Network Punking?

October 12, 2006 4:12 PM

EvilFilter: I want to hack a machine on my own company's network.

We have this sales guy in our company who's a bit of a nut, and we think it would be funny to get his goat by choking his Internet access and hearing him freak out.

We don't have root access to his box (Windows XP Pro), and we don't have admin access. I know his network login and his machine name, and we're on the same Windows network; that's it.

Is there a way I could get his network MAC address and redirect his traffic or something? Send all his web traffic to a website? Or force requests from his IP or MAC address to be dropped or lost or something, effectively knocking him offline for a few minutes?

If there are any other little pranks we can play without admin access (more interesting than net sending him a message or email spoofing), please let me know.

posted by blahtsk to computers & internet (24 comments total)

Attach this to his monitors power cable:
http://www.shoptronics.com/wireco3poous1.html

Let the fun begin.
posted by mildred-pitt at 4:27 PM on October 12, 2006 [1 favorite]

Unless you know someone in the IT department that has full access to their network hardware, you won't be able to do any of that. (And even so, I'm sure they won't do it for you)
posted by mphuie at 4:34 PM on October 12, 2006

What you're talking about doing is against the law.
posted by Steven C. Den Beste at 4:35 PM on October 12, 2006

ntpasswd will let you back up the relevant registry hive, change his password* to whatever you like, then copy the backed-up hive back in place so his original password works again and he is none the wiser.

*if, however, the login is via domain or active directory, you'll have to settle for doing the above as the machine-local admin instead.

do let us know when you get fired.
posted by dorian at 4:37 PM on October 12, 2006

Is this "company" called high school? Because you sound like a bunch of bullies pushing around the weird kid.
posted by smackfu at 4:49 PM on October 12, 2006

I understand the temptation, believe me. That said, do not do this. Stick to whoopy cushions.
posted by everichon at 5:07 PM on October 12, 2006

I can't see this question lasting long.
posted by Neiltupper at 5:24 PM on October 12, 2006

Joining the litany of cautions, if it's a company with an IT department, then if the IT guys aren't in on it (and obviously they're not or you wouldn't be asking this question) there is every chance they'll be pissed off when he interrupts their day with an emergency fix request, and when that pain-in-the-ass work turns out to be the direct result of deliberate tampering by you guys, you'll probably end up the focus of their ire.

And you don't want that.
posted by -harlequin- at 5:26 PM on October 12, 2006

Ack, sorry, we're not that evil. We were thinking more like harmless prank, but I seem to have made a wrong turn. (Our IT guy would help us if we asked him... small company.)

We'll try something else... messing with his chair or monitor settings or something.
posted by blahtsk at 5:37 PM on October 12, 2006

We'll try something else... messing with his chair or monitor settings or something.

Old classic, screenshot his desktop, make it his background, then hide the icons and toolbar. Hilarity ensues.
posted by empyrean at 5:41 PM on October 12, 2006

If you're still in the San Jose/Santa Clara area, and you work for a company that doesn't have much of a sense of humor about network intrusions,

1) You could lose your job, and
2) Be subject to California criminal laws covering computer system intrusion
3) Be subject to Federal law for computer system intrusion
4) Face civil liability from both your ex-employer and the person whose communications you intercept, and everyone else on the network, individually, if what you do breached their rights in communicating with the person whose communications you actually did intercept.

Think I'm kidding? Review at your leisure the sad case of David McOwen, a nice, and well intentioned guy I've had dinner with a few times. And he was trying to help people!
posted by paulsc at 5:48 PM on October 12, 2006

Blah, all this talk of consequences. Lame. What you want is this dnsiff. I personally find changing hotmail.com to be hotmale.com to be a rather amusing use for this. Plus since it's not work related, it's not like they can bitch. Also it's completely safe/non destructive. You will need to be on either the same network segment, or the same network segment of the dns server for it to work.
posted by mock at 6:12 PM on October 12, 2006 [1 favorite]

To get back to actually answering the question, probably the most effective way to mess with him in the manner you so desire would be packet spoofing, as since you guys are on the same network his computer is much more likely to accept the bogus traffic you generate as authentic.
posted by ChasFile at 6:30 PM on October 12, 2006

No, this is a good question. This isn't real evil, just a practical joke.

Does he ever leave his desk? Can you access the computer when he does? If you can you could have much fun by playing with the hosts file.
posted by caddis at 6:45 PM on October 12, 2006

Get to his computer when he's away and disable the connection and unplug his phone cord. Then he'll freak out and walk to the IT area himself. In the interim reinstate anything. Wash, rinse, repeat.
posted by geoff. at 7:03 PM on October 12, 2006

While I like geoff's idea for harmlessness, be sure to let the IT guy in on the joke. Otherwise, he'll think he's a total reject and liable not to help as much.
posted by jmd82 at 9:32 PM on October 12, 2006

Agree w/letting IT in on it - specially in a smaller shop. Get him to come up w/something as only he can know your shop's fun potential :)

I used to replace login "exe's" (Unix) to display their passwords the next time they logged in, "lmao your password is crap - XXXXXXX!"

Another buddy used to spy on one guy working on his own website at work (admin privs though.)
posted by prodevel at 1:15 AM on October 13, 2006

Oh and as an admin on unix using simply echo "\a\c" appended to ppl's term sessions was fuuuuuun! Almost 100% logout action wondering what was wrong.
posted by prodevel at 1:17 AM on October 13, 2006

Agreed on the consequences. Sound like you're at a small enough company that this could qualify as "team building". But absolutely let IT in on it.

We used make custom keyboard layouts and switch things around.

Even easier, just set his keyboard to dvorak.

I also remember an old Mac OS 7 extension called sniffles or something which would cause the computer to sniff at random intervals. Very fun:

Him (to IT): Umm... my computer is making strange noises.
IT: What kind of noises?
Him: Sniffling?
IT: Sounds like your computer has A COLD!!!
You and IT: Bwaaa haa haaa haaa


Too bad you don't have a *nix box running an x11 server... I had a friend in college who would constantly pop up nasty granny porn onto my box.
posted by dentata at 2:18 AM on October 13, 2006

Swap his "N" and "M" keys on his keyboard, turn down the brightness and contrast of his monitor and hold his mouseball hostage [if he has one]
posted by bhell13 at 2:20 AM on October 13, 2006

In my last job, we entertained ourselves with Office Poltergeist for quite some time. And it's harmless. You will need someone to install it on his machine (and run it on start-up) though.
posted by StuMiller at 4:08 AM on October 13, 2006

Drifting offtopic, but my favorite Unix prank when you find someone leaving themselves logged in unattended:

echo 'echo sleep 3 >> ~/.profile' >> ~/.profile

(Substituting the correct shell rc file for the user, of course.)
posted by mendel at 6:54 AM on October 13, 2006

A while ago the company I was working for was having issue with email viruses. When one of the high profile ones started going around (maybe melissa) the sysadmin sent around a piece of mail advising everyone to not open any attachments on mail titled with whatever the title of the virus message was. So my friend, wiseass that he is, wrote a batch file that did "net send" to the sysamin's computer with the message "I don't read virus alert emails". He then sent it to the global company email list with title the sysadmin warned about.

Five minutes later the sysadmin was in my friends cube, screaming at him. She had been swamped with messages saying "I don't read virus alert emails". I personally thought it was hilarious, but people higher up took it much more seriously. My friend kept his job, but I think the moral is don't piss off IT. They take these things seriously.

At a later company one of my coworkers managed to replace all of the mp3s on another coworker's iPod with the "peanut butter jelly time" song while keeping all of the song title and album information the same. I thought that one was pretty good.
posted by Lazlo Hollyfeld at 7:35 AM on October 13, 2006

Change his screen saver to the blue screen of death.
posted by kjs4 at 8:34 AM on October 13, 2006