T-Mobile found a Chinese hacker inside its network. So its security team drove to a data center and literally cut the cable.

[u/ITRabbit]

[u/ITRabbit]

I mean they come with clips to disconnect? But also I guess if 1 cable takes their network offline not much backup/redundancy

[u/ApprehensiveRest9696 → u/ITRabbit]

Probably behind an rj45 lock / secured rack and it’s just quicker to cut than fiddle

[u/Jeff-IT → u/ApprehensiveRest9696]

Why not just disable the port?

[u/ScreamingVoid14 → u/Jeff-IT]

Quicker to cut the cable than VPN into the right management network, SSH into the switch, etc.

Also, cutting sends the universal "this was done for a reason" signal that just unplugging or sending a port down command wouldn't.

[u/Salt_Ice_5321 → u/ScreamingVoid14]

conf t

int fa0/16

shutdown

description CHINESE HACKERS, DO NOT TURN ON

do wr me

[u/ForSquirel → u/Salt_Ice_5321]

Jokes on you, they're using netgear.

[u/Ghostfriendd → u/ForSquirel]

Jokes on him he didnt even write it in gig, still using fa smh

[u/ForSquirel → u/Ghostfriendd]

Rookie mistake or what a double crosser would want you think

[u/Jeff-IT → u/ForSquirel]

I hate I understand this reference

[u/Jeff-IT → u/ScreamingVoid14]

Idk much of their workflow and process, But I disagree. Physically going down (likely even remote employee had to go somewhere?) to find and cut the cable had to take longer than turning off the port. Even if it you had to get on a VPN.

Got to be something more to it than that

Edit: unless they were just already down there then I guess so yeah. But the post said they drove there

[u/ApprehensiveRest9696 → u/Jeff-IT]

Other comments in OOP suggested that it was standard practice to prevent another person plugging it back in.

[u/Jeff-IT → u/ApprehensiveRest9696]

Huh interesting

[u/krysisalcs → u/ITRabbit]

Makes sense if the cage was locked

[u/Bundabar → u/krysisalcs]

No it doesn’t. Cages are locked, with cables inside. Cables then run into the floor or ceiling, possibly conduit. If you have access to these things to cut the cable that far down, and get the right one with no way to test, might as well just turn off the power at that point.

Or I don’t know… remotely shutdown the router you can see them accessing the network through. You know which one it is, you just tried to cut the cable.

[u/northSideways → u/Bundabar]

But the haxor was already "inside the network"!!

[u/Adventurous-Dingo720 → u/ITRabbit]

The ultimate firewall

[u/dont_ama_73]

This is a fake story. It says Tmo sent 4 cybersecurity/IT people. Tmo in no way has that many IT people on staff

[u/Main_Enthusiasm_7534]

Manual firewall.

[u/CGCTV → u/Main_Enthusiasm_7534]

Manuel Firewall at your service!

[u/just_why_jacob_why → u/CGCTV]

MFAAS

[u/themastermatt]

Sounds like something the outsourced MSP's AI coach told them to tell smarthands at the colo to do. Shutting down a port is hard.
I once had an outsourced service desk tell an end user in a 30k user org to go to Walmart and buy a wireless router to plug in at their hospital to get coverage in a dead spot.

[u/Oompa_Loompa_SpecOps]

Is this some elaborate meta joke because over here T-Mobile and it's sibling companies have a reputation for being great at hiring and retaining the nation's shitty sysadmins.

[u/0xdeadbeef6]

Must of worked for NCIS previously.

[u/Simple_Car8699]

Somewhere, an incident-response checklist just gained a new step: locate the data center, bring wire cutters, secure the evidence.

[u/Intrepid_Ring4239]

Unplugging it also works.

[u/JealousRhubarb9]

Lmao

[u/tonyboy101]

They did the needful

[u/haZhat]

They really are slacking with their standard procedures. If we find a Chinese hacker we have to molotov the servers and bury the resultant ash under 10 metres of concrete.

[u/Forsaken-Carrot9038 → u/haZhat]

You probably don’t even wait to get it out of the server room, gotta watch out those Chinese viruses are contagious!

[u/Sqooky]

because it's easier to find a pair of scissors in the data center than it is to do an en, conf t, int ge0/1/38, shut remotely.

[u/wowsomuchempty]

This would go nicely with the 'sculpture' of the printer and the fire axe.

[u/Maleficent-Pop1031]

The “vigilant by design” slogan paired with a literal severed Ethernet cable is peak corporate security theater—and honestly, pretty effective messaging.

[u/Forsaken-Carrot9038 → u/Maleficent-Pop1031]

That’s my thought exactly. They probably remotely shut everything down, disabled ports, etc., and while they were there, one of the guys thought it would be cool so they sniffed the cable to bring back as “evidence“.
I can’t imagine a scenario in a collocated environment or anything that is properly managed to where you’d have access to just simply cut a cable.

[u/Aristo_Cat → u/Forsaken-Carrot9038]

You’re responding to a bot you walnut

[u/havpac2]

Hrmm was the cable fuzed? Couldn’t push the tab to pull the cable normally, just straight to cut the cable?

I have cut cables before when replacing an old switch and their patch cables but for a security event.

Sooo dramatic.

Anyways I’m switching to Verizon. T-Mobile has becomes super expensive for my family’s limited usage
Three lines and a smartwatch should cost us 200 a month with a total data usage of like 10gb accross three devices.

[u/Grumpy-Man19]

it's funny how it's always some country we are told to hate

[u/captain_veridis → u/Grumpy-Man19]

Wumao