Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Crime Networking Security IT

Company's Former IT Admin Accused of Accessing Backdoor Account 700+ Times (bleepingcomputer.com) 63

An anonymous reader writes: "An Oregon sportswear company is suing its former IT administrator, alleging he left backdoor accounts on their network and used them more than 700 times to search for information for the benefit of its new employer," reports BleepingComputer. Court papers reveal the IT admin left to be the CTO at one of the sportswear company's IT suppliers after working for 14 years at his previous employer. For more than two years, he's [allegedly] been using an account he created before he left to access his former colleagues' emails and gather information about the IT services they might need in the future. The IT admin was fired from his CTO job after his new employer found out what he was doing.
One backdoor, which enabled both VPN and VDI connections to the company's network, granted access to a "jmanming" account for a non-existent employee named Jeff Manning...
This discussion has been archived. No new comments can be posted.

Company's Former IT Admin Accused of Accessing Backdoor Account 700+ Times

Comments Filter:
  • Poor Governance (Score:3, Insightful)

    by jeauxkewl ( 1465425 ) on Sunday March 19, 2017 @11:40AM (#54069065)
    This is why you need all accounts backed by an HR system. The employee record changes to anything but active, all access is automatically revoked. It amazes me in this day and time that there are still rogue accounts in large enterprises. This is also a great case for single sign-on where you kill all access in one place.
    • Re:Poor Governance (Score:5, Informative)

      by chmod a+x mojo ( 965286 ) on Sunday March 19, 2017 @12:02PM (#54069121)

      Yeah... because the guy setting up that system wouldn't be able to hide anything he wants outside of the system on those servers. You know, like hiding a backdoor, I mean it's not like he was the ADMINISTRATOR, and had full unlimited access to the servers for a long time or anything....

      You can make all the damn rules and regulations you want, but in the end you are bound to having to trust the people who have full access to the systems to implement those rules properly. There will always be someone somewhere in the setup chain that will not be bound to those rules yet, as the settings and rules won't exist on the servers yet.

      • Not disagreeing with you at all, just saying proper governance minimizes the risk. Their governance was shit.
        • Re:Poor Governance (Score:5, Insightful)

          by rickb928 ( 945187 ) on Sunday March 19, 2017 @12:32PM (#54069213) Homepage Journal

          Security based on access control alone is inadequate. It must be supported by auditing and reporting.

          Then you can audit enabling and use of services and access, justification and documentation of users and their accesses, and confirmation of declined/terminated access.

          • It must be supported by auditing and reporting.

            This is totally true and feasible in the enterprise. I work for a company that sells a product that aggregates all existing accounts, and then periodically sends out emails to managers saying, "Here's a list of accounts belonging to your team." The manager has to approve each one or revoke them. That way, there is accountability down the road if it turns out there were lingering accounts that shouldn't have been accessible or exploitable. Can also be used to

            • by Anonymous Coward

              We have something similar... They have a choice of tasking themselves or their employees to track down accounts, disabling accounts that they don't think are necessary and risk breaking something, or just saying the account is still necessary and moving on. What do you think most managers do?

      • Yeah... because the guy setting up that system wouldn't be able to hide anything he wants outside of the system on those servers. You know, like hiding a backdoor, I mean it's not like he was the ADMINISTRATOR, and had full unlimited access to the servers for a long time or anything....

        You can make all the damn rules and regulations you want, but in the end you are bound to having to trust the people who have full access to the systems to implement those rules properly. There will always be someone somewhere in the setup chain that will not be bound to those rules yet, as the settings and rules won't exist on the servers yet.

        Oh noes! He was the ADMINISTRATOR? In ALL CAPS? It's almost as if after the shitbird was shitcanned, the OTHER ALL CAPS ADMINISTRATORS should have been auditing service accounts and user accounts. These were deeply hidden "backdoors".

      • Indeed here's the ranking of who has the power to decide how things actually work in a modern company, from least powerful to most powerful:

        Line workers
        Line supervisors
        Mid management
        Directors / VPs
        C*O
        Board of directors
        System administrator

        If the system administrator wants all of the CEO's documents to disappear, they can make that happen, during their employment or even after they are no longer employed. A company should be careful who they have doing system admin, because the admins can read all of your ema

    • And that brakes some automated system or dumb HR system has IT admin = ROOT and blocking root shuts down the system in full.

      • And that brakes some automated system or dumb HR system has IT admin = ROOT and blocking root shuts down the system in full.

        It would shut the system down, but only after the brakes are applied for a sufficient amount of time to bring everything to a halt.

    • Re:Poor Governance (Score:5, Insightful)

      by mindwhip ( 894744 ) on Sunday March 19, 2017 @02:16PM (#54069519)

      He didn't access his own account. He set up a "fake" account for a 'fake' employee that didn't exist which could be done even using the HR link if he he had access to add records to that database. Or he could have set up additional access on some other employee (say a driver) who rarely used the wider computer systems and wouldn't notice the extra access.

      But HR links like that don't really work in the real world anyway. It doesn't allow for most large corporate set-ups where mainframe needs to talk to linux box that needs to talk to an oracleDB that needs to be accessible by a java batch job that needs to write output to the windows domain server file system so a human can check it before uploading it to an SFTP gateway box for an external customer to collect.

      You don't just have accounts that are pure user accounts. You need mechanisms and accounts to allow system to system communications and logins for moving data between automated systems and for a large company it would be easy for an admin with sufficient privileges to hide a back-door amongst all these inter-system communication accounts (or even just hijack one or two legitimate ones, having copied passwords and other keys).

    • by TheCarp ( 96830 )

      > It amazes me in this day and time that there are still rogue accounts in large enterprises

      I would like to be shocked but, I got over that years ago. I actually got called to a desktop support case once that turned out to be "someone broke in". Did some random damage to equipment that didn't make sense (looked like they had a go at the floppy drive of an old laptop with a screwdriver, in a rather rude way)

      Before I updated my ticket and left it up to security to deal with though.... I did think to check

  • by Anonymous Coward on Sunday March 19, 2017 @12:08PM (#54069139)

    IT people usually have all the keys to the kingdom, and when they leave, anything that might go wrong they will be scapegoated and blamed for by current management. For people who actually want to run a reasonable business that isn't full of a bunch of sociopaths playing masturbatory politics, whenever a manager blames the last person in a position, they are really doing is eliminating their own ability to learn and grow. Depending on the enterprise, that can lead to legal shenanigans as well.

    Once you're out the door, you're out. Don't even leave yourself the ability to VPN into work or access systems, don't try, don't even ping the external IP's. If management needs you after that, you charge contractor rates, 50% upfront, 50% at time of delivery, all in writing, and watch for bankruptcy filings so you can get yours in first.

    With that said, guy obviously did not have the slightest clue on IT security or he'd figure out how not to get caught.

    • by rl117 ( 110595 )
      Exactly. If you're ethical, you won't leave any access possible, so there's no doubt as to your integrity. When I left my previous employer, a small business where I had full admin rights (I set most of it up), I made sure to wipe all my ssh keys, lock and delete my accounts so that the company directors could be sure I no longer had any access, remote or otherwise. No cron jobs, no source code, no customer information. A few months later they asked me if I could look into a problem that cropped up, and
  • by Anonymous Coward

    This is just a plain and simple dishonest individual. Too bad they have to give IT professionals a bad name. He needs to be in jail.

  • by sjbe ( 173966 ) on Sunday March 19, 2017 @01:33PM (#54069395)

    An Oregon sportswear company...

    Why the generic descriptor? Say the name of the company - Columbia in this case. It's not as if no one has ever heard of them or they need their identity protected. Plus the company is named in the article.

  • If you fail to pay severance benefits, one has to help oneself!

  • by pepsikid ( 2226416 ) on Sunday March 19, 2017 @03:17PM (#54069727)

    I'll just leave this here:
    http://io.fondoo.net/ [fondoo.net]

    "Fun fact: you could telnet to password.io.com from anywhere in the world, and log on as guest. Lynx, a text-only web browser, was configured as the shell, and you would then be presented with a sparse version of the web-based customer account tools found at http://password.io.com/ [io.com]. This was so customers could reset their own password, update their address, set their PLAN file, etc.

    IO forgot to disable browsing the filesystem (press g, period, enter). Also, IO never enforced uniform file and directory permissions or audited active accounts. As a result, through 2004, after IO was taken over by Prismnet (or later), you could roam around and directly view many customer's private files, email, and IO's sensitive system areas. You could also open the Lynx config to define a custom "editor" and thus actually edit files, or run executables. This was a direct back-door into everything! This continued a full two years after IOCOM "hardened" their network to sell network security services."

  • by ErichTheRed ( 39327 ) on Sunday March 19, 2017 @04:32PM (#54069989)

    Even in large companies, many sysadmins have full access to everything, especially those involved in any sort of identity management. In most WIndows environments and projects I've worked on, I've either had or had the ability to gain domain admin access, which is basically as good as having full access. Since we're not licensed professionals, most of us don't learn anything about ethics or the way to responsibly manage your access. I do want to keep my reputation somewhat intact, so whenever I leave an employer or get assigned to another project where I don't need the access, I'm very careful to give it up completely. I take the time to ensure everyone involved knows I've disabled accounts and handed access over to the next person. I've had a couple times where an employer has asked me to come back and help the new guy for a couple hours, and I make sure they create new accounts and remove them immediately. It makes sense -- you wouldn't let an employee you fired keep his badge and keys regardless of the situation.

    Of course, this situation sounds like the person was planning from the outset to set up his own backdoor and use it. As much as I hate the idea of malpractice insurance, I think it might be time for something similar in the IT world. Computers and access to them are more important than ever and having someone do something like this can damage a company's results and reputation.

  • A lot of employers I've been in don't need a "backdoor", because their access-controls and account-management are so effing terrible there's almost always remnants of old accounts.

    I had an old-old employer of mine for whom some of their sites were still emailing for years after employment with "hey, we miss you, please come back." I've never bothered to see if I still have admin-level access, but I wouldn't be surprised?

    How can this be, you ask? Well they wanted us to use usernames and email addresses that

  • by Anonymous Coward

    Before you hang this guy out to dry, please keep in mind---innocent until proven guilty.

    First, this is not back door access. (Something he could have set up.)
    This is leaving yourself keys to the front door though legitimate accounts regulated by IT and company security.
    Back door access would be installing an unauthorized program that provides remote access without the knowledge of company IT.
    That is to say you cannot claim back door when the user is legitimately logging in through the employee VDI.

    I wish to

  • "Jeff Manning" is the name of the most famous political reporter in the Portland metro area. He reports for both The Oregonian, the only daily newspaper, and for Oregon Public Radio, the state network of NPR-affiliated public radio stations.

"Joy is wealth and love is the legal tender of the soul." -- Robert G. Ingersoll

Working...