The Consultant We Fired for Cracking Our Passwords

We found it during a PCI audit sweep. Scanning every system, as the audit required, we turned up a copy of L0phtCrack sitting on one of our servers. If you know the tool, you know the feeling: L0phtCrack is a password cracker, an unambiguous hacker utility, and it was inside our environment, on our hardware.

The first hours were pure panic response. A cracking tool on a server means someone put it there, and until you know who, you assume the worst: an intruder with a foothold, working your credential store while you hunt. We traced it down expecting a breach.

Insider incidents bother me more than any outside attack, because the company handed the person the keys. Businesses pour money into watching the internet and assume everyone with a badge is on their side, and that assumption is the opening every insider uses, whether they mean harm or not.

The call is coming from inside the house

The trail ended at one of our own consultants.

He had a job to do, the job required passwords, and we hadn’t given him passwords. Instead of asking for access, he installed a cracker and took it. He succeeded, too. He got passwords and he got in, with a tool that worked exactly as designed in the hands of someone we’d invited into the building. That part still stings.

He wasn’t malicious. He was trying to do his job and chose the wrong path. It didn’t matter. We called him in, and he was let go immediately. Cracking credentials on a corporate network isn’t a judgment call, whatever the intent behind it. The act is the offense. I’d make the same call today. A consultant who’ll crack passwords because asking felt slow has already decided the rules are for other people, and I don’t want that judgment anywhere near a credential store.

That firing taught the organization something no policy memo could: the rules bind everyone, including the people we hired for their expertise, including people whose motives looked clean. If intent excused the act, every attacker caught mid-breach would claim good intentions, and some of the most damaging insiders have them.

The other flavor

Insider threats don’t all look like an impatient consultant. At another company I worked with, a colleague in my group uncovered an employee cooking the books, systematic financial fraud from inside the organization.

That one ended in prosecution and jail. At a third company, we discovered illegal pornography on an employee’s system; he was fired and the police were called in.

Three insiders, three motives: expedience, greed, and criminality. What they share is the thing perimeter security can’t address. Every one of them was already inside. Firewalls face outward. The consultant had legitimate access to the building, the fraudster had legitimate access to the ledgers, and no amount of perimeter hardening would have touched either.

That’s why I get impatient with security budgets that are all firewalls and no oversight. The perimeter can be flawless and a company can still lose its customer data, its money and its good name to someone who walked in the front door with a badge.

Why do you never hear insider threat stories?

Notice that you’ve read plenty about external breaches and almost nothing about incidents like these, and the silence is structural. Companies disclose external attacks because attackers are a shared enemy and victimhood is forgivable.

Insider incidents implicate the company itself: its hiring, its oversight, its controls. The fraud case ended in prosecution, which is public record, but the consultant and the pornography case ended the way most insider incidents end, in quiet terminations that never touch a press release.

Multiply that silence across every company, and the industry’s picture of its own threats tilts toward the outside. Executives read the breach headlines, fund defenses against the attackers in those headlines, and never hear about the consultant with the password cracker.

The distortion has a budget consequence. Security spending follows the visible threat, so it flows overwhelmingly toward the perimeter, while the controls that caught our three insiders, full scanning, financial oversight, verification applied uniformly, get funded as compliance afterthoughts. I don’t call the perimeter overfunded. The threat you never read about isn’t the threat you don’t have.

What catches insider threats?

Notice what found each one. A full scan, an audit control that inventoried every system without exceptions for systems presumed clean, caught the consultant. Financial oversight, the segregation-of-duties territory I cover in a companion article on documenting roles, not just rules, caught the fraud. Trust caught none of them, and tools pointed at the internet wouldn’t have caught any.

The uncomfortable summary: insider defense is mostly verification applied to people you’ve already decided to trust.

It feels rude, and it works anyway. Companies that skip it because checking on their own people feels awkward are choosing their own comfort over their customers’ data, and I don’t have much sympathy when it goes wrong. For executives who publish on security, the insider chapter is the one readers won’t get anywhere else, because companies bury these stories.

For more from this series, see The Cybersecurity Hub: breaches, audits, and hard-won security lessons from 33 years in the trenches.

Frequently Asked Questions