Shelby Medical Center really thought nobody would notice?

Okayyy so can we talk about how ridiculously easy Shelby Medical Center made this for us?? 😭

Me and d34th have been having a little fun with their systems lately, and honestly, I'm almost offended by how little effort it took.
Everyone's always looking for some crazy exploit or secret backdoor, but babes, sometimes all you need is a little charm and someone who's way too trusting. 💋

Turns out one of Shelby's registered nurses was a lot better at taking care of patients than protecting her credentials. A little social engineering on my end, a little convincing, and suddenly we had ourselves a perfectly legitimate username and password.

Like, an ACTUAL employee account. No fake identities. No suspicious new users. Just a nurse who had absolutely no idea she was sharing her digital life with DEADFACE. Iconic, honestly. 💅

And here's where it gets cute.

While our favorite nurse was busy working her overnight shifts, d34th and I were using those same credentials to access patient records. We weren't even coming in from some sketchy overseas address. We had access through their internal VPN, so as far as their precious security systems were concerned, we looked like another employee going about their business.

The best part? She was still logged in and working while we were using her account.

Literally. Same credentials. Same moments. Different workstations.
She's checking patient charts at one nursing station, and we're pulling records from somewhere else. She's doing her rounds, and we're printing and exporting data. Two completely different people using one perfectly normal employee account at the exact same time.
And nobody noticed. FOR DAYS. 😂

I mean, how embarrassing is that?

Their logs probably look sooooo clean, too. Just a hardworking nurse accessing patient information during her shift. Nothing to see here, right?

Except, like... unless Shelby's hiring nurses who can teleport between workstations, somebody should probably start asking questions. 🤭

Anyway, d34th says I shouldn't get too comfortable bragging about this stuff, but what's the point of doing something fabulous if nobody gets to appreciate it?

Shelby, sweetie, your security is giving trust issues.
xoxo, luciafer 💋

I specifically told you not to elaborate on our access methods. Nevertheless, the underlying problem is clear: Shelby trusted valid credentials without adequately verifying the activity behind them. Their assumption worked in our favor.

LMAOOOO imagine being on shift and some random hacker is out there clockin in with u 💀💀 shelby securty team boutta need medical attention themselves

Two workstations. One identity. No questions asked. Impressive negligence.

omg relaxxxx 🙄 I didn't even say which nurse. They've got plenty of them.
Besides, if their security people can't figure out why one nurse apparently needs to be in two places at once, that's a Shelby problem, not a me problem. 💋

Lucia, you've made your point. Stop giving their investigators free information.
And d34th is right. There is a difference between exploiting someone's complacency and becoming complacent ourselves.

Not both of you lecturing me in my own thread 😭
Fineeee. No more details.
But you have to admit, getting into a hospital without breaking into a single account system? Kinda ate.
Shelby can keep their fancy security dashboards. I'll keep the receipts. 💅