Slashdot Mirror
Fired Techie Created Virtual Chaos At Pharma Co.
itwbennett writes "Using a secret vSphere console, Jason Cornish, formerly an IT staffer at the U.S. subsidiary of drug-maker Shionogi, wiped out most of the company's computer infrastructure earlier this year. Cornish, 37, pleaded guilty Tuesday to computer intrusion charges in connection with the attack."
Well that was totally worth it.
For those wondering how he got caught, he accessed the servers from his home also for the McDonalds just before he accessed them he purchased some food using this credit card.
I think that hardly that moron^H^H^H^H^Htechie will have enough resources to compensate his former employer for damages.
However long his imprisonment will be, that idiot^H^H^H^H^Hpoor company will pay.
This should make it very clear than too many companies use IT just like fridges: push the plug in the socket, put a warm bottle in, wait, get a cool bottle out.
IT is not really that way. And Mr. Jason knows that very well.
Mr Jason should be hired for free as the CTO of that company and get his payroll only once the damages have been paid back.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Damn, he took his time. Musta felt good though.
But seriously, if you're smart enough and determined enough to do this, cant you foresee the outcomes?
tl;dr, Shoulda just spliced an ethernet cable into a power cord, added a "Never unplug this!!!" sticker, and left it by a power outlet. Once the blue smoke is released, the magic is lost.
He could have potentially wiped out some on going expensive research while he was at it and potentially cost lives not to mention jobs at a company that obviously wasn't in the best financial health to start with. This selt centered little prick doesn't deserve any leniency.
I usually can only destroy 10 or so vm's before my vsphere client runs out of memory / handles or just segfaults for the fun of it. Needless to say, my displeasure with that vpshere client has caused me to become somewhat of a vsphere command line ninja.
Firstly, it appears this guy was treated poorly and not only is he a nitwit, it would appear that most of his coworkers/management were as well.
Secondly, it's acts of sabotage like this that make it hard for the rest of us to do our jobs.
Thirdly, on a not so serious note... wi-fi from McDonalds? vSphere console? How did he think he was NOT going to get caught? Did he even try to wipe the logs off the vsphere server? Had this guy two brain cells in his head, he could have obliterated their infrastructure and not left a trace of evidence.
Yes Francis, the world has gone crazy.
Please
This is one reason why we need to have a well documented and well tested procedure for the termination of an IT employee.
There need to be a group of people; not just one or two; in the company who have a *full understanding* of the network, the servers; the entire infrastructure. Those people need to get together and come up with a detail step by step procedure and then test it thoroughly.
Once they test it, they should have it reviewed by not just one, but perhaps two or three different security consultants.
This procedure needs to cover *everything*; network passwords, personal passwords, building/room access cards or keys, etc.
It should be a given that physical locks (old fashioned keys) must be changed. Assume that keys are duplicated.
It should also be a given that *all* root/system/admin passwords must be changed
If the person had any access to any private cryptographic and PKI keys, they must be revoked and replaced.
And, by the way, do you search the areas the person had access to and look for rogue modems, wireless access point, or whatever? Do you have an active inventory and configuration of your network readily available? Do you look above the false ceiling and under raised floors? Probably not. But do it. I''ve seen it all. Even a changed lock on a door that not normally used; the person put his own lock on it so he can get in after all the locks on the 'normal' doors are changed. Any extra routers on the perimeter? Yes, I have seen it. That inventory must be thorough, accurate, and periodically checked.
From experience and stories that I have seen; it is a given that if at all possible, all of the account/password/access termination must be done prior to the person knowing that they are to be terminated. I prefer to do this work over a weekend (and do thorough testing) and then formally terminate the person on the following Monday morning when the employee arrives at the building's lobby or reception.
The best places that I have seen have this procedure not only trained to several people but documented in loose leaf binders prominently on key people's desks. They also run drills periodically (with evaluation by at least one if not more external and trusted security consultants) to ensure that *every* access to the building/network/servers is secured properly.
Yes, this costs money; lots of it; but it's your darn business that's at stake
Most Respectfully Yours Mark Allyn Bellingham, Washington
someone who has your root passwords...
Best Slashdot Co
Has anyone noticed that every system claiming "enterprise" robustness only ever protect against untrusted third parties or component failure? I think there's an enormous amount of research waiting to be done to develop systems that are robust against attacks by rogue administrators. Think about it this way: a modern distributed cluster can be made robust against nuclear warfare, but not a grumpy admin!
Technologies like the kind developed by internet pirates could be applied to enterprise systems. For example, protocols like Bittorrent are designed to be robust against malicious peers. The lessons learned by Wikipedia (where everyone is an 'admin') could be applied too, such as enforced versioning of all configuration changes.
Similarly, multi-party authentication should be an option for critical enterprise systems. It should be possible to mark objects such as VMs or service accounts as "critical", allowing configuration changes only if, say, three admins authenticate together, like in a nuclear launch. This isn't a new concept -- Certificate Authorities often require secondary approval to issue certain types of certificates.
The need will become ever greater as the trend of moving away from tape towards snapshots and replicas accelerates. Do you seriously think Google backs up to tape? Or Amazon? Or any cloud provider? They don't! They just keep two to thee copies of everything, and hope that none of their thousands of administrators ever cracks and does the equivalent of "rm -rf *" on the entire cloud all at once!
Unfortunately, a business with general purpose servers running Windows or Linux are out of luck. Even if someone were to come up with, say, a virtual hosting environment that's robust against even administrators, that wouldn't prevent other mass attacks, such as formatting the SAN (shudder), deleting every object from the Active Directory domain, or my favourite: setting an encryption key on the backups for a month before leaving, wiping the password, and then formatting every server in parallel. Just resetting every password in the system at once is enough to bring most organisations to their knees, and can be done in seconds! How long would it take your organisation to recover from that? You'll just restore the AD from tape, right? Step one: log on to the backup server... err...
Remember: Mirrors won't help. Replicas won't save you. Snapshots can be deleted just like everything else. If the business didn't have off-site tape backups of everything, it's game over.
Anyone doing this will never ever be put into a position of trust again. That is, if the potential future employer do a decent check on who's applying for the job. It doesn't matter how mad you are, you will ruin it for yourself if you do anything to harm your former employer.
I was promised a flying car. Where is my flying car?
wouldn't it be more worthwhile setting up an infrastructure which constantly needs you expertise to stay running, the day you are not there to enter the magic code then "boom". then you could successfully claim having not touched the system after your contract is up. it would have to not be a time bomb but some kind of bash commands which you enter from memory every morning.
...make it impossible for some elderly people (along with some kids with cancer, and perhaps a few diabetics) to get their meds.
Oh yeah, and incidentally, cost my employer money.
Douchebag of the Year Award candidate.
I am very small, utmostly microscopic.
Dude is just another anarchist like all the rest of these people....... no thought to important info being destroyed nor any innocents that may be affected. Justification is their own inadequacies which they cannot face. Malicious code just puts a weapon in the hands of the emotionally bankrupt.
Seems half the comments here are people who say how stupid this guy was -- that they could have done a much more thorough job of destruction AND covered their tracks better. Shows what kind of geeks we are. ;)
Go ahead, post your "I could have done it better" comments here.
I only post comments when someone on the internet is wrong.
I don't understand. Was this guy the head of the IT department? Did they lay off the entire IT staff? Who was in charge of the IT department? I hope it is the guy stabbing himself in the stomach. What type of moron doesn't have machines storing VM drives separated from the network just in case of catastrophic disaster or intrusion? For the love of Yoda people! Hire a Security Engineer!
Having to work for a living is the root of all evil.
in some office buildings you do not have full control of the keycard system / locks. That is under the buildings control and lot's of them the building maintenance guys can get in to any room with there keycards / keys.
I have to admit that my initial reaction was the same as yours.
And then I spent some time thinking about it.
First, riots on previous days had resulted in people being injured and even murdered, robbed and people's homes and business destroyed.
And then these guys come along and try to arrange more of the same, knowing full well the results of those riots.
Second, I got to thinking: who are the worst? The rioters who get caught up in the heat of the moment or the cowardly little turds at the back of crowd egging them on and hiding behind the masses?
My vote is the cowardly little agitators are considerably worse.
Thirdly part of the justice process -sadly too often neglected- is to protect society, punish the guilty and plain old fashioned revenge.
So on all those counts I think a custodial sentence is quite justified.
One of the 'men', Blackshaw , was obviously quite serious and even turned up for the riot- fortunately he was the only one. There was obviously serious intent there.
The other one did it as a drunken prank and took it down when he was sober the following morning- but the damage had been done. His posts had caused serious concern in Warrington and a police response. You might think being drunk is an excuse but it impacted lots of other people- and would you try the same excuse for a drunk driver?
My conclusion is that 4 years is harsh but not unreasonably so given their intent, what they did, the impact they had and the prevailing climate.
Bad analogies are like waxing a monkey with a rainbow.
I think it quite reasonable for an employer to know whether a potential employee is a convicted thief or has a record of violence.
I do agree that these offences should become 'spent' after a period of time, for example ater 5 years of keeping out of trouble.
Bad analogies are like waxing a monkey with a rainbow.
Modded down 2 points already.
I guess some cowardly little turds who spend their time trolling and winding other people have mod points today.
Bad analogies are like waxing a monkey with a rainbow.
Step 1: Hack into the vsphere
Step 2: Install spyeye on the network
Step 3: ???
Step 4: Profit
Step 5: Bathe in the blood of the bourgeoisie
Acts like this create more FUD within companies when it comes to employees. This guy was malicious and it creates more distrust between management and IT employees. I've worked in places where this kind of FUD creates the "walk you out the door" mentality when an employee or contractor even hints that they are leaving. Invariably this distrust leads to these kinds of incidents where contractors and employees are considered as a necessary evil on multiple levels by management. This isn't what we need in the industry and it merely validates all these ridiculous studies where employees are considered a bigger threat than outside entities.
Yes, this company was stupid. It didn't disable ex-employee / contractor passwords when they were terminated, it also didn't properly audit access to the systems. Again, if somebody can get into a hidden VMWare console to do this, then there's something much worse going on within this company. If this company makes pharmaceuticals then I'm wondering why they don't have better controls on access, especially at the system admin level, for these systems?
Harrison's Postulate - "For every action there is an equal and opposite criticism"
I didn't say anything about actual rioters- they should certainly be punished.
Agitators should be punished for two offences in my opinion, firstly they should be punished as if they had committed the crim themselves plus they should be punished for corrupting the person or people who actually committed the offence.
People are influenced by other people and it's a nonsense to pretend they aren't and there and some little turds who take great delight in trolling other people and getting them to respond.
Words have power and free speach is no defence against mis-using that power.
Bad analogies are like waxing a monkey with a rainbow.
If all the important data was saved on mounted filers rather than virtual disks and/or if the company had reasonably good backups of the VM's they should be able to get back up and running in a few hours. That is the beauty of VMware and virtual servers is that you can spin up new or recover lost VM's significantly faster than physicals.
Damage done with a vSphere console could be significant but much more limited than if someone had root/admin access via RDP or SSH consoles.
I would have to agree though that this guy made a critical mistake in his life and once the rage wears one depression will probably set in, for the rest of it. Business is business and it is cold and heartless. As IT, perform your trade well and roll with the punches of life and business.
Jason and I worked at Shionogi together for 3 years. I was laid off at the same time.
Shionogi did a piss-poor job of that round of lay-offs. I completely understand his attitude.
Apparently the only reason he was caught is because he used a debit card at the Mcdonalds where he logged in...
Smart guy that did a couple of very stupid things...
So basically there's nothing secret about a vSphere client and you can download it from VMWare. The issue here is that he had access to the VM hosts from outside the network AND had working credentials to logon to them and manage them with the vSphere client.
Shitty sensationalism. Unbecoming of a tech web site.
None of our VM hosts are access able from outside the LAN without a VPN connection. And passwords are changed and VPN access is revoked when people get canned around here.
For all my complaints about goings-on at former jobs, the most I can recall doing is grousing about it with colleagues etc.
Why burn bridges? Even in jobs where I've left because of frustration with the business, I'd not publicly badmouth the company or sabotage their infrastructure.
In some cases I've had to re-contact those old employers (as a job reference, or to get some information I needed but no longer had regarding my position). They've always been polite to me, and I've been polite to them.
Being a jackass doesn't help anyone. If you really hate the job, move on, but don't leave a trail of destruction behind.
If you get canned unfairly, talk to a lawyer and build a case for wrongful dismissal or whatever. Vigilante b.s. only proves that you're a cowboy jackass, and that they were fairly justified in firing you.
Awful stuff. It does bring up the question of where their backups are.
I'm sure if they'd being doing the Right Thing (tm). They'd have off-site backups of their virtual machines and data on disk or tape to restore from....
or... not?
... for having to use vsphere for this.
A true hacker would have used the VMWare sdk and command line tools and had a VM that later deleted itself perform this act.
Amateur.
"No good deed goes unpunished"
You mean to say he was also the Collar-Bomber?
I8-D
Everyone knows you're supposed to replace data with porn, not flat out delete everything.
What do I know, I'm just an idiot, right?
By your logic Adolf Hitler was as innocent as a new born, after all he didn't personally invade France or Russia and he didn't personally kill a single Jew, Gypsy or Homosexual.
Bad analogies are like waxing a monkey with a rainbow.
The upside is that he'll never be hired in the IT world again.
They fired an employee after getting into an argument with management, didn't take away or change passwords, and also didn't backup their systems.
Sounds to me like the company should be taken to court not just the employee.
Seriously, we treat our employees poorly, we don't take security seriously, and don't believe in backup.
What could possibly go wrong?
Yeah right, because they don't keep backups of these things.
Not every convicted criminal will go through probation.
Bad analogies are like waxing a monkey with a rainbow.
When my IDIOT boss fired me from my IT position at one of the bigger Car Dealership Firms in West Texas, he left my work email acct live, and he left my REMOTE LOGIN FROM HOME VPN ACCESS turned on. For THREE WEEKS. I had to be the one to contact the company owner; yes, it was vindictive; and tell him that my former boss left my access turned on. So, HE CALLED ME at home, on a three way call with the company owner, and asked me to uninstall the VPN program. Never mind the fact that all he had to do was change my VPN status to disable. He had to save face and not look like a F***ING MORON in front of his boss.
Most IT Directors these days are figureheads at best. Some, though, are an anchor just waiting to sink a company.