Posts by AustinTX 267 publicly visible posts • joined 15 Jul 2008
Illuminati Online of Austin TX, aka IOCOM Corporation (chuckle), died with a whimper when it was sold to Prismnet.com in August, 2004. It's domain name was finally sold off in June, 2011 to a storage provider who wanted a short trophy alias.
This modest Internet Service Provider was launched with the money won in court years after the USA Secret Service raided Steve Jackson Games and seized everything with an electrical cord including their busy Bulletin Board System. After years of pressure, the Secret Service eventually claimed that SJG was literally designing a mainframe hacking course "disguised" as a role-playing game. They insisted on this, right up until the bloody end. Well, it turned out that it was just a board game and success was determined by rolling dice. A "cyberpunk" styled choose-your-own-adventure game.
As the year 2001 began, IO had around 4,850 customers, 18 staff, and raised a bit over $1M/yr in revenues. IO consisted of around thirty servers, mostly 200MHz PPRO and 233MHz PII desktop systems which were mounted in bargain basement beige ATX cases.
IO also colocated TX Governor George W. Bush's server cabinet until just before his candidacy for President was announced. I can't explain why he chose to use a hosting company whose theme was based on conspiracies, political elite, and secret societies, and which was on the Secret Service's permanent shit list.
You could telnet to password.io.com from anywhere in the world, and log on as guest. Lynx, a text-only web browser, was configured as the shell, and you would then be presented with a sparse version of the web-based customer account tools found at http://password.io.com/. This was so customers could reset their own password, update their address, set their PLAN file, etc.
THE HOLE
IO forgot to disable browsing the filesystem (press g, period, enter). Also, IO never enforced uniform file and directory permissions or audited active accounts. As a result, through 2004, after IO was taken over by Prismnet (or later), you could roam around and directly view many customer's private files, email spools, within /public_html, and IO's own sensitive system areas. You could also open the Lynx config to define a custom "editor" and thus actually edit files, or run executables. This was a direct back-door into everything! This continued a full two years after IOCOM "hardened" their network to sell network security services.
For more details, visit my clone of IO's old website at io.fondoo.net via archive.org around February 2023. As I write this, archive.org seems to be over capacity. The snapshot does contain lots of pages and images though if you can come back at a better time. The white side on the left is just as the company designed, and the text written on the purple side on the right is my insider's commentary.
So, i'm a GenX. The # sign has always meant "number" in front of digits and "pounds" when it comes after digits.
I had an office job where most of the employees were in their 20's, and thus thought of it as "hashtag" because of their social medias. My job required me to ship some things off, but I had to request shipping labels from someone else who often worked remotely. I made a request for a label for a package which I expected would be "22#". The young person, after the usual day's delay, writes back and asks; "what is the weight of the package?". I replied; "22#" again, being all professional and pleasant and such. A day later, he replies; "I need to know the weight because the cost varies". I replied with "22#" but I changed the color to red and underlined it. A couple days later, hearing nothing back, I repeat my request for the label and he replies; "Will you tell me how heavy the package is PLEASE?". That's when I realized what t.f. was going on. He didn't process "22#" as "Twenty-two Pounds" but read it as "Hashtag Twenty-Two", and despite that making absolutely no sense, he didn't ask my why I was putting a hashtag in our correspondence. He thought I was just spontaneously shouting "Yeah! Hashtag Twenty Two!". Or pretending not to understand.
THIS GUY WAS THE OFFICE MANAGER. You know. Someone who makes purchases and writes reports. Does inventory.
So I grabbed a post-it, wrote "#" on it and approached one of the nearby employees, someone in his late 20's, who hadn't left for home yet, and asked him what he called it. He said; "A hashtag". I said; "yes, but what else is it called? He literally paused a while and thought about it. He said; "I know it USED to be called 'number' which is why it's on the telephone" as if those days of yore were past and # belonged wholly to the new generation to use as they please. As if The Council had Decided. Then he suddenly added; "and some people call it 'tic-tac-toe'". I'm sure I was gasping for air at this point, but I asked; "Have you heard it called 'pounds' too?" And he was all 'oh right, whatever' at that point and turned away from me like I was being exasperating.
Facepalm
When I worked for Illuminati Online in 1999-2000 (the ISP which was launched with the court-awarded winnings after the USA Secret Service raided and pillaged Steve Jackson Games in 1990, on the false accusation that they were working on a game that literally taught players how to actually hack real computer systems), the root password was written on the whiteboard over the network admin's desk. But, it was on the bottom corner with the eraser positioned so that it was partly covered. It did get changed montly or so. But, if that was too big of a barrier, anyone could telnet in, press 'g' '.' and enter, and then just browse the filesystem in a handy GUI.
https://www.sjgames.com/SS/io.html
https://web.archive.org/web/20230507022718/http://io.fondoo.net/
I worked for Kyndryl a few years back. On-site executive desk-side support in Austin TX. The company is broken on virtually every level.
Fun fact: "Kyndryl" is a conjunction of "kinship" and "tendril". Isn't that clever? Doesn't that just say "great IT company" to you?
I mean, that's essentially what in-house imaging is like. You wait and wait and wait while Microsoft, in their infinite wisdom, display a whirling thingie and then randomly prompt; "Do you want to continue or shall I abort? 10-9-8-7...."
Or, as a trained and experienced tech, you come in handy dealing with issues such as; "We had a minor problem trying this thing once... Nobody thought to offer a "RETRY" button... So press "Cancel" to cancel, press "OK" to cancel, or press "X" to cancel and then we'll shut the PC off just to be that much more annoying".
If you want to make it more entertaining, set up a whole mess of identical PCs and then start them all at once to marvel at how they all fall wildly out of synch after just a few minutes...
I've worked temp jobs a number of times. People need temps to handle extra load caused by either their great success or their great failure. The clients are either really really nice, or just the worst people that ever lived.
I once overheard one of the client employees talking with another about running out of money to pay for the temps. That evening I was called to say I was fired for being "habitually late". I'd never been late. I faxed them both a few hundred pages of big black squares, but scheduled it to happen when I was personally in the office to pick up my last check (before caller ID).
At another job I was tasked with opening mail and delivering it, and accidentally saw my tempco's bill for my services. I was getting less than half what was being paid for me, of course. But I'm sure tempcos work SO HARD they deserved it more than me, right?
Back in the DOS days, I had the bad habit of using the root directory of my second partition as a temp folder. It would ordinarilly never have files in it, so clean-up was as simple as deleting any non-folders.
Well, one day Microsoft outsmarted me. Their installer finished adding the program, and then it just blanket deleted everything in that folder including itself, existing folders and the new program it had just installed.
In my defense, the installer shouldn't have assumed it was being run from a directory with nothing valuable in it, and if it was going to clean up files, it should have only deleted ones belonging to it.
I haven't even looked in root in years, so I obviously don't use it as a temp directory any more, but i'm sure I probably continued to do so after this adventure.
If they agreed on a standard, people could continue to use racks that were hundreds of years old! That means a lot less merchandise sold by rack mfgrs. They make more money by trying to lock customers into proprietary setups and by making equipment their competitors can't use. The more it costs to switch providers, the less likely they willdo so. But we know all this. :)
I was on the evening shift with one co-worker, and gone outside for a walk on my break. When I got back to the building I realized I'd left my key card inside. Cell phones were still luxuries, and I didn't own one. There was no security guard (or cameras) so I had no way of getting ahold of anyone.
Willing to try anything, I hiked about a block to the other side of the complex where there was a 1-story strip mall which physically attached to the side of our 3-story building. Our offices were on the 2nd floor, but the company was mostly in windowless rooms inside. Except that the building had originally been normal offices and they'd decided to put the servers in a room that had once been a nice windowed office.
I managed to get access to the roof by climbing up a hot, buzzing transformer, and made my way back to the office's server room window. I started making irregular rapping sounds on the glass with my car keys, knowing that even if my co-worker was wearing his headset and couldn't hear me, eventually he would go into the server room to do tape swaps and checklists. Fortunately, he heard me and saw me at the window. He gestured in the direction of the building entrance to let me know he would meet me at the door.
5 minutes later I was chatting with him while he took the opportunity to have a quick smoke break.
Guess who ALSO forgot his key?
He didn't have a phone either. With another 3-4 hours until anyone arrived to relieve our shift, we sort of panicked for a while there. We both had our car keys and thought about driving to another employee's house for help getting back in.
Fortunately, my co-worker had some knowledge of breaking into offices that I didn't know about. Our building's door was the type where you push a bar to exit, and just touching the bar released the magnetic lock. With a scrap of thin metal stuck through the crack between the doors, we touched the bar, and the door was open! The rest of the evening was quiet, and we hadn't even missed a call.
During my stint with Kyndryl* a couple of years ago, the mgt above me saw fit to distribute my personal cell phone number as the new Help Desk number.
I wasn't asked first. It blew my phone up- using a number I mostly ignore because so many recruiters hammer it.
I still get occasional calls from B-level executives "requesting" early upgrades to their leased MacBooks.
I live in another state now so I just ignore calls from that area code.
*from their website:
"Kyn" comes from "kin." It represents the strong bonds we form with customers and with each other. Our people are at the heart of our business. "-dryl" is coined from "tendril," evoking new growth and connections. By working together, we are growing.
So once again, to "keep us safe" we are asked to submit to 24/7/365 audio surveillance. I'm SURE that can't serve multiple purposes after assurances otherwise?
How about, instead of AI or whatever constantly analyzing for impudent sounds, that safety valve be built to WHISTLE at a specific frequency which can be detected by dumb circuitry?
I'm not saying it was good form, but sometimes I was just too lazy to make a /temp directory to unzip a program installer into, so I ran it from C:/
Mind you, I wouldn't let pkunzip fill my root with scores of files; this would just be to uncompress a monolithic executable installer.
Until I met the one which installed it's payload and then cleaned up by deleting everything in the install-from directory. You know. Everything.
One has to wonder why all of the leadership are ethnic Indians (with dots). Perhaps it's racism, perhaps they all just have established work ties and just need more time to integrate. Nah, it's racism.
I worked for The Cog at Faecebook HQ downtown. They weren't horrible bosses, but they were a bit inept. Mgt delegated mgt work to us gora (white people) so they didn't have to do any work. The worst part was that we were forbidden to participate in the FB employee chat rooms where people in our role (internal help desk) asked for help because they were afraid that it would show how poorly we'd been trained.
Now if we can turn the spotlight to another Indian-dominated subcontractor; HCL. I worked for them at NXP Semiconductor. My immediate supervisor was Latin, but passed quite nicely as an ethnic Brahmin. He told us he'd been invited to meetings until they found out he was Latin. At these meetings, ethnic Indians would speak English as it was a common language. They would laugh and joke about how nobody but Indians would be getting promotions or raises. But they were serious.
I worked for Kyndryl in 2021-2022. I'm shocked they're still in business!
First of all, how do you market a company with a name like "Kyndryl"? Say it out loud. Bleh. Imagine the salespeople constantly having to explain it to their sales leads. Nobody had any idea what it meant, but you can google this precious POS:
[kyndryl.com/us/en/about-us] "Kyn" comes from "kin." It represents the strong bonds we form with customers and with each other. Our people are at the heart of our business. "-dryl" is coined from "tendril," evoking new growth and connections. By working together, we are growing." OMG.
Overall, it was a typical situation of a wildly dysfunctional employer. Red flags a-plenty. The Kyndryl technical documentation was wildly out of date and the employees siloed their knowledge. Slack was filled with people asking for help and getting no answers. My team members were cagey and irritable, and I had to "trick" them into giving me information. I had to wait weeks to get my laptop, and months to get access to ServiceNow, AD, a phone number assigned, etc. It seemed like Kyndryl didn't have an on-boarding checklist. They distributed my personal cell phone number far and wide.
I was working alone as the new "on-site" tech in an empty hi-rise office of about 500 seats. The client had planned to cancel WFH but employees weren't having it. A lot of them had moved out-of-state. The client was firing twice as many people as they were hiring. I had to process equipment returns, but they never let me know in advance. I'd get an angry email demanding why I hadn't prepped a PC for a new hire. Or, I would find a big box delivered to the lobby, addressed to the tech i'd replaced over a year previous. Several times a week, I would just suddenly find a sad-looking person standing at my office door, holding some items. I had to walk down to the street and take their access cards as they left the garage. I watched women cry. *sigh*
I gathered that the client gave up on ordering their staff back to office. Eventually, I got a call a Thursday afternoon telling me I was no longer needed. I gathered up all of my things, saluted the surveillance cameras, and biked home.
I worked for Kyndryl a couple years ago. I worked solo at my job site with 99% of staff working from home. Aside from some inventory and a PC refresh project, I had no idea what my responsibilities were and all of the documentation was out of date. The software library was an endless labyrinth of old versions and nonworking install guides. It took ages for them to set up my admin accesses. The client was expecting me to be a concierge who could do everything for them, and the CIO personally screamed at me for not getting a newhire's laptop shipped on time, though it was their own office manager's fault for ignoring my many requests for a UPS label. Several of my teammates were pretty cool, but the company was in complete disarray. The cool teammates quit. The other teammates were expert responsibility punters. I was also supposed to help nationwide customers remotely, but the network of the customer where I was hosted blocked access, and my management just treated me like an idiot who couldn't use tools.
But providers/ISPs want to be in a position to bill people in speed and quantity tiers, when they sometimes can't even physically provide the contracted service. I had ATT DSL once and they weren't interested in throughput issues unless we could prove to them we were getting less than 50% of our "as high as" speed.
And we all know "as high as" catagorically means they don't have to actually provide that full speed. The word "overprovisioned" surfaces more and more often now, which describes most of these ISPs. They accept and bill more high-speed customers than they can actually serve, and if there's even another ISP to go to, they're playing the same game.
Providers/ISPs don't want to be in a position of having to upgrade their network to support all those high-speed tier customers, so they maintain an ARTIFICIAL SHORTAGE and jack their prices up in a wholly-manipulated market system.
Yes if anything, it COSTS MORE to throttle everyone's connections... but the throttled service is what providers mean to offer as the discounted tier.
And a word about how major networks bill and credit each other for data crossing to each other's networks; obviously they don't bill bandwidth at the actual cost of providing it. They bill it at a price that is sufficient to KEEP OTHER PLAYERS from joining! These people are just inventing new kinds of monopoly which skirt the legal definition of it (if it's even illegal in their area).
For example, Provider-A and Provider-B tend to exchange around the same amount of data with each other. So if they bill and credit each other $100 per Megabyte, they come out about even. Provider-C would like some backbone access please, but they're a last-mile provider (who also ban their customers from hosting servers) so most of their data travels inbound. This is the "expensive bandwidth" which your residential ISP frets about. They have to pass this arbitrary cost on to end customers.
And I have to point out that the actual cost of maintaining an idle network is the same as maintaining a busy one. The miniscule impulses of energy carying the data are trivial compared with rent, utilities, maintenance, licenses and advertising. So data itself shouldn't even be measured! Networking isn't storage. People should only be billed by the capacity of their firehose over a given billing period.
Most people figured out by now that there never were any "fast lanes"! "Fast lanes" are nothing but providers applying resources (network management!) to slow down everyone, unless they pay a premium to NOT be throttled. This is no less than fraud! Gatekeeping. Tolling.
After decades of technology providing miniturization of network equipment and exponential increase in bandwidth speeds, the providers kept whimpering about "rising cost of business" FORCING them to jack up their prices!
Obviously, when a single rack now replaces a data center full of older equpment, while handling a million times the former bandwidth, it is far cheaper to run. Less energy to run and cool. Less staff to hover about addressing issues. Obviously, with 66% of deployed fiber remaining dark, and ALL of it capable of 1000x faster speeds now than their designers anticipated, there is NO SHORTAGE of connections. With their profit margins exceeding 95% in some markets like NYC, It's like printing money, friends.
I would like to know why the press still hasn't written an article exposing how things really work, instead of continuing to politely use the vocabulary and logic of the carriers themselves, even when mildly hand-wringing about the poor customers.
It blows my mind how nobody can understand that they're not building "faster lanes" for people who pay more.
They're slowing everyone's speeds down unless they pay more! It requires resources to impose the throttling!
And still ISPs operate at a 95% profit margin and yet whine that they must raise fees to keep up with expenses!
Speaking as a former Dell CST... whatever the Dell tech told you to do, it was to get you off the phone because the call was ruining their average call times (ACT), and there was NOTHING higher priority to their manager than short calls. NOTHING. When I worked there, I was ordered to take my next call without logging any details about the one I had ended. I was told to "go back and put in the details when you have free time". As if one could remember that degree of detail hours later. There was never any free time. You can imagine how many customers called back with results from the pointless busywork they had been assigned only to be told there was no information in their call history and they would have to go through mandatory dumbass troubleshooting yet again.
It used to be routine (though bad practice) to run program installers from the root directory. Software would typically unpack into a temp directory, install the software, then clean itself up. Which is what I was used to and relied upon happening until the day I installed a major software package which cleaned up the lazy way by just deleting everything in the directory it was run in. I called those fruckers up and chewed them out.
When I worked for Austin TX internet provider io.com, you could telnet in as guest and just browse the filesystem directories! You could go to /home and just harvest all of the usernames at that level, and often you could dip into customer's /home/%username%/mail folders to get additional mailbox names. You'd just send your spams to %usernames%@io.com.
How could you just telnet in, you ask? Well, they had a public telnet portal to log in and reset passwords, update PLAN and open help tickets. It was based on using LYNX browser as the shell instead of BASH. So, aside from failing to set permissions properly throughout the system, to keep customers from browsing outside their own account folders, they forgot to disable LYNX's file browser feature (press g, period, enter). Pretty sad, considering the staff liked to think of themselves as burningman_cybergods and the company was boldly claiming to run a "hardened network" and selling security products on that basis!
Search for io.fondoo.net on archive.org if you want the detailed story (which I added to the sidebar of my snapshot of the company's website).
Don't overlook the point that services were paid for, provider got to hold (and invest) the money without delivering all of the services, and now provider wants to not only keep the rest of the money, but they also want to claim that the cost of doing business has risen so prices also must go up. When they literally got everyone's full payment up front, did whatever they could to avoid having to deliver all of the services (and their cost of operation is way lower than what they imply by their prices in the first place) and made bank on all of that free money.
