A factory IT manager picked an insulting password to taunt hackers, but an old, unpatched server still let a security tester take over the whole network.
A factory's IT manager chose a rude, taunting password for his admin account, meant as a message to any hacker who got in. A security tester found it, and it worked. The password was not the real weakness. One old computer left on the network was.
The factory had been hacked six months earlier. It made changes and hired Dahvid Schloss of Suzu Labs, a pen tester, to check that the fixes held. A pen tester is a security expert paid to break in so the company can find holes first. His goal was to win domain admin rights, which means top-level control of the company network.
At the factory, Schloss noticed several Windows 7 servers tied to CNC milling machines. Windows 10 was by then Microsoft's supported system. Companies often keep older systems like this because they fear newer ones will break their special software.
Most of those servers had been cut off from the main network, which was the right move. Even if he got into one, the local admin logins differed from those on most workstations. Then he found one server linked to the milling machines that was still on the network. It had a known flaw called EternalBlue.
On that server, Schloss pulled stored login details from Windows memory and found two sets of credentials. One looked like an admin account. Its password was an insulting message to hackers, written in leet speak, a style that swaps letters for numbers. He assumed the IT team had planted it as a gag and left it alone for a week.
At a briefing, he asked who had set up the account. The room looked at the senior manager of IT. It was his real admin password. On Monday, Schloss tried it and gained complete control of the network. Many other passwords he found were also insults aimed at hackers.
The password was actually a decent one, according to the report, just embarrassing if exposed. The team was clearly still angry about the earlier breach. But an outdated machine on the network gave Schloss the way in, not a weak password. A strong lock does not help if a side door is open.
Companies keep legacy systems for good reasons. The lesson here is that each one needs a plan, because attackers look for the one that was missed.
One old, unpatched computer on your network can undo strong passwords, so update it or cut it off from everything else.
North Dakota lawmakers are looking at HB 1447, a bill meant to help prevent crypto fraud, and AARP wants residents to speak up.
Read more: North Dakota weighs a bill to curb crypto scamsA user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA fake call in Truro, Canada, sent a police tactical team to a woman's home. An RCMP officer now shares plain rules for spotting phone scams.
Read more: Canadian police share simple rules to beat phone scammers
