Slashdot Mirror
Company's Former IT Admin Accused of Accessing Backdoor Account 700+ Times (bleepingcomputer.com)
An anonymous reader writes:
"An Oregon sportswear company is suing its former IT administrator, alleging he left backdoor accounts on their network and used them more than 700 times to search for information for the benefit of its new employer," reports BleepingComputer. Court papers reveal the IT admin left to be the CTO at one of the sportswear company's IT suppliers after working for 14 years at his previous employer. For more than two years, he's [allegedly] been using an account he created before he left to access his former colleagues' emails and gather information about the IT services they might need in the future. The IT admin was fired from his CTO job after his new employer found out what he was doing.
One backdoor, which enabled both VPN and VDI connections to the company's network, granted access to a "jmanming" account for a non-existent employee named Jeff Manning...
One backdoor, which enabled both VPN and VDI connections to the company's network, granted access to a "jmanming" account for a non-existent employee named Jeff Manning...
Before you hang this guy out to dry, please keep in mind---innocent until proven guilty.
First, this is not back door access. (Something he could have set up.)
This is leaving yourself keys to the front door though legitimate accounts regulated by IT and company security.
Back door access would be installing an unauthorized program that provides remote access without the knowledge of company IT.
That is to say you cannot claim back door when the user is legitimately logging in through the employee VDI.
I wish to draw your attention to the sheer volume of logins as an indication of reoccurring scripting and not malicious intent.
You would have to be an IT worker to understand this but there is no damn reason to login 700 times to steal data. To make a real life
comparison, that would be like invading someone's home 700 times to swipe files off of the counter top.
Speaking of jmanning, that could easily be a user test account for a variety of applications and modification to service
account could easily be within the scope of work at that site. And frankly, when he is no longer with the company
he shouldn't be accessing data---and the company should close the account, but it is not unheard of to transition
an admin gracefully or for the new admin to be unfamiliar / an idiot and the CEO to call up the old one and ask for help.
And, we certainly don't know the full story.
While the people here are may be qualified to judge this guy, the court of public opinion really isn't.
They tend to take IT issues and blow them out of proportion. Every field has criminals.
Professional ethics are all that stop IT guys from going rogue. Doctors and Lawyers don't discuss secrets.
News reporters don't give sources. IT guys don't go rogue with data. CEO's make bad decisions and deals.
There's no movies about IT guys getting fired for applying a patch that disrupted business
and walking away and handing in his badge and credentials to people who have no idea what happened.
IT guys are professionals. We are treated like digital janitors with all the shit we deal with but we have a code.
I would make the case any critical employee can sink a company ship though incompetence or on purpose.
Your IT guy for the most part does what he is required to do and goes home. That's it.