Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
Network Security Businesses Operating Systems Software IT Hardware Technology

Former Sysadmin Accused of Planting 'Time Bomb' In Company's Database (bleepingcomputer.com) 143

An anonymous reader writes: Allegro MicroSystems LLC is suing a former IT employee for sabotaging its database using a "time bomb" that deleted crucial financial data in the first week of the new fiscal year. According to court documents, after resigning from his job, a former sysadmin kept one of two laptops. On January 31, Patel entered the grounds of the Allegro headquarters in Worcester, Massachusetts, just enough to be in range of the factory's Wi-Fi network. Allegro says that Patel used the second business-use laptop to connect to the company's network using the credentials of another employee. While connected to the factory's network on January 31, Allegro claims Patel, who was one of the two people in charge of Oracle programming, uploaded a "time bomb" to the company's Oracle finance module. The code was designed to execute a few months later, on April 1, 2016, the first week of the new fiscal year, and was meant to "copy certain headers or pointers to data into a separate database table and then to purge those headers from the finance module, thereby rendering the data in the module worthless." The company says that "defendant Patel knew that his sabotage of the finance module on the first week of the new fiscal year had the maximum potential to cause Allegro to suffer damages because it would prevent Allegro from completing the prior year's fiscal year-end accounting reconciliation and financial reports."
This discussion has been archived. No new comments can be posted.

Former Sysadmin Accused of Planting 'Time Bomb' In Company's Database

Comments Filter:
  • Backup, anyone? (Score:3, Insightful)

    by Anonymous Coward on Thursday April 13, 2017 @04:44PM (#54230735)

    Seriously, why would it even be an issue? Critical code and data, but not backed up?

    • RTFA, anyone? (Score:5, Informative)

      by tomhath ( 637240 ) on Thursday April 13, 2017 @05:06PM (#54230871)
      FTFA:

      Allegro's IT staff discovered the sabotaged Oracle finance module on April 14, 2016. Ten days later, on April 24, the IT staffers found Patel's malicious code after comparing the current database with a copy from older backups.

    • Re:Backup, anyone? (Score:5, Insightful)

      by Anonymous Coward on Thursday April 13, 2017 @05:08PM (#54230895)

      You think a malicious sysadmin wouldn't know to target the backups as well?

      • Or at least, have the code delete itself.

      • It took them two weeks to find it - after which the damage seemed to have been done.
      • A good sysadmin would have a job.

        • No, because a good sysadmin would like to eat something besides mac&cheese, and the company prefers to pay wages that would require you live with your parents rent free, and on your "special night" you can afford to spring for mac&cheese...for yourself.

          • No, because a good sysadmin would like to eat something besides mac&cheese, and the company prefers to pay wages that would require you live with your parents rent free, and on your "special night" you can afford to spring for mac&cheese...for yourself.

            So leaving and messing with the database gets you better food that mac & cheese. I'm not seeing your logic.

      • I don't think a malicious vindictive sysadmin has thought through any part of his life or what he is about to do. I don't credit these people with much in the way of brains.

  • by segedunum ( 883035 ) on Thursday April 13, 2017 @04:50PM (#54230763)
    They're using Oracle.

    .....and, backups??! But of course, that's a silly question.
    • by Thelasko ( 1196535 ) on Thursday April 13, 2017 @05:35PM (#54231071) Journal

      They're using Oracle.

      Seriously. If they were using SAP he would have never figured out how to sabotage it.

  • by Viol8 ( 599362 ) on Thursday April 13, 2017 @04:54PM (#54230789) Homepage

    "Eventually, they traced the unauthorized access to Patel's second business laptop based on the device's "electronic fingerprint.""

    Translation: Someone with a functioning braincell in the IT department googled about MAC addresses and thought maybe they should check the wifi router logs and look for unauthorised access by company issue laptops.

    • by AndroidCat ( 229562 ) on Thursday April 13, 2017 @05:07PM (#54230889) Homepage
      "return the second laptop because the device was capable of accessing Allegro's IT network"

      It sounds like they depend on the MAC address for access security, and not-a-one-of-them has ever heard of MAC spoofing. (Or a Pingles can for extending WiFi range to off of company property.)

      • by Anonymous Coward

        He wouldn't need to keep the laptop if all he had to do was spoof the MAC address. It sounds like they know more about network security than most Slashdot posters. Though, the articles are never clear on this so who knows. Anyway, what the company primarily at failed was proper asset control.

    • by Lumpy ( 12016 )

      Second translation: DB admins are pretty inept at IT. It's trivial to change the Mac address.

      Once again proving that those that do evil deed are typically pretty stupid and leave obvious clues.

      • by duke_cheetah2003 ( 862933 ) on Thursday April 13, 2017 @07:13PM (#54231607) Homepage

        Once again proving that those that do evil deed are typically pretty stupid and leave obvious clues.

        Na, just proves the stupid evil doers are still stupid. We never hear about the smart evil doers. If there is such a thing. :D We'll never know, if they're smart enough.

      • by Stealthey ( 587986 ) on Thursday April 13, 2017 @09:08PM (#54232129)

        Second translation: DB admins are pretty inept at IT. It's trivial to change the Mac address.

        Once again proving that those that do evil deed are typically pretty stupid and leave obvious clues.

        You missed the key point too.

        The anon poster before you had the right idea.

        He wouldn't need to keep the laptop if all he had to do was spoof the MAC address.>

        If all he needed was the mac address, then he didn't even need the laptop. He could have spoofed the Mac Address. Most likely there was additional network security which is why he needed the laptop. It could be a cert/key etc. too that was on the laptop which he couldn't spoof.

    • X.509 could also explain it.
  • and this is the only one to be made public
  • by BoRegardless ( 721219 ) on Thursday April 13, 2017 @04:55PM (#54230807)

    Who in the heck was monitoring for changes to Oracle's software? Too many unanswered questions.

  • Something tells me the company didn't care what sort of damage they did to Patel's year end financials when they canned him. Turnabout and all that. Maybe next time the company will consider using something as simple as two factor authentication to make something like significantly more difficult.
    • by Aeros ( 668253 )
      The article said he resigned.
    • by Afty0r ( 263037 )
      RTFA? "Canned him"? There's a pretty big blue paragraph heading stating he resigned. No evidence they canned him.
    • by hokeyru ( 749540 )

      Whatever the circumstances, professionals do not sabotage their former employers (or current employers, for that matter).

      Besides compromising your professional integrity, and risking criminal charges, it's just not work your time. Move on and live your life.

  • by 140Mandak262Jamuna ( 970587 ) on Thursday April 13, 2017 @05:06PM (#54230875) Journal
    I am sure a big company like Allegro will have all the critical information replicated in multiple locations. I am sure they restored all the data in a few seconds and laughed at the stupid sys admin. Right? That is how the story should have ended
    • by AmiMoJo ( 196126 ) <mojoNO@SPAMworld3.net> on Thursday April 13, 2017 @05:37PM (#54231097) Homepage Journal

      It's not worth posting stories about these amateurs. Everyone knows you don't just delete random stuff, you introduce subtle errors that can be passed off as genuine mistakes, and which take years to fully manifest, way beyond the point where backups can help.

      • Your homepage is actually really great. There is however a broken link on the front page.
      • Of course, but you keep all your noxious code always in the stack, rendered inactive by a script that you bring in your USB stick, and manually execute every six months. Then when you are no longer there to execute the script...

        Much safer than having to hack the network to delete things and leaving a trail and all that. Of course it's a lot of work, and perhaps your wife is right, and if you had used all that work for the benefit of your company, perhaps they wouldn't have fired you.

        • by sinij ( 911942 )
          Running script is easy-ish to detect and attribute. Much better is to have it periodically look for something unusual, but plausible, that only you would know to do. Like manual backup or some diagnostic test.
      • by sinij ( 911942 )
        AmiMoJo, I am pleasantly surprised that you are not entirely zen-like.
      • Re: (Score:2, Interesting)

        by Anonymous Coward

        An effective (and legal) way of screwing over an employer would be not to automate certain infrequent but mission-critical tasks. Just document what needs to be done (and when) in your well-written and exhaustive handover notes. If you're feeling unkind don't explicitly state why or how to perform such a task (e.g. "purge old logs from the database server instance weekly"). Bonus points if before you leave you pitch a project to automate essential maintenance tasks to your boss, and they shoot it down as a

  • is there a file anywhere with usernames and passwords? Is that jut mis-understanding and he cracked the hashes, or do these guys actually have everyone's password written down somewhere?

    An yea these days, if your shit matters, you need 2FA of some sort.

    Also, apparently, you need the guy who checks in the returned laptops to check serial & model numbers...

    • by Kiralan ( 765796 )
      From the article: Patel had access to employee credentials because he was one of the company's senior system administrators, and kept a copy of a file with usernames and passwords on his laptop.
      • by v1 ( 525388 )

        I don't care if you ARE a senior system administrator, you have NO business having a list of user passwords. You have no business having anyone's password, EVER. There are times we need to connect as a user or login to their network account to fix a problem or test something. When that happens, we reset their password, do our work, hand them over the reset password, and their account has the "must change password immediately at next login" flag set. (A) we never know their password old OR new, (B) we ge

        • by rossz ( 67331 )

          So much this. The only time I know someone's password is when I set it the first time with a forced change the first time they log in, typically minutes later. I don't want to know anyone's password, nor do I need to know anyone's password.

          When someone leaves, I immediately nuke all of their account credentials, often before they even exit the building.

        • But, you do know the "password" is not the key to the account?

          As a "sysadmin" I can basically always use your account without you noticing and without knowing your password. How to do that ofc varies from OS.

          • by v1 ( 525388 )

            But, you do know the "password" is not the key to the account?

            As a "sysadmin" I can basically always use your account without you noticing and without knowing your password. How to do that ofc varies from OS.

            I've seen that feature in directory services, when you go to the directory admin account configuration. "Use directory admin password to masquerade as other user". Basically means the diradmin master password will authenticate ANY account if you check that box. I've never used that before, and we don'

  • That said, how do they know it was said person? This is an accusation, not a proven fact.

    More likely one of the senior execs deleted the files to cover up some theft on their part.

    Never assume.

  • How does one calculate the damages a company suffered by being rendered unable to generate financial reports?
    Unless their business is generating financial reports, that does not seem like that would get in the way of producing whatever it is they produce. And if they do not know how much money they have, how can they ever estimate how much they lost?

    • by dbIII ( 701233 )

      How does one calculate the damages a company suffered by being rendered unable to generate financial reports?

      Part four of this (about half way through it) has an example (about half way through it) of how ridiculous damage estimates for computer crime were "determined".
      http://www.mit.edu/hacker/hack... [mit.edu]
      Damage of $79,449 was determined (in itemised detail) for downloading a document that could be purchased in hard copy form for $13.

      Sadly the same sort of reasoning still applies.

    • How does one calculate the damages a company suffered by being rendered unable to generate financial reports?
      By the fine they get and by the time/efford they need to recover the data and finally deliver the report.

  • So the best evidence they have is the MAC address of the wifi adapter of the business laptop that wasn't returned. We all know how immutable that is.

    The article seems merely to be parroting the court documents that were filed by Oracle, leading to a one sided story. Just as likely Patel is being being thrown under the bus for someone else' screwup, or perhaps a case of industrial sabotage. Excuse me if I don't assume anything Oracle is alleging as true.

  • Isn't this illegal hacking? Call the FBI.
  • by nuckfuts ( 690967 ) on Thursday April 13, 2017 @05:36PM (#54231077)
    FTA:

    Eventually, they traced the unauthorized access to Patel's second business laptop based on the device's "electronic fingerprint."

    By "electronic fingerprint", I suspect they're referring to the MAC address of the laptop's WiFi adapter, in which case the guy is a bit of a noob for not spoofing it.

    • by dbIII ( 701233 )
      Personally I think it smells like insurance fraud by blaming a convenient ex-employee for a fuckup. If it was real I think the police would be very interested and the guy wouldn't just be getting sued.
    • Simply depending on a MAC address alone would be an amateur move. A talented investigator will not rely on a single fingerprint. Instead, the professional will balance the reliability (e.g. resistance to tampering) and identifiablity of multiple fingerprints. For example, one will search logs for hostnames, UUIDs, usernames, etc. Amongst other things, this is what keeps the professional from getting (too) hung up on concluding that it was the user who's credentials were stolen. I'm also sure that the fac
  • by CaptainDork ( 3678879 ) on Thursday April 13, 2017 @05:36PM (#54231083)

    ... for a sysadmin.

    Know where the logs are and erase the goddam things.

    • by DogDude ( 805747 )
      Nothing in the article said he was a sysadmin. It says he was an Oracle programmer.
      • From TFS:

        According to court documents, after resigning from his job, a former sysadmin kept one of two laptops.

    • ... for a sysadmin.

      Know where the logs are and erase the goddam things.

      For a sysadmin who left their job and then decided to vindictively retaliate against his former company, you actually think they have brains?

  • An administrator leaves a company. A few weeks or months later, things start to fall apart. This tends to happen even if there's no malicious code involved.

    • This could also happen if they forgot to renew the software.

      A long time ago, I remember it was fairly common practice, in fact.

      But, hey, I'm sure the relative of one of the execs they hired is good at his job.

      • by roc97007 ( 608802 ) on Thursday April 13, 2017 @06:56PM (#54231553) Journal

        "This could also happen if they forgot to renew the software."

        Absolutely. The biggest time bomb of all might be simply to decline to share the file of license renewals. The company starts to feel the results of *that* after the admin is long gone. And all the warning messages go to the admin's closed account, or to a service account that nobody checks since he left.

        The problem is, the results are indistinguishable from the case where the admin passed the information to "transition management" prior to being outsourced, only to have them lose it, so he gives them his spare copy, and they lose that also, and then a few months down the road when appliances and software suddenly stop working, offshore management blames the former admins for the debacle(s).

        Don't ask me how I know this.

  • Hello, jail time. Or prison time, perhaps. Either way it sounds like they have this clown dead to rights.

    • by dbIII ( 701233 )
      If it was real yes.
      He's being sued instead of being subject to a criminal investigation. I think that's an indication that there is less going on here than was claimed. If you are going to accuse an ex-employee of a crime and you are confident that they actually did it surely it's time to call the police instead of suing them?
      If they really did have him dead to rights I think you will find that the police would be involved - there is theft in the allegations to start with and it goes on from there into st
      • He's being sued instead of being subject to a criminal investigation. I think that's an indication that there is less going on here than was claimed. If you are going to accuse an ex-employee of a crime and you are confident that they actually did it surely it's time to call the police instead of suing them?

        Depends on what you want. If you smashed my car and I had the choice between (a) you going to jail for a year, or (b) you paying for all the damage, I'd want to get paid for the damage (if for some reason no insurance would pay). They might say "it's $500,000 damage, the guy is 40 and can work for another 25 years and pay $20,000 a year for the damage".

        • by dbIII ( 701233 )
          Maybe but your example is very different and a little bit contrived.
          This thing's into medieval "weregild" territory where a crime with damage gets paid off. It's not the way crimes are normally dealt with in the west.
          Seriously, if it's as bad as suggested why are the FBI not all over this? They've kicked up a huge fuss over far less in the past.
  • This is one of those cases where people really need to learn to let their anger go. I'm sure this guy thought he was smart; that he could take precautions. Maybe he even avoided all the security cameras. Maybe it was one ticket sitting in a provisioning system that said that laptop was last on his desk. No matter how well you think you've covered your tracks, in companies that big, there will be a record.

    I'm reminded of the kid who sent a bomb threat via Tor to get out of something at his University. They d

  • Is it real? If so why not criminal charges?
    It really looks a lot like trying to blame an ex-employee for a fuckup If this was real there is a long list of law enforcement types that would be very interested.
  • https://www.linkedin.com/in/ni... [linkedin.com] Although I'd consider that there is a possible chance that they were actually hacked instead.
  • ... if the Sysadmin sabotaged the back ups, too.

    Sorry, stories like this are just ridiculous. A guy who knows his business surely knew that the company has back ups. And a "End of Year" is usually not calculated over the last 365 days, but over the last 11 or 12 "end of month" and the last 1, 3 or 4 or 5 "end of weeks". Depending how and when you make "the end of month".

  • http://www.marketwatch.com/sto... [marketwatch.com] "I suppose that as the case of the programmer, Rajendrasinh B. Makwana, is brought out into the open we'll discover whether he's just a disgruntled programmer irked at being let go by Fannie Mae in October, or someone with more sinister intentions. It was only a fluke, according to all the reports Friday, that a malicious piece of code was found on the Fannie Mae FNM, -6.82% servers. It was designed to go off Saturday and erase all the data and screw up the company. It w

The Force is what holds everything together. It has its dark side, and it has its light side. It's sort of like cosmic duct tape.

Working...