Mini Blue Team Diaries Story:
It was a springtime Saturday many years back, and all was right in the world. I was mowing the yard, which at the time, meant a very small patch of grass that could be mowed by an electric mower plugged in with a tiny extension cord. All of a sudden, the perfect spring time in suburbia came to a screeching halt. The on-call phone was going off.
At the end of the line, an engineer from our hosting ops department, who was taking advantage of a maintenance window to do some patching on VMWare ESX hosts. He was actually updating the hypervisors in person, at the datacenter, so he could be quick to respond if something went sideways.
Alas, something had gone sideways. The ESX machines, appeared to have all been compromised! The engineer had called in a panic.
Upon reboot of the machine, an ominous message never before seen by the engineer just after the POST screen.
"All your servers are belong to us!" read the message, in an apparent nod to Zero Wing.
Clearly this was the calling card of some malicious actor who had rooted the hypervisor and was now deep enough into the system that they could own our entire stack. So he'd called SecOps for our take.
I had two thoughts. 1) Run the compromise checklist, and see if there was anything strange going on, and 2) ring the engineer who'd worked there the longest to see if they'd ever seen this message before.
1) was well underway, and found no evidence of a breach. 2) took a bit longer to get ahold of the right person, but when we did, we had our answer.
"Oh, that was just Don who used to work here. He put that message on all the servers he set up as a joke. He's a great guy."
And just like that, the incident was over, and I returned to the yard work.
Incidentally - I made a very big deal out of making sure that the engineer who'd rung the on-call for that knew that he'd done 100% the right thing. What I didn't want to happen was, although this time turned out to be nothing, was for him to be worried about raising the alarm again in future, and missing something real.
Want more, slightly less mini stories like this? Check out: https://www.infosecdiaries.com/
We hope you are as excited as we are for the release of FIRSTCON25's agenda
Drum Roll!
from our archives: "Training to Become a Savable Victim" 
Launching today: Discernible Drills - our new weekly security/privacy communication training delivered via Slack!
I've had quite a few outrageous responses to my alerts, this is another one of those, sent by teammateapp.com CEO.
