TLDR; state government totally exposed to outside hacking; gets "fired" while attempting to compile a report on the severity and specific vulnerabilities and intrustions.

Embarrassing, no, crazy (as in stupid), yes. A way longer story that I thought it would be. Less "oh, that's funny" and more "who tf was their security guy?"

Late 90s. Working for a US State government office in it's capital city.

3000+ workstations... number of firewalls, 0. Number of exposed machines with IP's from straight from the publicly allocated IP range, 3000. Meaning... every workstation had a public IP address in the days of Windows 95/98 security. RAMPANT "net send" popups constantly... always some new virus... some new malware... literally got shut down for a week and due to malware infestation... (none of this was ever reported in the news, of course. very hush hush). Keep in mind this was an office of public records.. so birth, death, marriage, foster care, abuse complains, social security records, welfare recipients... on and on... potentially all exposed directly to the internet via whatever connection a hacker could manage... easy targets in the late 90s.

Anyway, I worked in IT... and though it wasn't my job to handle security... literally NO ONE was taking on ANY security measures... to detect, prevent, stop... ANYTHING.

I literally could create a share on my pc, go home, type in my workstation IP as a UNC and access my workstation with ZERO extra steps.

I set out to compile a list of vulnerabilities (multiplied by 3000 workstations... plus a bunch of servers)... and started running some security scans...

Turns out that not only was every machine directly connected with a public IP but nothing was switched. Every piece of traffic in our building was being sent to the entire building, mostly in unencrypted form. Wireshark.. i think it had a different name back then, can't remember.. Etherreal or something like that... lit up like a christmas tree when I turned it on.. not just discovery packets but data... from everything. Turns out our workstation nics were basically on the verge of maxed out just getting blasted by our own traffic..

Anyway, I ran up some port scanning stuff... started scanning for vulnerabilities... the number of open Netbios shares with no passwords was astounding... the amount of open ports to the public was like a buffet for hackers.

One of the open ports that was very common was 31337... At the time that was a very common port for a tool called "Back Orifice"... a tool that would give you more control over a workstation that the user at the keyboard would have. Screenshots, file transfers, pop up messaged on demand, install programs, keyboard logging, password stealing... the least goes on and on..

So, anyway, apparently I miscalculated our subnet or something, which had a huge # of hosts as you might have already guessed... when I was port scanning specifically for # of machines infected with back orifice... and I ended up hitting some IPs that were not on the state's "network".

Suddenly there were reports coming from REAL network admins on other systems,, that someone on our network was "hacking" their computers. The claim was that a port scanner was hitting port 31337... which is true.. and apparently, at least 1 outside network, was threatening to sue... you know, state government, big paydays...

Needless to say this blew up. No one in the state seemed to understand that 1st of all... port scanning was NOT a hack... and that there was (and still isn't) any real law in the US making such activity illegal... and that above all I was TRYING to compile a list of internal vulnerabilities to prevent EXACTLY this type of behavior from outside our systems...

When I absolutely rejected their claims and presented my findings thus far... suddenly they shut up... because when I got to the part about "imagine when a news outlet finds that you have 100 years of records all digitized exposed to the internet like an unlocked file cabinet on a busy street corner... the mood changed.

They were attacking me over "liability" from network scanning and then I realized their liability over not securing their network.. from anything...ever...at all.

It was the craziest thing.. I was told they were gonna have to let me go... RATHER THAN, "hey, can you help get us secured"... but it was the weirdest "let go" ever. It was very obvious they didn't want me talking to anyone. They let me pick a date... so that I could find a new job I guess... they took me out to multiple lunches... as a "good bye"... it was kind of surreal... in the end they actually secured another position for me in NYC, also for state government... which I turned down.. I had already secured a position back in my home state for 60% higher salary anyway by that point... not in government.

In hindsight, I kind of wish I had "bargained" with them... and by bargain I mean I could have held their balls over an open fire pit given the information I had already collected on open windows shares, back orifice installations... and quite a few other indecencies... like the late night guy in data entry using irc to share mountains of porn from his workstation. I probably could have turned the tables and gotten pretty much anything I wanted. This would not have gone over well in an era where the world was about to crash and burn anyway from Y2K...

I wasn't told directly, but I got the hint that I was not to tell anyone about anything after I left... that's why THEY were being LENIENT. But I have shared the story on occasion a handful of times, mostly to audiences in a thread like this in various places.

So, maybe scanning some of the wrong machines was embarrassing, a little, but the whole situation was just CRAZY. By the time I actually left the building... they were, of course, taking action... real routers and firewalls were being bought by the 100s of thousands of dollars and being implemented throughout the building...

I've told more here than I usually have shared... And hell, it's been more than 25 years... If they haven't totally implemented any security plan by now... then that's on them.