Flip The Script
Many years ago, working at a school, we used a piece of software that all staff had access to. It worked off databases and ‘scripts’; you’d run the script, and it would ask for input and go off and do whatever it was supposed to do, such as print a list of students in your class.
These scripts were limited in who was authorised to use them. There were scripts for teachers, for general staff, for admin, for payroll, etc, and if you didn’t have authority, then you could see the script, but the software wouldn’t let you run it.
Now, one major problem with this software was that all the scripts were visible even if you couldn’t use them, and there were so many that it was often difficult to find the one you needed. So, the software would let you ‘favourite’ a script, and that would place it into a list that only you could see.
Now I had a lot of training on computers, and my specialty was user interfaces and beta-testing software, so when I saw this system my first thought was “OMG, what a clumsy user interface” and then “Mwah-ha-ha. How can I make this crash?”
Much to my surprise, I discovered that you could easily view the code for any script you’d put in your favourite list, even one that you were not authorised to run. No apparent problem, since you still couldn’t run it. BUT, if you then created your own script, which anyone could do, and cut/pasted the code from the forbidden script into it… well, that was a different kettle of fish, and suddenly you were authorised to do pretty much anything, since you could obviously always run scripts you’d created yourself.
So, I went into the payroll scripts, changed my salary to be ten times that of the school principal, and reported the whole process to IT. There were a lot of hurried and late-night meetings, and for a while I was NOT very popular with the management. They really didn’t seem to share my sense of humour.
