We Thought Helicopters Only Came In Parent Varieties!

I work in tech support. Not too long ago we switched to a different two-factor authenticator, as the other one was less secure and we kept having “annoyance intrusions”.

“Annoyance intrusions” are what my job calls them. A person has their account credentials compromised, and a third-party actor tries logging in. They are hit with 2FA (two-factor authentication) and decide to try their luck. The person who owns the account thinks nothing of it and ignores the prompt or hits “no”. The third-party actor tries again and again until the person finally gets annoyed and hits “yes” to shut their phone up.

After years of dealing with these kinds of intrusions, we convinced the higher-ups to switch to [Authenticator]. Actually, that’s a lie. [Authenticator] is cheaper than what we were using before, and that’s how we got them to approve the switch.

Anywho, we made the swap last year, and we kept running into something I call Helicopter Manager Syndrome. The manager would set up their entire staff on the 2FA for them. They would not have their workers grab the [Authenticator] app from the app store; they would just set it up for them and use secondary authentication methods like texts or phone calls.

Fast forward to this year. New security policies are in place. Malicious third-party actors are able to intercept calls and text messages, logging into accounts and compromising our network.

Now, 2FA is app-only. You forgot your phone? Guess you gotta drive home. Your phone was lost, stolen, or destroyed in a horrible paddle boat accident? Gotta get a new phone.

Let me introduce you to [HMS (Helicopter Manager Syndrome) Manager]. [HMS Manager] is a manager of over 150 underlings whom she treats like her children. Her perfect little angels need her to do everything for them.

Since the plague wiped out most of humanity and we all started to live in underground bunkers — or just permanently worked from home — [HMS Manager] has always been a bit extra when it comes to her hovering. If one of her underlings calls into the help desk, she has to be three-wayed onto the call. Her staff needs warranty work? Better write up a 4,000-word essay to explain why, or she won’t approve it. Actually, that one is easy as managers don’t approve warranty work and cannot interfere with that.

[HMS Manager] is the manager no one wants to work under and yet is the only choice due to location.

So, we send out the warning email stating that text and call methods will NOT work for logging into our systems any longer. Then, the second warning. Then, the third.

Yup, all ignored.

Finally, the day of the switchover comes, and [HMS Manager] is calling us, frantic. By this point, [HMS Manager] has lost over sixty percent of her underlings due to the economy.

HMS Manager: “You have to undo the change! We cannot use this horrible app!”

Me: “Thank you for calling IT; this is [My Name]. How may I assist you?”

There’s a small silence.

Me: “Hello?”

HMS Manager: “Can you hear me?”

Me: “Yes, I can hear you now. Thank you for calling into IT; this is [My Name]. How may I assist you today?”

HMS Manager: “I just… Never mind. You have to undo this horrible change! We need to be able to text to log into our accounts. This app is horrible!”

Me: “I understand that it can be a bit of a pain to set up, but once it’s up and running, it is good to go.”

HMS Manager: “No, it’s not. It’s popping up with full-screen ads and not letting us authenticate to log in.”

Me: “Uhh…”

HMS Manager: “And it cost forty dollars! Do you know how expensive it is for me to pay forty bucks for forty-seven employees?”

Me: “Well, I have some good news there. It is actually free. If the app you have is saying it costs forty dollars, it is not the correct app. Also, [Authenticator] does not have any ads, so that is not the correct app. You don’t have to pay for it.”

HMS Manager: “That isn’t true. I am looking at it right now on the [App Store]. It’s called ‘The Authenticator App’. It has a lock with a keyhole in it.”

Me: “Ma’am, [Authenticator] is free. It does not cost forty dollars. The one you are looking at is a fake provided by a malicious third party trying to steal your login credentials.”

There’s a long pause.

Me: “Have any of your guys tried to log in to the app?”

HMS Manager: “They tried, but it wouldn’t work with the QR code prompts from the logins.”

Me: “So, you are telling me that all of your employees have entered their usernames and passwords into this app?”

HMS Manager: “They tried to, but it doesn’t let them log in.”

Me: “But they physically entered the infor—”

HMS Manager: *Interrupting* “I JUST SAID IT WOULDN’T LET THEM LOG IN! WE DO NOT NEED TO ESCALATE THIS!”

While having this conversation, I am on our chat programs with the security department.

Me: “Hey… I am on with office [number] — you know, [HMS Manager]’s office?”

Security: “Don’t ruin my day, please.”

Me: “You know those fake apps that are charging forty dollars and stealing accounts?”

Security: “…Thank you for reaching out to the security department. No one is available to take your call at this time.”

Me: “Bro…”

Security: “Okay. Yeah, we know the app. It’s been all day with this crap.”

Me: “So, you know how [HMS Manager] is the most helicopter-est helicopter to ever ‘copter her underlings?”

Security: “English, please?”

Me: “I’ll order us some [Wings Place]. But yeah, her entire office bought this forty-dollar app and entered their credits into the app.”

Security: “Didn’t I just tell you not to ruin my day?”

Me: “Shut up. I’m paying for [Wings Place].”

Security: “Okay. I’ll get on the horn with [HMS Manager]’s boss and the CIO. Let them know that jimmies are about to be rustled.”

Right around this time…

HMS Manager: “DID YOU JUST DISABLE MY ACCOUNT?!”

Me: *Talking really fast* “Per security policies, I have informed the security department of the possible intrusion. Everyone in your branch has had their accounts disabled for their protection. If any of your employees use their [Our Company] password for any of their non-work accounts, it is suggested that they immediately change it.”

In my chat with security, the CIO is invited in, as well as [HMS Manager]’s boss.

CIO: “Hey, invite me into this call.”

HMS Manager’s Boss: “Yes! Me, too, please.”

So, I invite [Security], the CIO, and [HMS Manager]’s boss into the call and “accidentally” disconnect myself from it. In the chat…

Me: “Oh, I guess I accidentally transferred instead of added. [CIO], you have the call now.”

CIO: “Okay. That works for me. Mistakes happen. Not like you could have done any more, anyway.”

In a private message from the CIO:

CIO: “Smooth.”

[HMS Manager]’s entire office was down that day, and it took the security department four hours to set their office up on the correct [Authenticator] app.

The cherry on top was that the CIO ended up footing the bill for the buffalo wings!