User Fooling Websense?

So... I was looking at the real time analyzer when I noticed that my boss was supposedly browsing some sites from a machine in another building.....My boss is not at work today just to add to the problem....

The Machine also shows the actual user of the machine on at the same time in the reports.....

Now, I have not had any problems with this particular user, however there is one user over there who has been hitting the proxy avoidance sites... All of them blocked except for 2 that I found today that just went by IP address and were uncategorized at this time..... I turned in the report to his supervisor yesterday but i don't think they talked to this user yet.

Is it possible that someone is somehow spoofing my Boss's User name for this computer? I'm really not sure what to think of this... I did go to this other building and I saw that this user was logged in as their own name.

What else should I look at?

Thanks!

Find more posts tagged with

SAVE $250 on Your Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Boot Camps

Comments

Darthn3ss

he probobly got the username/password. we did that all the time in highschool. we used to get the teachers passwords to so we could browse the internet less-restricted. student accounts had just about everything blocked (world news, financial news, the simpsons, etc)

Megadeth4168

Thats what I was originally thinking... I just could not explain how it was showing 2 users on the same machine at the same time browsing different sites.

sprkymrk

Megadeth4168 wrote:

Thats what I was originally thinking... I just could not explain how it was showing 2 users on the same machine at the same time browsing different sites.

Can you open IE with the runas command? I never tried.

Mishra

sprkymrk wrote:

Megadeth4168 wrote:

Thats what I was originally thinking... I just could not explain how it was showing 2 users on the same machine at the same time browsing different sites.

Can you open IE with the runas command? I never tried.

Yup

Megadeth4168

sprkymrk wrote:

Megadeth4168 wrote:

Thats what I was originally thinking... I just could not explain how it was showing 2 users on the same machine at the same time browsing different sites.

Can you open IE with the runas command? I never tried.

Hmmm... I never thought of that! Good thinking!

My boss did change his password and made it much more difficult, so I hope that we don't see this problem again.

Thanks!

Megadeth4168

Good suggestion, but I just tested it and even though I'm "run as" a different user the reports still show me....

Sie

Was it exactly the same time or could he just be switching users when he saw you coming?