Slashdot Mirror
Rogue System Administrator Faces 10 Years In Prison For Shutting Down Servers, Deleting Core Files On the Day He Was Fired (techspot.com)
Joe Venzor, a former employee at boot manufacturer Lucchese, had a near total meltdown after he got fired from his IT system administrator position. According to TechSpot, he shut down the company's email and application servers and deleted the core system files. Venzor now faces up to 10 years in prison and a $250,000 fine. From the report: Venzor was let go from his position at the company's help desk and immediately turned volatile. He left the building at 10:30AM and by 11:30, the company's email and application servers had been shut down. Because of this, all activities ground to a halt at the factory and employees had to be sent home. When the remaining IT staff tried to restart them, they discovered the core system files had been deleted and their account permissions had been demoted. Eventually the company was forced to hire a contractor to clean up all of the damage, but this resulted in weeks of backlog and lost orders. While recovering from the attack was difficult, finding out who did it was simple. Venzor was clearly the prime suspect given the timing of the incident, so they checked his account history. They discovered he had collected usernames and passwords of his IT colleagues, created a backdoor account disguised as an office printer, and used that account from his official work computer.
I guess he did not like getting the boot.
.....find someone to fill your shoes...
I see what you did there
It all happened so fast, officer. He ran that way. He was short, beige and had a tattoo that said Lexmark.
Have gnu, will travel.
Those core files were probably stale anyway.
An admin can still override authentication. Whats needs is to bring the new admin in before you sack the old one. He removes admin privileges from the guy being sacked. That, or isolate the system from the outside world for a while but in this day and age that may be impossible from a business perspective.
http://michaelsmith.id.au
Are we supposed to be outraged or something? It sure sounds like the guy deserved to be fired - and, based on the actions he took after being fired, he deserves prison time and a significant financial penalty.
#DeleteChrome
in this case, they did remove admin privileges from the guy being sacked, he used other people's accounts to access things remotely.
Two Factor authentication could have blocked that by preventing him from impersonating other admins.
It's 2017. Everything should be running in VMs, and snapshots of those VMs should've been backed up. Guess the IT department wasn't up to scratch.
They are a bloody nuisance and just take up disk space.
http://www.kvia.com/crime/fbi-...
Karma: Bad
Come on, people, if you are going to get revenge on the company that canned you, you're supposed to set up a daemon on day one that checks to see if you have logged in the last month and then begins corrupting backups as they are made for the next 5 months, at which time it will execute a total system meltdown that results in total data loss! I swear, you youngin's know nothin' about properly destroying the lives of those who have wronged you! ;)
Anons need not reply. Questions end with a question mark.
Hell, if you want to be vengeful, you don't do it from a computer, you do it from a IoT device on the network. You can even make it a canary to take action when your account is disabled or something. But for gods' sake, do it in parts over a longer period of time... and give yourself a way to clear your mind and stop it!!
It is scary just how hard it can be to detect a rogue employee trying to sabotage you. There are only a few things you can actually do to limit impact to a reasonable level.
You're spelling it g-o-o-d but pronouncing it "evil and incompetent".
It's not your system--it's your employer's. If you feel that you have to make yourself "indispensable" in such a fashion, you're doing it wrong.
Il n'y a pas de Planet B.
If you want to be vengeful, thank your former employer for the job on the way out the door and ask for a letter of reference. Then go get a similar job at another company at a higher wage knowing you would never have gotten such a raise at your former employer's.
Don't get me wrong, this guy certainly deserves punishment if guilty, but 10 years? Did any CEOs or politicians get 1 day of jail time for the 2008 financial crisis?
This guy had that kind of access, and knowledge for that matter, as a help desk employee? The article is confusing but who puts a sys admin on the help desk with any ability to access all company servers in the first place?
...and I found my answer...a company that is dumb enough to run it's entire business applications from a single server. http://www.kvia.com/crime/fbi-...
"Investigators learned that the server controlled the company's production line, warehouse, distribution center and its ability to take orders."
Realistically you can't keep him out. He could have created a fallback account to use.
http://michaelsmith.id.au
That's not just a problem in IT. Ask the CEO who's company it is. Usually they don't own it, but they act like they do.
Cheap storage VM.
We should mostly agree that 'don't be stupid' is a good rule to follow. Though we man rant about having similar feelings about past employers, just not enough to take any such actions.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
He was an admin, and he obviously had little to zero ethics or morals. had they had an MFA solution I am sure he would have just disabled it for a few accounts or simply registered an MFA token to one of those accounts that he could have taken with him. MFA does not solve the rogue administrator problem completely
It seems the hype and hysteria over computer issues is still ongoing.
You can, I've been there and done that during a layoff in a place I'd never been to before. You disable all remote access until you are certain what is at the other end of each remote access method. One time the former sysadmins had VPNs to their home machines (in 2002 so not as common as today), which was totally legit when they had a job but completely undocumented, yet it still wasn't hard to stop until it was clear where everything was going.
That sort of canary happens by accident instead of design when systems grow "organically" with all kind of weird interdependancies, especially on very low budgets. I started work at a place like that once and my initial goal was to remove every little quirk that needed feeding every day so that I would be free to spend time at the beach every now and again.
I seem to remember some years ago stories of suppose dead man switches and sabotage would come out when the reality was fragile systems carefully looked after by people who never got to train a replacement.
This story is of course different - but ten years? Corporate crime with consequences of shutting down companies completely doesn't get ten years, serious embezzlement doesn't get ten years - why should this sort of corporate crime get ten years?
Where I am, IT manager is not king. If I see something out of place, I can go directly to the CEO. I create the audits and then the CIO will audit it. We do this quarterly. We compare all users to a list of current employees from HR to verify that we don't have any "accidental" users not disabled / deleted.
Perhaps we are unique that we actually do try to take security seriously.
He didn't get 10 years, 10 years is the maximum he CAN get under the law. though this arsehole looks like he probably deserves the maximum
A good canary won't rely on the owner hand feeding it; but will accept food from authorized automatons.
If the user's account is closed, the canary will no longer be fed by the golems, and will peck the neener button. But the user going on vacation or to hospital won't cause the account to be closed, and the golems continue feeding the canary.
and an account 'disguised' as a printer...
If they used a really old Unix server, chances is that the lp user account didn't have a password by default.
Infosec teams often have direct read-only access to equipment and audit logs to central servers, with alerts on use-cases such as turning off logging, modifying account permissions etc. etc. In some circumstances even command history is logged.
It's hard to imagine why infosec would conspire to hide an account. If it has a good reason to exist, the case can be made to the CIO.
It might be possible to circumvent this stuff if you have physical access during a network outage, but your card access logs would still be in the system, it just might take a couple years for it to turn up when people investigate "how did the back door get there?" and it may be enough to put you in prison.
For this use case, they are secure.
I see my shadow changing, stretching up and over me...
I used to work at a $Very Big Transportation Company from 1982 to 1998. They are now clients of our company. Earlier this year Transportation Company needed to give me access to some of their systems. My old username and account, from 1998, were still in their systems.
None of them can see the clouds; The polished wings don't care.
How about teaching your users: under no circumstances does anybody else ever need to know your password.
And the higher-ups who insist that they don't need passwords? Because it's "their" computer. even though it's not? And "passwords are hard".
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
to society? If you just want punishment for punishment's sake I guess there's that. He's a first time offender, the damage was minimal. Nobody got hurt, and they just needed a few contractors (read: Cheap Windows guys) to sort it all out. "Core Files" here if you RTFA means he broke the OS. He should get slapped with restitution equal to lost sales and the contractor hours + a little for pain/suffering (very little) and sent on his merry way. Maybe get some court mandated therapy. By the sound of it this was a spur of the moment/rage thing. Throwing him in jail is a waste of everyone's time and money and might unnecessarily destroy his life.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
It is. People are still exceptionally stupid and this is one thing they understand even less (it that is possible).
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.