but I can't be sure...
Some bar I've never drunk in...
And they keep coming, and knowing Andy, I suspect they'll never stop. How he convinces strangers in foreign lands to adorn a mask depicting someone else's face and pose for a picture is beyond me. 

Perhaps you'll find something to take away from this, as a real-world example for something (maybe) but, perhaps more likely, a blue print for your own pranks. It's the anniversary this weekend, and who knows, maybe I'll be on Google Earth by this time next year...



Popular posts from this blog

Tools & Techniques - Cloud Firewalls (DigitalOcean)

Image
My home lab is (probably) typical of most security professionals: a beefy workstation running VMWare workstation, a beefy-ish workstation running ESXi and a bunch of laptops, switches and other devices.  I utilise a couple of VPS providers for hosting and exposing VMs to the cloud. My VPS provider of choice has been DigitalOcean for the last couple of years (going by my billing history) and to date, they've been excellent. They recently introduced and advertised a new service feature called 'Cloud Firewalls' and I had chance to have a play with them today. Essentially, they've incorporated a network level firewall service to their VPS offering which can be used as an alternative or in addition to host-based firewalls like iptables, firewalld, etc.  Initial Impressions - Pros, Cons and Limitations Pros No Cost (free!!) - Cloud Firewalls are available at no additional cost. Availability - Cloud Firewalls are available in ever region DigitalOcean operate.
Read more

PCI-DSS: Your CDE may be getting bigger

Image
In December, the PCI Security Standards Council released guidance around scoping and network segmentation for card data environment (CDE) assets. In their own words: “Many organizations struggle to understand where PCI DSS controls are required and which systems need to be protected. This document provides guidance to help organizations identify the systems that, at a minimum, need to be included in scope for PCI DSS. Additionally, the document provides guidance on how segmentation can be used to help reduce the number of systems that require PCI DSS controls.” The guidance goes on to visualise a scoping process, considering each category of system in turn: I believe it’s worth highlighting the ‘broadness’ of the “Connected to OR Security Impacting Systems” . These are cases where the: System component is on a different network (or subnet or VLAN), but can connect to or access the CDE (e.g., via internal network connectivity). System component can connect
Read more

WAR GAMES - Simulating Security Incidents

Image
Why it's a good idea There are a myriad of reasons to test in peace time, the controls and processes which collectively represent your incident readiness. These include: Validating your Incident Readiness - testing can confirm that you are as ready as you think you are, and that nothing has changed resulting in an end state which prevents you from initiating IR.  Assess Controls Coverage and Identify Gaps - testing can confirm your controls coverage is adequate as well as highlighting those gaps which you'd rather not have in the event of a real issue. Demonstrate value of investment - you've probably spent a lot of time and other people's money acquiring controls, attracting talent and preparing for the eventually of an incident. Internal stakeholders will likely already be looking for assurance that their investment has been worth while.  Demonstrate investment and commitment to interested parties - internal stakeholders considered, you'll lik
Read more