Question re 'hacking' ToCo results

[Eliot]

Is it possible for someone with a great deal of computer expertise to 'hack' into the computer of the main security boss, and alter ToCo results?

This is what seems to have happened to a friend of mine, who cannot post right now as he's working.

His 4 nightly rounds have not been logged in the system, although he swears that he used the 'wand' at each check-in point, and it appears as though he has done only 2. This has happened for several nights in a row and he is in danger of losing his job.

Although I don't know much about the ToCo system, I know enough about computers to know that altering these records seems quite feasible, but it's hard to trace or track.

Does anyone have any idea of how this could have happened, or could you point me in the direction of someone who can help?

I'd be grateful for any help you can offer, my friend's job could well depend on this.

Thank you so much.

[Tsalla Apopka]

Sure any computer can be hacked but the question would be why? What would someone gain from doing that? Does he have an enemy that would go to that much trouble?
I would first consider a problem with the system. There is the wand sensor unit, the communications link to the main computer and the main computer itself to consider for a failure. If I was him I'd take a video camera on shift and video each wand touch with the time/date stamp on. It could be somewhere a "hand-shake" is not taking place and the results are not being recorded.
And it could be the boss just wants to fire him and is faking the results??????

[Eliot]

Thank you very much, Tsalla Apopka, for your helpful reply.

Yes, he does have an enemy, another guard who has boasted that he's able to hack the system.

It does not seem likely in this case that the boss is to blame.

I think the video camera is a very good idea, I'll pass it on. Even a still camera with the date showing would help.

I would like to thank you all, and especially the Webmaster, for allowing me to post here, even though I'm not a security professional. :-)

[ScottFree]

All to often i find that these so called "expert hackers" leave footprints that arent to hard to find, since there some things that you just cannot cover up.

I suggest your friend cover his bottom at all times and start to document anything that he suspects.

The best way to handle this situation is to let whomever is doing this think they are getting away with it while you clearly document,or in this case photograph,your proof.

The computer that the big boss uses. It is on a network? Is it standalone? What does it run?

No matter what happens the time is now to insure that all work functions are carried out properly and completely, that way when this thing does come out your proof can dispute any "facts" that happen to come to light.

[Eliot]

Thank you for responding, ScottFree.

You're right about these 'expert' hackers, and I'm pretty sure that any reasonably savvy tech person could find the trail. The question is whether the boss is prepared to have his computer checked, right now he seems to think that my friend is inventing this to excuse his slacking.

The computers are networked, the OS is Windows, XPPro, I think.

I think those are very good suggestions, the more proof he has, the better. It would only take one dated photograph clearly showing him using the wand and the result not appearing on the computer to make all the other results (or non-results) suspect.
As you said, not to let the other guard suspect what's happening, or he will stop at once, and it will be impossible to get that evidence.

One hopes that the boss has not already passed on the information that my friend has suspicions that he's being framed.

Of course, as Tsalla Apopka pointed out, it could be a failure of the wand or the computer system, that's always a possibility. But this seems not to have happened with any other guard, so it's more likely that the system has been hacked. I wish I had access to the boss's computer, I'm sure I could find the necessary evidence.

Thank you again for your helpful advice and suggestions, I'll pass them on.

[FireRanger]

Playing devil's advocate here, lets say the boss does have something out for your friend. If the client's / site policy states that taking photographs/use of video cameras is not allowed without consent. Your friend may get himself into trouble for violating that policy.

[justlogic]

If there is no site video of your friend making the rounds and this friend is endanger of being terminated anyway.This friend may want to start covertly video recording themselves doing the rounds as a part of their routine and keep these recordings for future use. I have done similar things in the past with audio and video and not only did it save my butt, a VP came up and caned a few worms including a regional manager. Facts without evidence is just a story.

[txinvestigator]

I think it is FAR more likely your buddy is not doing his rounds.

[sig229]

The most obvious thing to check is whether the computer was asleep or on standby when he put the wand in the reader. Unless the computer is active it won't read it. Pretty obvious but some don't know this.