I85PREP
⌘ K
Haryana Police Constable study materials
Haryana Police Constable study resources

One Shared Login, One Clicked Attachment

Haryana Police Constable · Put your knowledge to work in context.

All case studies

One Shared Login, One Clicked Attachment

A police station in a district headquarters runs on a single Windows desktop shared by nine staff using one login, 'ps_staff', with a password that has not been changed in two years. An email arrives addressed to the station, with the sender address shown as [email protected] and the subject 'Urgent transfer order - open attached'. The attachment is named order.pdf.exe. The text says the officer must enable macros and reply within two hours.

A constable opens it. The next morning, the station's FIR templates and scanned case files will not open, and a text file on the desktop in broken English demands payment in cryptocurrency within 48 hours. The constable's solution is to copy whatever still opens onto a pen drive, format the computer and reinstall Windows before the SHO returns, so that 'the problem goes away and the diary is not disturbed'.

1. Identify the attack and list every warning sign in the email that should have stopped it being opened.

Read the worked answer

The attack is a phishing email carrying ransomware. The attachment is a dropper: opening it installs a program that encrypts the station's files and leaves a ransom note. The chain is: look-alike sender → malicious attachment → execution by the user → encryption → extortion demand.

Warning signs, in order of seriousness:

  1. Double extension order.pdf.exe - Windows hides the real extension by default, so the icon shows a document but the file is an executable. No genuine order is sent as a .exe.
  2. Look-alike domain gov.in.in - a genuine government address ends in gov.in; the extra .in is a classic impersonation trick.
  3. Artificial urgency - 'within two hours' is designed to stop the reader from checking.
  4. Instruction to enable macros - macros are a standard delivery route for malicious code; a legitimate order does not need them.
  5. Generic salutation with no name, file number or office reference - real transfer orders carry these.
  6. Attachment instead of a portal or signed PDF for an official order.

Lesson for the station: a single rule - never open an .exe, .js, .scr or macro-enabled file from email, and verify any 'urgent' order by telephone to the number already in the station's own directory, never to a number given in the email.

2. Evaluate the constable's plan to copy files to a pen drive and reinstall Windows. What should be done instead, in what order?

Read the worked answer

The plan makes the situation worse in three ways.

  1. It spreads the infection - copying files to a pen drive can carry the malware to any machine the drive later touches, including other stations.
  2. It destroys the evidence - reinstalling Windows wipes the email, the ransom note, the malware, the logs and the timestamps needed for an FIR and for certifying the electronic record in court.
  3. It conceals the incident - an unreported ransomware attack on police data is itself a serious matter; hiding it converts a technical failure into a disciplinary one.

Correct sequence:

  1. Isolate, do not power off. Unplug the network cable and disable Wi-Fi so the encryption cannot spread to shared drives; keep the machine running so that volatile evidence is not lost.
  2. Photograph the screen showing the ransom note before touching anything.
  3. Inform the SHO and the district cyber cell immediately, and report the incident upward; CERT-In is the national reporting point for such attacks.
  4. Preserve: the original email with full headers, the attachment, the ransom note, and system logs; record who did what and when (chain of custody).
  5. Do not pay. Payment funds crime and does not guarantee a decryption key.
  6. Restore from a clean offline backup, then rebuild the machine from trusted media, patch it, and re-enable protection.
  7. Reset credentials, and require a password change for every account on the network.

3. Explain how the single shared login 'ps_staff' has made this incident harder to handle, and how an investigating officer would fix the practice.

Read the worked answer

The shared login destroys attribution. Nine people use the same credentials, so the system record shows only that 'ps_staff' opened the attachment - it cannot show which of the nine did it. In a disciplinary enquiry or a criminal case, that gap is fatal: the log is real evidence, but it points at nobody.

Other consequences:

  • No least privilege. Everyone, including the newest constable, can reach every FIR template and scanned case file, so the blast radius of one click is the station's entire record.
  • Unauditable access. Any change to a record carries the same account name, so tampering cannot be traced - a serious problem when records may be produced in court.
  • Password never changed in two years - once leaked, it gives permanent access; the same password may also be reused on other systems.
  • Misplaced accountability: the person who clicked cannot be identified, so blame drifts toward whoever is on duty, which is unjust and does not fix the cause.

Fixes an IO should insist on:

  1. Unique named accounts for every staff member, with the shared account disabled.
  2. Role-based rights - clerical staff read FIR data, only designated officers modify or delete it.
  3. A separate administrator account used only for installation and updates.
  4. Password policy: minimum length, periodic change, no reuse, and two-factor authentication for email.
  5. Logging and review of who accessed what and when, plus offline backups kept disconnected.
  6. Restrict USB ports and autorun, and block executables at the mail gateway.

Accountability has to be built into the system before an incident, not reconstructed after it.