Fired Gucci Employee Accused of Attacking Network

WrongSizeGlass writes "Computer World, Information Week, The Register are all reporting on the story of a former Gucci IT employee who is accused of a November 2010 assault on Gucci's network deleting files and virtual servers, taking a storage area network offline, and deleting mailboxes from the corporate email server. The lost productivity is estimated at $200,000. Sam Chihlung Yin, 34, of Jersey City, NJ, allegedly created a fake VPN token in the name of a non-existent employee which he tricked Gucci IT staff into activating in June 2010, a month after his employment contract was terminated by Gucci for unrelated reasons."

Comments

First Post

[GameboyRMH]

Down with fashion!

They owe him

[Stenchwarrior]

They should be paying him that lost $200,000 for running the white-hat attack to fish out the vulnerabilities. Yeah that's it...White. Hat.

Re:They owe him

[Anonymous Coward]

Unless it is after May 1. Then only beige is acceptable... but only when the shoes are darker than #aaaaaa.

Re:They owe him

[Hatta]

Am I desensitized by hyperbolic damage claims in other cases, or does $200,000 seem pretty low for this kind of attack?

Re:They owe him

[Stenchwarrior]

I thought the same thing, actually. I chalked up the low number to the fact that they seem to be running virtualization and restoration of these servers is really easy, assuming they are making timely snap shots and storing them somewhere the ex-employee didn't have access to. They likely restored the latest images and had to re-enter some data...a few hundred people and a couple hour's worth of time is probably how they came up with the figure.

that's fucking awesome

[Anonymous Coward]

I remember a guy in intermediate school wearing Gucci. He used to dance a lot with the ladies a lot, I don't know what happened to him. If he has a family I guarantee you he's feeding off of my tax dollars! GNU FTW!

Hacking

[SJHillman]

It's funny how the closer something is to hacking, the less the word is actually used in an article. While this seems to me to be more of a result of bad policies (admin passwords were never changes) and social engineering (which is a form of hacking) actual hacking, I find it funny that the term is hardly used at all whereas when Anonymous tries a DDoS, it's ZOMG HACK0RZ!!!! every other line.

Re:Hacking

[staticneuron]

Social Engineering is not a form of hacking. Hacking is not always a negative connotation but in every case it involves modifying hardware and software in ways it wasn't intended. Social Engineering existed as a term way before the term hacking and has more in common with fraud because it deals with people and not with devices and software.

Re:Hacking

[Ihmhi]

Social engineering is modifying society to do what you want it to, just like, say, getting an Xbox to play a copied game.

Re:Hacking

[gnud]

It's not modifying society, it's leveraging how a society behaves to achieve your goal.

Re:Hacking

[Ihmhi]

Hacking is the same thing - leveraging how a piece of software or hardware behaves to achieve your goal.

How long....

[Junior1120]

I wonder how long it took for the IT staff to determine the bogus user and remove remote access. The IT department must have activated that account with a minimum of domain admin permission. Bad IT policy at Gucci.

Re:How long....

[sandytaru]

Depending on the programs used, they might just add blanket "domain users" to the admin group on their systems. We do it at our smaller sites (that have no native IT staff) because it's either that or answer emails every 15 minutes about why they can't add in Google toolbar.

Re:How long....

[ArhcAngel]

I love how 20 years later Microsoft's Active Directory still doesn't have the granular functionality that Novell Netware had way back in 1990.

Re:How long....

[L4t3r4lu5]

Instead you spend hours of time re-imaging hosed systems because of Antivirus 2011 installations, Limewire-sourced trojans, and AWWW DA ICKLE KOOT SKWEEN SAVUR!!1

Seriously, if they don't need Google toolbar, why the hell would you let them install it? And let's be honest... You don't need Google toolbar, ever.

Conjugal Visits?

[chill]

Conjugal visits? Not that I know of. Minimum security prison is no picnic. The trick is, kick someone's ass on the first day or become someone's bitch.

http://www.killerclips.com/clip.php?id=74&qid=669&PHPSESSID=6ea47a84f4b8b325495d3b4b2a7ed7cd

Re:Moral of the story

[The MAZZTer]

Being fired is likely to piss off someone whether they deserve to be fired or not.

Word Association

[Anonymous Coward]

Gucci...

Cleavon Little...

The new sheriff is a ni[BONG]

Re:Word Association

[lysdexia]

"I dunno ... Play chess. Screw."

"Let's stick with chess."

Re:Moral of the story

[Ogive17]

What he got fired for is irrelevant. Sounds like a nerd's way of "going postal" is to delete as many files as possible on their way out.

Revenge is not a smart move. You are most likely going to get caught and it will ruin your chances at future employment as soon as a prospective employer does a background check.

Re:Moral of the story

[sandytaru]

I can't say I didn't fantasize about throwing a supermagnet into the data center of an ex-employer I was downsized from, but I knew better and the majority of adults I hope would know better too.

Incompetent managers

[mangu]

I wonder what a bank would do to the branch manager if a former employee could walk away with $200,000 six months after being fired. Or, to use a car analogy, if a former employee was able to walk into a dealership and drive away with a $200,000 car just like that.

The law about computer crimes should have strong penalties for managers that allow that shit to happen. It would be somewhat different if the guy still worked for the corporation, because it's much harder to guard against an attack from inside, but if someone is responsible for managing a valuable asset he should be competent enough to take reasonable precautions to protect it from any attack someone could bring from outside.

Re:Incompetent managers

[Xugumad]

> The law about computer crimes should have strong penalties for managers that allow that shit to happen.

Why does this need to be a legal thing? I mean, there's employment issues to look at (like, err, should they have a job still), but why on earth would this be a legal issue?

Re:Incompetent managers

[Nickodeimus]

Tell that to the manager that goes to upper management for additional funds to harden the network and is denied. I'm sure you'll say, oh he should just quit working for such an organization. You'll, of course, forget that he still has a mortgage and car to pay for and work is not as easy to come by as it once was.

Re:Incompetent managers

[Stenchwarrior]

I'm inclined to agree with you. However, in this case simple education of the staff or change in VPN access policy would probably have kept this from happening since it was a social engineering method.

Re:Incompetent managers

[JosKarith]

"I wonder what a bank would do to the branch manager if a former employee could walk away with $200,000 six months after being fired."
It's called being a Director isn't it..?

Re:Incompetent managers

[deKernel]

I would think this is a legal issue in the fact that the person destroyed company property without consent. Imagine if you stopped getting the newspaper delivered, and as a result, the paper boy took your car and had it stripped.

Re:Incompetent managers

[Artifakt]

There's this concept of criminal degrees of negligence (under US or UK law at least). If somebody does a big enough screw-up, something any 'reasonable' person should have known better than to do (as the law defines reasonable), they they have committed criminal acts. In this case, for example, some of the people working for the for the corporation made assurances to their boss that the system was better secured than that, and some of them made assurances to clients or to the government. If I know damned well there's a real chance of a leopard in the next room and I assure the people going through that door that things have been carefully inspected for their comfort, I've taken some of the responsibility for the crime as well as whomever planted the leopard. If I actually know the room inspector has no training in room inspection and was laid off six weeks ago anyway, that level of responsibility could rise to criminal.
        The point here is, anyone claiming this rises to the level of legal issue is claiming some employees of the company knew there were real risks, and lied, or lied about their training to detect risks, or they lied to investors, or customers, or inspectors. They lied knowing that their was a real chance somebody would suffer serious financial harm. The law is there so there are circumstances where nobody can just say "I didn't really lie, I'm just a big dumb-ass who didn't think about it at all."
        The fact that this is called 'criminal' negligence should explain that the law thinks justice can't be achieved by civil means only in such cases. I'm not sure just what your objecting to here - modifying a n existing law to include provisions for criminal negligence where it specifically relates to this sort of intrusion, or to the existence of criminal negligence as a legal concept in general.

Re:Incompetent managers

[derrickh]

You're actually blaming the victim? It's your fault for a thief picking your pocket, getting your keys and stealing your car because you should've had it chained to your waist? The home invasion was your fault because you didn't pay extra for the level 5 security system?

This wasn't a case of the IT staff inviting people into the office, sitting them at a PC with a list of passwords on the desktop. The criminal did very specific, targeted things to falsify keys and identities to gain access.

Re:Incompetent managers

[Anonymous Coward]

I wonder what a bank would do to the branch manager if a former employee could walk away with $200,000 six months after being fired.

Give him a raise.

Re:Incompetent managers

[g0bshiTe]

But what if there truely is a leopard in the room? http://www.apple.com/macosx/

Re:Incompetent managers

[mangu]

You're actually blaming the victim?

No. The victims are Gucci stockholders. The incompetent manager was an accessory to crime, therefore he should share the blame.

Re:Incompetent managers

[djdanlib]

I wonder what a bank would do to the branch manager if a former employee could walk away with $200,000 six months after being fired. Or, to use a car analogy, if a former employee was able to walk into a dealership and drive away with a $200,000 car just like that.

Well, he didn't walk away with tangible things of value. A better analogy would be:
* Bank analogy: someone destroyed enough of the bank's records that it cost the bank $200,000 to fix the resulting mess.
* Car analogy: someone drove a monster truck onto the dealer's grounds and squashed $200,000 worth of cars.

It's not usually the case that a sysadmin's manager knows the system as well as the admin. So, it's not really possible for a sysadmin's manager to prevent all possible angles on something like that. It's kind of unique to that business. A bank's branch manager would know where all the doors were, and have a sheet that accounts for all the keys. A dealership would have some accounting for who has the keys to each car, who has the keys to the safe, and when any car keys were ordered or made. I know this because I've had to deal with ordering a duplicate car key, and there was more to the process than you'd think.

I think the current system works pretty well. Corporate information security policies do need to be designed, kept updated, and followed better in general, though.

200,000 is that even a loss for gucci?

[Anonymous Coward]

In other news Gucci recouped the lost revenue today with one sale (1 item). I kid I kid

Re:Moral of the story

[Anonymous Coward]

Really? If I do something I deserve to be fired for, I am not going to hold it against the company. On the other hand, losing my job because the boss wants to put his girlfriend's dimwit brother in my place might piss me off enough for me to consider retaliation.

Unrelated reasons?

[JDHannan]

Thanks Gucci for not breaching time continuity for not firing him for something he would do in the future!

Re:Unrelated reasons?

[delinear]

Maybe he accidentally deleted the files while looking for his minority report.

Re:Moral of the story

[hubie]

I'm curious, even if he was fired without any justified reason, and let's assume for the moment that it was for some petty reason, would you think what he did was in any way justified or correct? If you are withholding judgment to hear what the cause of his termination was, I'm trying to imagine any scenario that would justify his actions. Simply being pissed off doesn't work (for me, at least). If it wasn't virtual damage, but instead if on his way out of the building he did $200k damage by smashing computer monitors, slashing the furniture, and breaking the fancy piece of art in the lobby, would it be any different in your mind?

Re:Moral of the story

[Anonymous Coward]

The thing is, it might not be what it seems. A few years ago I got fired, apparently because my incompetent boss thought I was after his job (which couldn't be further from the truth; the last thing I want to be is a manager). Thanks to at-will employment, I was escorted from the building without so much as warning. A couple weeks later, one of their public-facing systems was cracked. Never mind that it was a system I didn't even have an account on, or that I knew much of anything about, and never mind that at the time I was diplomatically asking for chance to plead my case with HR as the wronged party... the execs immediately assumed I'd done it, and sent the F-B-fucking-I to my house. It was probably a random drive-by cracking. It might have been my boss faking the incident out of spite for me, or some other asshole trying to frame me for lulz. But I had nothing whatsoever to do with it. I'm just lucky the Feds found my protests of innocence credible enough to not seize my computers (which incidentally had a bunch of downloaded porn (all of legal age as far as I know, but not by much, and just try proving that to a jury) and a couple dozen ripped movie DVDs on them (stuff I'd rented and wanted to watch again later), and could have been used to ruin what was left of my life at that point). All for being better qualified than my boss. So I'm a big fan of "innocent until proven guilty".

Re:Moral of the story

[Gunnut1124]

Ever seen what Buckyballs will do when placed in close proximity to a 15k drive?

Two things

[lymond01]

1) if you're going to fire an IT admin who has access to all your stuff, you meet him at the door in the morning while your other admins are changing passwords. He doesn't touch a computer in your building again. You'll put his files on a flash drive and don't let the door hit you on the way out.

2) Anyone posting IT post-firing sabotage fantasies who isn't posting as a Anonymous Coward deserves the results of their next interview. I'm looking at you sandytaru.

Re:Two things

[xnpu]

Typically we pay these types of employees a delayed bonus. If after 6 months they did nothing to harm the company, it's paid, otherwise it's not. This usually buys IT enough time to have fully replaced all passwords, etc.

Re:Two things

[Krneki]

And if he planted a backdoor somewhere?

Re:Two things

[moco]

Or make sure you hire professionals. A professional will take their severance pay (or whatever they are entitled by law) and move on.

Also, the way people are fired says a lot about a company. Generally, if people are treated the way you suggest, that company is not a good place to be.

I'll agree with your second point. Those fantasies are either an indication of immaturity or personality disorders.

Re:Moral of the story

[Anonymous Coward]

Of course we shouldn't feel sorry for the guy, nor should be feel sorry for the corporation. Injustice by the employer shouldn't be surprised to find injustice by the employee. Not that we know why he was fired to begin with.

An no, the damage done is damage done, makes now difference how it was perpetrated. Simply punish him fairly and move on as he may have felt his punishment may have been worth the revenge.

There is no question that what he did was wrong but there should also be no surprise considering how many places treat their employees.

Death spiral?

[Anonymous Coward]

Quote from google finance.
"Gucci Group, an Italian company with a Dutch address that sells French fashion, does quite well in Japan, too. Its offerings include handbags and other leather goods, shoes, ready-to-wear clothing, cosmetics, skin care, jewelry, and watches. Gucci family squabbles and imprudent licensing once nearly doomed the firm. New management revived it with fresh product lines and stricter licensing, as well as heavy investing in its Asian presence. Gucci operates more than 550 stores worldwide and wholesales products through franchisees and upscale department stores. French retailer PPR purchased almost all of the remaining shares in the company in 2004, taking its interest up to 99.4%. "

Although this is a private company, i'd guess that recent events (Tsunami, credit crunch,) have put this company into the corporate death spiral.But , it needs to be confirmed... wonder if gucci turnover figures are available from any ex employees.

Re:Moral of the story

[Moryath]

In other words... this is why anti-nepotism laws should be made a requirement of any business over the size of a 10-person "family business."

two sides to every story

[Anonymous Coward]

I don't believe any mention has been made about the reasons for the original termination.
Maybe this guy had a real asshole boss or something.
Doesn't completely excuse what he did but....
At least he didn't follow the Postal model of getting even.

Re:Moral of the story

[Moryath]

On behalf of all of us... fuck you.

I help my friends with their PCs all the time. I do it out of the kindness of my heart. I help my parents when I can.

But when I help them, I also educate them. I show them what I'm doing. I doublecheck to make sure they've got up to date virus protection, up to date OS, properly locked down home network (PC direct into cable modem = AUGH).

And I tell them look - I'm your friend. I'm helping you out. But I get a ton of people asking for this every day. Coworkers constantly ask for "help" with their personal machines. Friends-of-friends. Friends want someone to help their mom, or their aunt too. I could make a full-time job of "helping friends" with their computer and NEVER MAKE A FUCKING DIME. So I have to limit it. And that means that I'll gladly help a friend out, provided that they're not just being total morons about this stuff and doing crap I warned them not to do.

Is it a bit rough? Sure. Do I want to be a 24/7 free "tech help center" for anyone who has my cell number? Fuck no.

In conclusion, if you didn't read the link the first time, fuck you. I guarantee if you treated a doctor, lawyer, carpenter, or car mechanic the way you treat the IT/Computer people, they'd tell you to fuck off as well.

Re:Moral of the story

[Arrepiadd]

I heard most geeks are like that because (...)

The problem is clearly not in the geeks If you are gullible to the point of believing everything you hear.

Re:Second Post

[Jeremiah Cornelius]

200K? That's what, a belt, a pair of shoes, three handbags and a couple pairs of sunglasses.

Wait he used old passwords?

[tecker]

Why wasn't this guys password deactivated? Did Gucci actually have common all-powerful known to all the engineers? We did that at our little IT shop because we didn't have full control of the network (we were a first response team to the main IT guys). It seems like you would give the guys some logins to use to things, use LDAP or ActiveDirectory groups to put them in the admin user level, and then when they leave/fired/downsized/outsourced/etc revoke them from the admin group(s).

How many times do we need to read "Fired techguy used his/known admin passwords to cause hell" before someone catches on?

Re:Moral of the story

[tecker]

Um nothing? I play with them next to my HDs all the time and the backups still work fine. Of course this is my personal machine and I am not to paranoid about the backups getting hosed.

We also took some HD magnets (scrapped from an old HD we just wiped) and tried to zap a stack of remaining HDs to be wiped with them. No luck. We could still read the data off of it when we tested to see if the magnets worked so we had to DBAN each and every one of them.

Buckyballs next to the tape archives.... well that's a different story.

Re:Moral of the story

[knight24k]

I can't say I didn't fantasize about throwing a supermagnet into the data center of an ex-employer I was downsized from, but I knew better and the majority of adults I hope would know better too.

Yeah, I have had those fantasies too. You don't realize just how much damage you can do until you sit and think about it. After being let go by a retail chain with about 700 stores I realized that in about 15min I could pretty much put the entire chain out of business. They had just scrapped all their phones for VOIP and I had the passwords to all the routers and knew they had the domain admin password hardcoded into the mainframe (I had tried, unsuccessfully for over a year to get them to change that). It would have been very easy to vpn in using the admin account, telnet to the furthest VOIP router and erase mem my way back to the office effectively wiping out their phone network. Then, set the tape robot to bulk erase (they didn't use offsite storage - too expensive), wipe the fileserver, domain controllers, AIX and Linux and logoff. They also refused to buy any intrusion detection software so very little chance of getting caught. I would never do that, but it gave me a little perverse pleasure knowing that I could.

That company is still in business and I know of at least two instances where they have had breaches due to their refusal to implement even the most basic of security precautions. Still, I should thank them for canning me. I now work for a Fortune 500 company making more than double what they were paying, so all's well that ends well I guess.

Re:Moral of the story

[schwit1]

For publicly traded companies. Private companies should have the right to shoot themselves in the foot all they want.

Unrelated reasons?

[Anonymous Coward]

Sam Chihlung Yin allegedly created a fake VPN token... which he tricked Gucci IT staff into activating a month after his employment contract was terminated by Gucci for unrelated reasons.

I certainly hope the reason they fired him wasn't for something he hadn't done yet. Especially if it was in retaliation for being fired in the first place.

That's not remotely IT related!

[Skeesicks]

It`s like you have an emplyee, who duplicate his company keys and burns down the company at night. What he did is he commited a crime..If he did that with fake accounts or fake keys makes no difference. If I would get fired I WOULD NOT EVEN REMOTELY THINK of harming the company...what he did is really dumb and even if he left in anger, this does not justify any of his actions. I once got fired, but I worked till my last day like every day.Especially in IT you have to have some kind of tact, or you are COMPLETELY WRONG in IT. With great power comes great responsibility!

Skeesicks, step into my office.

[Anonymous Coward]

We've been having a lot of trouble with you lately, and that ALL-CAPS tirade is the last straw. You're fired, now grab your coat and hat and get the hell out!