Just like last time, all events were true. The spacing, timing, and event orders were changed, rearranged for epic retelling.
So the next day my task was to simply determine which devices were connected, and where these devices were connected from, and if we had a history with these devices.
So some of the comments yesterday were geting things a little wrong. When I talked about disappearing loans, these were mortgage loans not yet written. People were stealing potential loans from our company with all of the work already done.
If you apply for a mortgage loan using a mortgage company, never go through bank use a mortgage company, you will hear the term "locking in your rate." This is because the rates change daily. Sometimes you can lock in your rate and it will go down the next day. Sometimes it will go up the next day.
What this lady was doing, was hiring and firing people based on things they did not control. She would hire people, treat them like her best friend, take em out to lunch/dinner, get to know them well, and treat them like they are all stars. When someone was unable to lock in a rate in X time, she would let them go. She would do it for people who had no control over it either. If a customer forgot to include X W2 or Y pay stubb, you know the things banks want, then the loans would not get locked in in time. Fired. This created a large number of pissed off former employees. She was a high producer who went through assistants about as fast as I go through sparklets bottles. You get the picture.
These pissed off users would call up those people who had locked in and would give them a better rate, even though it was locked in, and steal all of the info from our loan software to create a paper loan. They would then submit the loan for the sweet sweet commission on a freelance loan. Which is very significant.
At this point nothing was shocking me. I would research a user, find out the extent of what they did, and document it while disabling access. After the tenth one where this happened, I get a call within 5 minutes transferred to me.
$PU = Panicked user
$me = Gul Dukat
$PU - (read all of this person's replies in a very panicked voice.) This is name of the account he is logged into. What just happened? I just lost all access.
$me - OK I need to connect with you to see what is going on. Please head to it support site and click on remote support.
Connects with remote session
$PU - So what do you think it is?
$me - Oh I have a good idea. Going to check a few things.
$PU - Please hurry it up. I have a client literally at the bank with me.
$Me - wont take long.
I go through and grab the PC name and check its history in our system. Bingo.
$Me - So actual name long time no talk.
$PU - Who? This is fake name.
$ME - No fake name knows she is not allowed to work right now. You have been abusing privileged access to our system to steal potential customers.
$PU - Yo man she gave me the password. Legally I am golden.
$Me - If I leave 30k in cash in my unlocked car in full view of the public, it is still stealing if you take it. I have to forward this to legal. I am sorry.
$PU - Wait yo. We dont have to do that. We can work something out.
I pulled the call record and forwarded a copy to Legal, HR, and Infosec. The rest of my day was like this. All in all we learned the vast majority were people who simply never removed the access. There were only a few... offenders in the group. Seventeen cell phones were remote wiped, 6 laptops were voluntarily submitted to us so we could confirm nothing nefarious was afoot, and 3 people were arrested. (by the end of the week) Several more were informed by legal that things were happening.™
This was when the gut check came. The company learned that when you report breaches due to your own incompetence to the police, the FTC comes knocking.
This started the interviews which , thankfully, i did not have to take part in. Which kicked off the audits, which unfortunately, I was vital to the documentation of.
To be concluded.
via reddit <a href="https://ift.tt/2Hg9Gl4" rel="nofollow">https://ift.tt/2Hg9Gl4</a>