Slashdot Mirror
Former Sysadmin Accused of Planting 'Time Bomb' In Company's Database (bleepingcomputer.com)
An anonymous reader writes: Allegro MicroSystems LLC is suing a former IT employee for sabotaging its database using a "time bomb" that deleted crucial financial data in the first week of the new fiscal year. According to court documents, after resigning from his job, a former sysadmin kept one of two laptops. On January 31, Patel entered the grounds of the Allegro headquarters in Worcester, Massachusetts, just enough to be in range of the factory's Wi-Fi network. Allegro says that Patel used the second business-use laptop to connect to the company's network using the credentials of another employee. While connected to the factory's network on January 31, Allegro claims Patel, who was one of the two people in charge of Oracle programming, uploaded a "time bomb" to the company's Oracle finance module. The code was designed to execute a few months later, on April 1, 2016, the first week of the new fiscal year, and was meant to "copy certain headers or pointers to data into a separate database table and then to purge those headers from the finance module, thereby rendering the data in the module worthless." The company says that "defendant Patel knew that his sabotage of the finance module on the first week of the new fiscal year had the maximum potential to cause Allegro to suffer damages because it would prevent Allegro from completing the prior year's fiscal year-end accounting reconciliation and financial reports."
Who in the heck was monitoring for changes to Oracle's software? Too many unanswered questions.
Of all the knocks on Oracle I have seen on Slashdot (most of which are completely valid), I have never seen an insinuation that their products are not reliable. I do not believe that is one of their weaknesses.
Oh, it's reliable alright.
You can count on being reliably fucked as as customer at any given time.
And that's just dealing with the software audit mafia. Forget actually patching the fucking thing and not breaking all kinds of shit in the process.
"This could also happen if they forgot to renew the software."
Absolutely. The biggest time bomb of all might be simply to decline to share the file of license renewals. The company starts to feel the results of *that* after the admin is long gone. And all the warning messages go to the admin's closed account, or to a service account that nobody checks since he left.
The problem is, the results are indistinguishable from the case where the admin passed the information to "transition management" prior to being outsourced, only to have them lose it, so he gives them his spare copy, and they lose that also, and then a few months down the road when appliances and software suddenly stop working, offshore management blames the former admins for the debacle(s).
Don't ask me how I know this.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
An effective (and legal) way of screwing over an employer would be not to automate certain infrequent but mission-critical tasks. Just document what needs to be done (and when) in your well-written and exhaustive handover notes. If you're feeling unkind don't explicitly state why or how to perform such a task (e.g. "purge old logs from the database server instance weekly"). Bonus points if before you leave you pitch a project to automate essential maintenance tasks to your boss, and they shoot it down as a waste of time*.
When the intern/son of VP/HB1 they decided was a suitable replacement for an experienced sysadmin invariably hasn't followed the handover docs, the server will fill up, run out of space, and shit its pants. And they have nobody to blame but themselves. If they try to pin it on you, just send them the handover doc with the appropriate passage highlighted, and a copy of your consultancy rates if they'd like you to help sort it out.
I've never done this on purpose, but I know it would work, because every single place I've left has called up a few months later with some dire emergency that could have been easily avoided if they'd just read my handover notes.
*: this actually happened at a company I was leaving. I'd got a lot of vacation days accrued, and they wanted me to take them during my notice period rather than do the automation project I knew they needed, saving themselves two weeks of pay that they'd otherwise have to tack on to my final cheque. In the end they asked me back a few months after I'd quit, and paid me the equivalent of two months salary to do the project, which was basically just refactoring and gluing together the various crappy shell scripts I'd written over the years and setting up a traffic light status monitor so they could see when things needed looking at. I felt kind of bad for them, but then I remembered the reason I left is that they wouldn't take my advice...
Second translation: DB admins are pretty inept at IT. It's trivial to change the Mac address.
Once again proving that those that do evil deed are typically pretty stupid and leave obvious clues.
You missed the key point too.
The anon poster before you had the right idea.
He wouldn't need to keep the laptop if all he had to do was spoof the MAC address.>
If all he needed was the mac address, then he didn't even need the laptop. He could have spoofed the Mac Address. Most likely there was additional network security which is why he needed the laptop. It could be a cert/key etc. too that was on the laptop which he couldn't spoof.
I am at loss with words...