I almost screwed up and let a hacker get away with credentials

Posted by j1mmyava1on@reddit | sysadmin | View on Reddit | 98 comments

I work in L1 Help Desk and last night this guy called in asking for a password reset because he was locked out of his laptop. He introduced himself with his name, employee ID, and home address. SOP for password resets done over phone is to send a 2FA code to their email or phone number but I completely fucked up and forgot to authenticate the user.

I reset the AD password without authenticating the user and then notified the guy over phone that I sent his temporary password to his email. He said he didn’t have access to his email so I said “okay I can send it over Teams”. He said he didn’t have access to Teams on his phone and then tried to coerce me in providing the password over phone. I told him that I couldn’t do that because it wasn’t SOP (I managed to remember that part) but he kept trying to push and guilt trip me.

I wanted to see what job position this guy had so I looked him up on Teams and saw that he was a VP. But what stood out to me was that it showed his status on Teams “In a meeting”, yet the guy over the phone said he didn’t have access to Teams. I pinged the guy on Teams and asked “Hey are you calling me from xxx-xxx-xxxx?” I get a reply back saying no and that he was presenting something to his coworkers. I immediately hung up with whoever called me over the phone and notified the network engineer who handled all cybersecurity incidents. I got into a call with several other people including my manager, head of IT, and the real end user himself, and explained everything. I found out from the real end user that his LinkedIn had been hacked a few years ago and that was probably how the attacker was able to provide his employee ID and address. During the meeting, my manager reiterated SOP but he and the head of IT complimented me for standing my ground and not causing a breach so I know the team has my back.

Long story short, I forgot to follow SOP and almost let an external attacker get away with credentials.