Slashdot Mirror

← Back to Stories (view on slashdot.org)

Searching For Backdoors From Rogue IT Staff

Posted by CmdrTaco on from the i-left-you-a-present dept.

WHiTe VaMPiRe writes "When IT staff are terminated under duress, there is often justification for a complete infrastructure audit to reduce future risk to a company. Here is an exploration of the steps necessary to maintain security." Of course the first piece of advice is to basically assume you've been rooted. Ouch.

69 of 328 comments (clear)

  1. the work involved.. by Nick · · Score: 5, Insightful

    to audit your system under the assumption you've been rooted should happen once a year at a minimum anyway, not just when you suspect a rogue employee left on bad terms. I've worked at places that never changed passwords and I found former employee logins enabled from months ago..

    --
    Fuck Ajit Pai
    1. Re:the work involved.. by arth1 · · Score: 5, Interesting

      It's fairly impossible to audit all systems to the extent needed. You can easily burn enormous amounts of money and time doing that, and the remedies can disrupt production more than the damage the disgruntled employee would do.

      There are so many ways to hide what you're doing that even rebuilding all systems isn't enough. Dangers can hide not only in backdoors, but dead man switches built in to compilers, stored procedures in databases, backups, or the Boss' PC, for that matter.

      So instead of sending good money after bad, it can be immensely sensible to let things be and instead try to ensure that the employees don't leave disgruntled.

    2. Re:the work involved.. by bloodhawk · · Score: 2, Insightful

      That would be nice but is in reality completely impractical. The time and money to do such an audit properly would be more expensive than just rebuilding your entire environment from the ground up. I could effectively hide a rooted box or backdoor on windows or *nix systems I look after that unless you are going to strip the boxes and mount the drives on seperate boxes to check the binaries you are simply not going to find the holes.

      The ONLY way to handle a suspected rooting is a rebuild, anything less is always an assumption that your smarter at finding the exploit than they are at hiding it.

    3. Re:the work involved.. by techno-vampire · · Score: 4, Interesting
      It's fairly impossible to audit all systems to the extent needed.

      If the back door is as well hidden as the one Ken Thompson hid in an early version of Unix, a complete audit of the source code and complete recompile of everything won't be enough to get rid of it. Of course, not many people are capable of pulling that kind of stunt off.

      --
      Good, inexpensive web hosting
    4. Re:the work involved.. by techno-vampire · · Score: 2, Informative

      I take it, then, that you didn't follow the link I gave, because the whole point of the hack was that none of it was in the source code. The compiler was hacked to add code to login when it compiled it, and to add code to itself (if it were recompiling itself) to do the work.

      --
      Good, inexpensive web hosting
    5. Re:the work involved.. by Kidbro · · Score: 3, Informative

      Of course there was source for the hack at some point. However, this source "disappeared" (i.e. was reverted) after having been compiled once. Subsequent recompiles (of login, or the compiler itself) by an already contaminated compiler propagated the hack.
      In practice, there was no way to get rid of it without compiling the compiler with a compiler that was known to be uncontaminated - something you had no easy way of verifying (or even suspect that you would need to verify).
      Remember that at some point, you need to start with a binary (compiler) that you simply have trust (well, at least in practice - in theory you can build your own computer from the scratch with twigs and bubble gum), and unless you're God himself, that binary was probably built by Ken.

      --
      May we live long and die out
  2. Three words by pjt33 · · Score: 4, Insightful

    Dead man's switch.

    1. Re:Three words by frinkacheese · · Score: 2, Funny

      It's great for a bit of extra consultancy work when you have been made redundant too.. Walk out and guess what, a week later things break and you're on $1000 a day fixing it ;-)

      But really, the best thing to do is to treat your IT staff properly in the first place.

    2. Re:Three words by Ironhandx · · Score: 2, Interesting

      This.

      I've worked in a highly stressful environment before where I didn't know if I was going to still have a job the next day or not. I had everything set up sufficiently complex but still for good reasons, that if they had fired me getting someone else to fix it would have been a nightmare and cost them a fortune, which they would find out as soon as they tried to get someone else to go in and fix it.

      Since I left on good terms I overhauled everything before I left and took out most of the non bog standard bits I had implemented. They ended up with a slightly worse but fixable in a pinch system.

      Had the work environment been less stressful I wouldn't have felt it necessary to go through all of the trouble, but they decided to make it that way, so I decided to build some security into my job that was otherwise nonexistant.

    3. Re:Three words by CharlyFoxtrot · · Score: 5, Insightful

      But really, the best thing to do is to treat your IT staff properly in the first place.

      This. I don't understand why it's so hard to grasp for some organizations. Pissing off IT is like telling your mechanic he's an asshole while he's working on your brakes. Sure most are consummate professionals but sooner or later you'll hit on one that isn't and then there'll be hell to pay.

      --
      If all else fails, immortality can always be assured by spectacular error.
    4. Re:Three words by Anonymous Coward · · Score: 5, Insightful

      This.

      I've worked in a highly stressful environment before where I didn't know if I was going to still have a job the next day or not. I had everything set up sufficiently complex but still for good reasons, that if they had fired me getting someone else to fix it would have been a nightmare and cost them a fortune, which they would find out as soon as they tried to get someone else to go in and fix it.

      Since I left on good terms I overhauled everything before I left and took out most of the non bog standard bits I had implemented. They ended up with a slightly worse but fixable in a pinch system.

      Had the work environment been less stressful I wouldn't have felt it necessary to go through all of the trouble, but they decided to make it that way, so I decided to build some security into my job that was otherwise nonexistant.

      This is still an extremely unprofessional thing to do. What if it breaks while you are on vacation? What if something happens to you? What if you get mono and can't work for three months? What if you get in a car accident and are in the hospital for months? What if your code gets audited and you get called out for writing shit code?

    5. Re:Three words by Cramer · · Score: 5, Informative

      I'm sorry, but that's the a**hole way of running a network... make the place unnecessarily complex so you're the only one who knows how any of it works so "they don't dare fire me." That rarely works out well -- and often encourages firings. Having been the replacement and consultant called in to sort it all out, I support the death penalty for such people.

    6. Re:Three words by drsmithy · · Score: 2, Insightful

      I don't understand why it's so hard to grasp for some organizations.

      Because even after multiple demonstrations otherwise, upper and executive management cling tightly to the fantasy that experienced mid-level+ IT (and other) staff are generic and can be disposed of and replaced at will, with essentially no loss to productivity.

    7. Re:Three words by PitaBred · · Score: 4, Insightful

      If they cared about that shit happening to him, they would have treated him better. What goes around, comes around. They aren't treating him well enough to care.

      --
      My blog. Good stuff (when I remember to update it). Read it.
    8. Re:Three words by Mr.+Freeman · · Score: 2, Informative

      Everywhere I've been inserting complexity to ensure job security is the number one (or at least in the top 5) way to find yourself without a job. Making something intentionally complex to the point that only you can fix it is unprofessional and, at least in the case of engineers, unethical. The only reason these firings are done without cause as opposed to for cause is because it's more paperwork if you're actually fired for being unprofessional.

      --
      -1 disagree is not a modifier for a reason. -1 troll, flaimbait, redundant, overrated are NOT acceptable substitutes.
    9. Re:Three words by Evil+Shabazz · · Score: 4, Insightful

      Indeed. In my experience, the folks who talk about making systems "so complex only they know how to fix them" don't actually really know what they're doing anyway. The real truth is usually that they've got things set up so batshit crazy trying to hide their mediocrity in this "you can't fire me now!" excuse.

      --
      Down with the career politician! SUPPORT TERM LIMITS
    10. Re:Three words by helixcode123 · · Score: 2, Insightful

      If you are that paranoid about keeping your job, find another job. Life is too short.

      Besides, it's exactly the opposite approach to being a successful consultant. Any decent consultant provides their client with a "here's how you fire me" file with all of the information they need to access and maintain the system(s) you've built. The idea here is to do such a good job for your client that they want more, not less, of you. If you can't do this you have no business being a consultant (or general employee, for that matter).

      --

      In a band? Use WheresTheGig for free.

    11. Re:Three words by kiwimate · · Score: 2, Insightful

      Wow...

      I've worked in a highly stressful environment before where I didn't know if I was going to still have a job the next day or not.

      Life is too short to put up with that amount of stress. You should've been job hunting.

      I had everything set up sufficiently complex but still for good reasons, that if they had fired me getting someone else to fix it would have been a nightmare and cost them a fortune, which they would find out as soon as they tried to get someone else to go in and fix it.

      Wow, again. So the client is really screwed if you end up in hospital with pneumonia for two weeks (I pick that example because it happened unexpectedly with one of our developers within the past 12 months). A professional sets things up so they are easy to maintain and trusts in his ability and skill to get jobs, based partly on that.

      Since I left on good terms I overhauled everything before I left and took out most of the non bog standard bits I had implemented. They ended up with a slightly worse but fixable in a pinch system.

      So out of the generosity of your heart, and because you left on good terms, you decided to magnaminously grant them a bad system rather than an utterly broken one. Wow...yet again.

      Had the work environment been less stressful I wouldn't have felt it necessary to go through all of the trouble, but they decided to make it that way, so I decided to build some security into my job that was otherwise nonexistant.

      Next time, don't go through all that trouble to sabotage a client's systems. If it's that bad, just do your job properly and take "all that trouble" to instead look for another job. And try building some security into your job by being professional and really good at what you do.

      You are the kind of consultant who gives consultants a bad name. Thanks for nothing.

    12. Re:Three words by lrichardson · · Score: 3, Insightful
      Yes and no. I've done so flashing-star, how-the-heck-did-you-get-that programming, mostly because of a unique position that straddled various corporate silos.

      Two killers, i.e. 'making them so complex only ...'

      1/ Not having the time to clean stuff up. If it works, management generally wants you to move on to the next fire.

      2/ Documentation oversights and assumptions. "Check the syslog for errors" doesn't cover what to do when errors arise. I'd reached the point of coding the automated sending of e-mails on errors - with the fix included - to the person running a job, on dozens of issues. Things that one just assumes after years of experience are complete show-stoppers to someone who doesn't have that same experience. And it only shows up when someone else does try and run something, per the documentation.

      &, of course, 1.5, not having the time to do any documentation ...

      I like automating the heck out of stuff, handing it off to some poor schlub to run as needed/scheduled, and moving on to the next problem. But I also recognize that it's done me out of a job a couple of times. Which really, truly sucks.

      The best advice I received from a friend was "Don't make yourself indispensible. You won't get vacations."

      It's a trade-off. I think I prefer being viewed as a valuable asset, getting new challenges, rather than the only guy who knows how to fix something.

    13. Re:Three words by dbIII · · Score: 2, Informative

      What about actually applying some reading comprehension skills to the portion quoted? Take note that things were not deliberately complicated but ended up that way to solve problems.
      Arcane performance tweaks by people that know the stetup backwards are quick while well documented proceedures designed for newbies take time to develop. You can aim to get there in the end, but the above post appears to be about what would have happened if things were stopped part way through.

    14. Re:Three words by Tuidjy · · Score: 2, Interesting

      Amen to this.

      I still have my job, and have never bothered to install back doors. But I am think about moving to a different position/geographical location, and am trying to get rid of all my hacks and cludges so that my replacement can have an easier time. Let me tell, with both of us working on this 2-3 hours each week, we are nowhere close to getting rid of all the crap.

      Just a simple example, of which we got rid last week. In 1997 when I had been just hired, my company was in the process of changing its ERP software. The problem was that they had a front end to it that had been written by an outside contractor whom they had fired. He did not put backdoors or anything, but no one had realized that the front end would not work with the new SQL based solution.

      Because the problem was dropped in my lap, I ended up hacking together a really ugly, brute force solution - watching the front end server process for disk access requests, putting it to sleep, and creating the old style file on the fly. Thirteen years later, the company owner and two of his close friends who head two of our 50 warehouses refuse to use any other front end. So until last week, I had a compiled program with full access to the main ERP database, to the payroll's server physical disk and to a modem. Good luck finding that.

      And yes, I realize that it was a terrible thing to leave active for more than a decade. But seriously, who remembers to go back and work on something like this unless it breaks? The only reason it's gone is that I am trying to tidy things up before I move... and if I was not moving within the company, I doubt I would be so nice.

      --
      No good deed goes unpunished...
    15. Re:Three words by tsm_sf · · Score: 5, Insightful

      If you can't do this you have no business being a consultant (or general employee, for that matter).

      That's a best-case scenario, and you should know it. There are plenty of jobs or projects out there where you will never be given the time it takes to "do it right." If you're the kind of person who's willing to spend their own time documenting systems then more power to you, but most of us don't want to work for free.

      Look, just ask yourself if the unbillable time you're spending is making someone else money. That's the metric you need to keep in your head all the time.

      --
      Literalism isn't a form of humor, it's you being irritating.
    16. Re:Three words by Antique+Geekmeister · · Score: 4, Insightful

      You've left out number 3:

      Being completely forbidden by your manager, or the client, from doing it the faster, cheaper, and simpler way in favor of some approach they're more familiar with, and having to work around the crazy in-house architecture they've already deployed and lack willingness or political capital to throw out.

    17. Re:Three words by jasonwalls · · Score: 3, Interesting

      Most business owners/managers have a better relationship with their mechanic than with their IT people. And why not, the Mercedes (insert any other prestige vehicle here if desired) parked in the MD's parking spot is considered a far more valuable asset to the business than IT. At least that's my exerience.

    18. Re:Three words by CrashandDie · · Score: 4, Insightful

      Look, just ask yourself if the unbillable time you're spending is making someone else money.

      Sure it is, but if you've worked out a good relationship with your boss, or if you negotiated your package right, all that should swing back in your bucket. That's how my previous gig was (infosec consultant); I would work insane weeks, over 90 hours a week in the worst cases, but I either got it back in double as holidays, or healthy financial bonuses.

      My bonuses equaled my salary at the end of the first year, at the end of the second year, my bonus were 3 times as high as my salary.

      There's working like an idiot, and then there's knowing how much your work is worth.

    19. Re:Three words by Anonymous Coward · · Score: 2, Insightful

      You have clearly never worked for someone who wants everything for free and doesn't negotiate.

      Extra hours? 'You're on a salary, it's expected'

      On Call? 'It goes with the territory'

      Call out? 'If we paid you call out then we would have to pay everyone call out'

      Pay rise? 'Given the current financial conditions I'm afraid there is no pay this year/last year/next year'

      I no longer work over time, answer my phone to my boss outside of the hours I was contacted for etc etc.

      I still do a good, professional job when I am there - just don't see why I should go above and beyond anymore...

    20. Re:Three words by Krneki · · Score: 2, Insightful

      Exactly, if you don't give a shit about your employers, don't expect any love in return.

      --
      Love many, trust a few, do harm to none.
    21. Re:Three words by ultranova · · Score: 2, Insightful

      This is still an extremely unprofessional thing to do.

      Professionalism goes both ways. If you keep your employees guessing whether they'll still have a job tomorrow, they'll keep you guessing whether you still have a system tomorrow. Why would you expect to get more than you give?

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

    22. Re:Three words by TheRaven64 · · Score: 2, Insightful

      Even if it keeps you in a job, it also has the effect of keeping you in the same job that you're currently doing. When management is looking for someone to promote, they're not going to promote the person who is indispensable in his current job...

      --
      I am TheRaven on Soylent News
  3. I'd say treat it like a DR drill by BobMcD · · Score: 3, Insightful

    If you're seriously considering this as a possibility, I'd say treat it like a DR drill. Burn everything down to bare metal and restore only the data. It's the only way to be sure...

    However, before taking my advice, I'd suggest you get your boss to sign off on it, whichever way. Present a list of options from 'ignore it' to 'burn everything' and have them pick. This way, whatever happens, you're covered.

    1. Re:I'd say treat it like a DR drill by Locke2005 · · Score: 3, Funny

      "I say we take off and nuke the entire site from orbit. It's the only way to be sure."

      --
      I've abandoned my search for truth; now I'm just looking for some useful delusions.
    2. Re:I'd say treat it like a DR drill by BobMcD · · Score: 3, Interesting

      If you're seriously considering this as a possibility, I'd say treat it like a DR drill. Burn everything down to bare metal and restore only the data. It's the only way to be sure...

      That seems a bit risky. I cannot see any manager worth his salt giving authorization to purposely destroying data "to see if the backup works".

      That's because the order of operations is out of whack.

      Rebuild, then cut over. Same result, less risk.

      Sorry for glossing that over.

    3. Re:I'd say treat it like a DR drill by fishbowl · · Score: 2, Informative

      >That seems a bit risky. I cannot see any manager worth his salt giving authorization to purposely destroying data "to
      >see if the backup works".

      We do it routinely, but it's not chaotic or risky like your choice of words makes it sound. OTOH we have invested a lot of money and brainpower into getting the redundant system we need to have in order to fail over a production system, tear one down, build it up again, verify it and put it back into production. That costs money... and probably not something the IT manager that had to be "fired under duress" actually accomplished.

      Unless you can deploy your standard configuration with nothing but the LTO tape from Iron Mountain and a charge account at your server vendor, you don't have a Disaster Recovery plan. (A fire in our facility probably takes out 4 city blocks. We seriously take this under consideration, and we do drill for it.)

      --
      -fb Everything not expressly forbidden is now mandatory.
  4. little OT.... by Anonymous Coward · · Score: 3, Insightful

    One of many reasons CEOs are given golden parachutes are to keep them quiet about trade secrets and certain contacts. Whether or not that happens is debatable, but discretion is basically paid for.

    Why not give similar parachutes to IT admins to follow these unwritten practices? If the CEOs are the frontmens, ITs are the infrastructure of the organization. Treat them like gatekeepers instead of disposable footmen. They have the keys to the castle. And all the secret entrances.

    1. Re:little OT.... by CharlyFoxtrot · · Score: 4, Insightful

      One of many reasons CEOs are given golden parachutes are to keep them quiet about trade secrets and certain contacts. Whether or not that happens is debatable, but discretion is basically paid for.

      Why not give similar parachutes to IT admins to follow these unwritten practices? If the CEOs are the frontmens, ITs are the infrastructure of the organization. Treat them like gatekeepers instead of disposable footmen. They have the keys to the castle. And all the secret entrances.

      The janitor has all the keys to the building and the cook could poison everyone if he wanted but those people aren't afforded the respect they deserve either. CEO's are given golden parachutes by their buddies who they'll see at the golf club and who they can maybe return the favor later on the board of some other company. We're just staff and staff don't get golden parachutes, they get concrete shoes.

      --
      If all else fails, immortality can always be assured by spectacular error.
  5. Multiple Backdoors by Bryansix · · Score: 4, Interesting

    I usually put in multiple backdoors. Not out of malicious intent but because I support customers who are so far away that I don't want to drive out there all the time. Now this might include software or even out of band management, VPN, etc. Basically, if you put yourself in a position where you have to fire your IT staff then you are a moron. Always do background checks because you are going to be giving these people the keys to the city.

    1. Re:Multiple Backdoors by Kozar_The_Malignant · · Score: 2, Insightful

      Basically, if you put yourself in a position where you have to fire your IT staff then you are a moron. Always do background checks because you are going to be giving these people the keys to the city.

      • Not every problem employee comes with "Crazy MF With Drug Habit" tattooed on his forehead.
      • Sometimes people lie when you do background checks. They want their problem to become your problem.
      • Your IT guy might be just fine until his wife leaves him for a younger woman who also works for your company.
      • Or, like my experience, the first thing you have to do in your new job is fire the sadistic moron that your predecessor tolerated for years.

      The point being, you don't always "put yourself" in that position. Sometimes shit happens.

      --
      Some mornings it's hardly worth chewing through the restraints to get out of bed.
    2. Re:Multiple Backdoors by greenbird · · Score: 2, Insightful

      All of those problems could be handled in a variety of ways with a competant HR department.

      Isn't that an oxymoron, even if it was spelled correctly.

      --
      Who is John Galt?
    3. Re:Multiple Backdoors by hedwards · · Score: 2, Insightful

      Not really, HR is generally highly competent, just not at what you think they're there for. Most companies have HR employees specifically so that they can be useless and make it as hard as possible for employees to get there benefits, preferably quitting before they're eligible. Sure it's a dumb way to run a business, but it happens. Usually if there's any corruption in a company it's found in HR first and spreads elsewhere.

  6. Re:terminated under duress by arth1 · · Score: 3, Insightful

    Yeah, that will really solve the problem of time bombs and dead man's switches...

    How about not disgruntling the employee in the first place?

  7. Re:Make your list prresent it to your stupid boss by boristdog · · Score: 2

    Just make sure to CC your boss's boss when you do this.

    THEN your ass is covered!

  8. Two words by Sycraft-fu · · Score: 2, Insightful

    Prison sentence.

    Seriously trying to do something like install a dead man switch to fuck over your employer would be the height of stupidity. Wonderful way to end up with a sentence that make the Child's thing look lenient. While I realize that pedantic geeks think they could cover their tracks that isn't the case. They don't have to prove it was you beyond any and all doubt, they just have to prove it was you beyond a reasonable doubt. If they can show means, motive, and opportunity, they've gone a long way to that.

    Sounds like the real answer if for companies to get rid of egomaniac assholes in IT before they are in a position to cause trouble.

    1. Re:Two words by Peach+Rings · · Score: 2, Insightful

      You could easily just badly document or fail to document passwords and configuration info and stuff. As long as you're around and working with the systems daily, everything runs smoothly. If you get fired, there's confusion with the new guy and your memory fades... it's not like they can really tell exactly what isn't a matter of the new guy not being up to speed for weeks. And you're not responsible for giving them consulting services for free after they fire you. If they can't figure out the non-standard port numbers you used, then that's their problem.

      Childs took an idiotic stand where he admitted he knew the passwords and refused to hand them over. That's not the most lenient case, that's the worst case I can think of other than destroying data.

    2. Re:Two words by Requiem18th · · Score: 2, Insightful

      Did you hear *woosh* over your head? That's the sound of missing that he was proposing revenge for being terminated with extreme prejudice. If you are dead, you don't have to worry about being jailed.

      If they fire you without firing AT you, that's good reason to kindly warn them to remove the DMS.
      All of this of course, as a joke.

      --
      But... the future refused to change.
    3. Re:Two words by X0563511 · · Score: 2, Insightful

      You know what a dead-man's switch is, right? The joke he was replying to was that it was better to kill the employee than to fire.

      The response was to build a dead-man's switch.

      Hard to go to prison after a 9mm to the brainstem...

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    4. Re:Two words by fluffy99 · · Score: 3, Informative

      You could easily just badly document or fail to document passwords and configuration info and stuff. As long as you're around and working with the systems daily, everything runs smoothly. If you get fired, there's confusion with the new guy and your memory fades... it's not like they can really tell exactly what isn't a matter of the new guy not being up to speed for weeks. And you're not responsible for giving them consulting services for free after they fire you. If they can't figure out the non-standard port numbers you used, then that's their problem.

      Childs took an idiotic stand where he admitted he knew the passwords and refused to hand them over. That's not the most lenient case, that's the worst case I can think of other than destroying data.

      Even worse, he deliberately setup the routers so he'd have to manually reconfigure them if/when they rebooted - in other words a deadmans switch.

    5. Re:Two words by Anonymous Coward · · Score: 2, Interesting

      Here's a fun little story, and only slightly relevant, too!

      My company's HR head also controlled access to the network. We outsource our IT and the head of HR was the point of contact (the head of HR was also assistant to the CEO. It was one of the few positions in the company that wasn't procedurally isolated from other responsibilities).

      Anyway, the CEO and President decide to clean house. The head of HR is fired, and the CEO goes in and changes passwords. The CEO, however, didn't have direct day-to-day focus on network issues (passwords, accounts, etc), and as a result didn't get every single account the ex-head of HR had access to. A day or so later, "someone" accesses the network using the one account that would have still be accessible the ex-employee. Using this account, "someone" went in and deleted a bunch of data from our servers, including data we were maintaining for over a year on a lawsuit that we were very tangentially connected to.

      As far as anyone knows, no action or investigation will take place. I suspect the decision-makers just want this one to go away.

  9. logic bombs on a timer by ei4anb · · Score: 4, Interesting

    The worst timed logic bomb I have had to deal with was by an intern who was looking for more pay. He had written a statistical analysis program that would have started to introduce subtle errors several weeks after he had left. If I had not found it then our stats would have become useless after a few months of that mangling. I assume he was hoping we would notice data errors, panic and re-hire him to fix it without realizing that he had caused the errors. I became suspicious when the timestamp on the Java source was newer than the class file so I did some reverse engineering. He had edited the logic bomb out of the source after compiling.

    1. Re:logic bombs on a timer by jjohnson · · Score: 2, Insightful

      That's a really good catch. Well done.

      --
      Anyone who loves or hates any language, platform, or manufacturer, doesn't know what they're talking about.
    2. Re:logic bombs on a timer by grahamsaa · · Score: 3, Insightful

      He knew how to program a logic bomb and how to cover his tracks by removing it from the source, but he didn't have the smarts to change the source file's time stamp? Sounds like an obvious step to take -- not that I'd ever do anything like that, but seriously, changing a time stamp isn't rocket science.

      --
      Facts have a liberal bias.
    3. Re:logic bombs on a timer by twebb72 · · Score: 5, Funny

      The worst logic bomb I had to deal with was written similarly by an underpaid (debatable) programmer. He set it up so that when money was exchanged between accounts the program would then truncate the remainder. This, in fact, was only a fraction of a cent. Then he took that remainder (once it had accumulated a bit) and transfer it out into a bank account of his own. As it turns out, it was relatively easy to install.

      We were so far behind for the Y2K updates, most people simply didn't notice. A couple days later the building burned down.

  10. My accidental SSH backdoor... by Anonymous Coward · · Score: 4, Interesting

    I had to administer a system when the vendor's software would fail on the rollover for the day. So it would fail at 5 am, and I would have to be the one to come in to fix it. As it happens at least once every two weeks I started to SSH in to fix it rather than rush to work and have to work an extra three hours that day (and not be compensated for it). The policy that I fought to implement at work was to do a quick audit, change any passwords/keys for any remote entry and to actually create passwords for many of the accounts that did not have passwords. So done and done I thought.

    To continue: I had many problems with upper management, one of which was their wanting me to 'tweak' time sheet accounting so that new entry level minimum wage employees were paid for as little as 75% of their legitimate hours worked. I thought this was particularly dickish as they fired employees on a project basis and anyone was usually fired within two weeks. So I quit and tried to get myself as good as a parachute as I could.

    Well two weeks after I left I found out the newbie replacement didn't perform the audit when I accidentally clicked on a bookmark at home (Putty) and I was suddenly in a server from my old job. I logged out and didn't feel particularly compelled to tell them that my keys were still trusted. About a month later I made the same mistake. The hole was no longer there. I thought to myself, "Good for him. I guess he's not so incompetent at all."

    But curiousity a la Facebook and Twitter revealed that a server had actually gone down that day. Apparently there was a 'rm -rf' oopsy!!!

    The story continues, but the end result is that he managed to destroy three servers within a month of my leaving. If I had been malicious I don't think I could have caused that much destruction...

  11. So what is the advice by bugs2squash · · Score: 4, Interesting

    for those that are terminated and have no intention of connecting back in ? After all, if I am let go, the last thing I want is for my old credentials to be used by someone to trash something and have suspicion fall on me.

    --
    Nullius in verba
    1. Re:So what is the advice by mysidia · · Score: 2, Insightful

      I wonder, that... if you had no way of getting back through the firewall... I wonder how you could know the credentials weren't deleted? :)

    2. Re:So what is the advice by sabt-pestnu · · Score: 2, Informative

      Wrote the answer to that above, before I saw your post here. To repeat: if it's a hostile environment, you need your own CYA audit, with witnesses. Your replacement could be Evil, or simply Incompetent. And either way, you don't want the blame falling on you.

    3. Re:So what is the advice by PPH · · Score: 2, Interesting

      I wonder how you could know the credentials weren't deleted?

      My Boeing e-mail address was on a number of mailing lists. It took a few years for messages to begin bouncing. People would tell me that my address worked one month but not the next nd I had a pretty good idea when my account was dropped.

      Boeing's computing security isn't too bright. They shouldn't be bouncing bad e-mail addresses. It lets spys probe the organizational structure. One can also send a message to a valid employee using the first.last@boeing.com format with a return receipt request and examine the headers to see where it was delivered and the internal domain name structure (which tracks the organizational structure).

      --
      Have gnu, will travel.
  12. Re:More like not keeping people who'd do that by cjb658 · · Score: 4, Insightful

    As an (ex-)employee, it would be to your advantage to maintain good relations with your previous employer anyway, unless you don't plan on ever using them as a reference.

  13. Re:terminated under duress by bill_mcgonigle · · Score: 4, Interesting

    Relatively current events counterexample A: Terry Childs

    He may have bucked the chain of command, but if his employer had sat him down, said, "look, Terry, we think you'd be better off somewhere else - we're going to keep you on until you find a better opportunity, and we're going to help you do that," he would have probably said, "yeah, but you have nobody else here who can handle this thing. You're going to need to hire a firm to manage this or get some better talent on staff," which seemed to be his motivating concern. And so they probably would have done that, and nobody would have gone to jail.

    Instead it seemed like a "give us the passwords and um, no you don't need to clean out your desk, why?" kind of scenario. I'm not meaning to absolve Childs of incorrect behavior, but a little Golden Rule would have gone a long way there. I think this is what the GP meant by not disgruntling the employees.

    --
    My God, it's Full of Source!
    OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
  14. Has to be said by Dunbal · · Score: 5, Insightful

    You get what you pay for. You hire for the lowest possible salary and treat your professionals like unskilled laborers, well, don't be surprised. A professional would never dream of doing something like this - but then again a professional would not work for peanuts either.

    --
    Seven puppies were harmed during the making of this post.
  15. Treat people humanely? by happyhamster · · Score: 4, Insightful

    How about a radical idea of treating employees as people, with respect and dignity, and they will treat you likewise in return? I know I'm stepping a little above the topic, as you asked what to do when you do fire people suddenly without a cause. Please bear with me and don't "escort me out" yet. The way employees are treated in the U.S nowadays is despicable. It would be unacceptable just a few decades ago in this very country, and it is still unacceptable in many parts of the world. An executive firing employees without good cause would and should be roughed up good after work to freshen their understanding of "immoral". American society should make it socially unacceptable, with after-work consequences, to fire people without a good cause, regardless of "laws' bought by corporations in the last decades.

    1. Re:Treat people humanely? by Fulcrum+of+Evil · · Score: 2, Insightful

      Good reason in this instance could mean 'we can get the remaining people to do the same work and look good for the quarter' while ignoring the whole 'dead company in 5 years' part.

      --
      "We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
  16. Why the nastiness ? by redelm · · Score: 2, Interesting

    Nastiness is usually a sign of guilt: "It is human nature to hate those we have wronged [sic]" Tacitus.

    If the corp is nasty, it will attract further nasties and have to cope with the results. The nice people leave.

    If a nice corp has to fire someone for gross malfeasance and such yet cannot charge them, then perhaps send in a trusted senior specialist to check things out quietly. A big investigative purge will just tell everyone there you don't trust them. Then why should they trust you? Thieves have the best locks. Lots of moves in this chessgame.

  17. grow up by luis_a_espinal · · Score: 3, Insightful

    Yeah, that will really solve the problem of time bombs and dead man's switches...

    How about not disgruntling the employee in the first place?

    Oh, grow the hell up and welcome the nature of life.

    Though there are work places that indeed are festering, pedantic shit holes, my experience has been that people who are disgruntled enough to commit a stupidity don't necessarily work in a place causing them to be so disgruntled in the first place. They are simply stupid assholes who either have a sense of victim-hood or are too arrogant and socially incompetent so as to pop a vein at the slightest work-related discomfort.

    Work is work, it's not supposed to be pleasant all the time. We get paid to do work that has a certain level of difficulty, both technological and sociological. It has always been so, it will always be so. Half of the time the fault of being disgruntled is in you. How you handle that shit is ultimately one's responsibility.

    If you are a mature person with a sense of, oh I dunno, fucking professionalism, you will never get *that* disgruntled no matter the working conditions. If you are not a mature professional and you cannot tell professionalism from shit flinging monkey riding a banana-shaped tricycle, then you'll inevitably construe any slightest difficulty into an affront, building each one of this up, turning you into an arrogant, festering boil of disgruntled human suckage and social incompetence.

    And for those who truly voted that post as insightful, man, grow up, really.

  18. Re:More like not keeping people who'd do that by phantomcircuit · · Score: 2, Informative

    Most employers will only confirm the dates you worked for them now, for fear of lawsuits.

  19. Let's just say this depends on the former sysad by mysidia · · Score: 2, Interesting

    This is why companies need to have an IT-savvy IT manager and know their employees well, and have multiple IT workers watching each other, much like accountants and finance officers are supposed to watch each other and have separated powers.

    Know your employees, their abilities, and their personality. Without knowing the person, it's difficult to assess the risk as to whether or not they might or might not do or attempt to do certain things. And what things are even possible for them to attempt.

    The easiest way to avoid running around in circles is to know what they are capable of exactly. If their personality is psychopathic super-programmer, you might have good reason to look for hand-coded hidden kernel drivers, or little binary blobs in a proprietary tampered-with program, containing custom logic bombs, and exploits for bugs in other programs (automated privilege elevation and exploitation).

    If not, well, more mundane audits should be fine.

    If the person is familiar with scripting, then, well, you'll have to check all the scripts extra carefully. Even if not, they might have found something on the web, and it doesn't take rocket science to cron "rm -rf". Which should not be that much a concern if you have solid frequent backups and take additional precautions to secure those.

    (Probably) the worst case scenario is they are conspiring with skilled outside hackers, who are providing expertise and assistance.

    Once the outsiders have enough information, they may get the IT admin to "run some code" from somewhere obscure, which will lay the playing field, and then later the outsiders will infiltrate the network.

    However, that implies premeditation. If an IT admin is going to forcibly lose their job for serious disciplinary reasons, and anything is suspected to be a risk, they should be escorted by security and not allowed to touch any computers until they are gone for good.

    Make them stay on premise during working hours, and have them use pen and paper to fill out some paperwork and answer questions.

    This way they will not have a lot of "free time" until all your new IT admins' audits and password changes are established.

  20. Corporations DEFENSELESS against determined foes by Anonymous Coward · · Score: 2, Interesting

    I was CIO for a fairly large company. I reported to the CFO. The first few years were great. Then the good CFO retires and is replaced by the bad CFO. This guy was looking for excuses to get rid of me from day one. It took him several years, but eventually he fired me.

    It seems he hired some type of security consultant to lock down the place just before I was fired. Some of my staff members were forced into cooperating with this little adventure. Evidently, the bad CFO thought I would launch some kind of high-tech retaliation. This was actually a fair prediction, based on how I was treated. If you treat people badly, you should EXPECT trouble.

    While I am in the process of getting the bad news from HR, it occurs to me that I really want revenge. But a high tech attack would be illegal, unethical, and they're probably expecting it. Therefore I will NEVER attempt anything related to IT. I'm not sure exactly how to proceed, but I decide to wait and give it some thought. My staff members knew from day one that I would do something and whatever it was, it was going to be big. The funny part is that the company's security consultant did everything recommended in TFA and then some. And yet he STILL left a gaping hole that I helpfully reported to the company after the fact. So much for the security audit.

    Good things come to those who wait. I stumbled across an idea that had nothing to do with IT. I REALLY REALLY want to write about what I did, but details of the operation must remain classified. Everything was 100% legal and ethical. The results were absolutely spectacular. I might turn this into a movie script someday. It was that good. The amount of pain I inflicted exceeds anything that I could have done with computers.

    Three important lessons here: (1) Security audits are seldom 100% effective and a determined opponent is going to get in anyway. (2) A really determined foe is not limited to computers. (3) Treating people poorly leads to unintended consequences; see (1) and (2).

  21. Let me correct that by drolli · · Score: 2, Interesting

    The assumption should be that you have been rooted by somebody who knows exactly what things are logged in your systems, possibly with continuous influence on what is being logged and how long, maybe even with the power to alter log files. IMHO one of the important things is to use several servers just for logs, to whom only a single admin has access. If one of them is going in a bad way, then you have at least the logs on the other machine. If you are paranoid, transfer the md5 checksums of the files on your servers to these machines and use git on the etc directory, backing the etc directories up on these machines. and force the it staff to make builds of custom SW automated.

    This means you have
    a) logs of what has happened (at least you know what you know)
    b) a possibility to determine which files changed
    c) a documentation about which configuration changes have been done for which purpose.
    d) a backup of the configuration, enabling you to reinstall the machine
    e) a way to rebuild programs added to the system easily.

    1. Re:Let me correct that by xenobyte · · Score: 2, Informative

      With Unix-family systems it's easy to stream syslog to another server, and that other server should be used for nothing else. Firewall it so it seems down from everywhere (except perhaps a monitoring server) and so that you only access it in two ways: Inbound udp on port 514 (syslog streaming) and inbound ssh on a different port than 22 only from a single access point (another server, a workstation or similar) using a key not stored on that access point and not used anywhere else.

      I'd say that it is extremely difficult for someone to compromise another server (webserver typically) and then gain access to the logging server (name or IP evident in /etc/syslog.conf) to erase his tracks there as well.

      --
      "For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
  22. WHy don't you grow up by Viol8 · · Score: 3, Insightful

    "f you are a mature person with a sense of, oh I dunno, fucking professionalism, you will never get *that* disgruntled no matter the working conditions."

    Oh please, and you're telling OTHER people to grow up? Sounds to me like you've hardly had any work experience in the real world. It doesn't matter how professional you are - everyone has certain buttons that can be pushed and in a long working career believe me , someone WILL push them eventually.

    Also you might disguise your young age a bit better if you didn't swear every paragraph.