Slashdot Mirror
Former Sysadmin Accused of Planting 'Time Bomb' In Company's Database (bleepingcomputer.com)
An anonymous reader writes: Allegro MicroSystems LLC is suing a former IT employee for sabotaging its database using a "time bomb" that deleted crucial financial data in the first week of the new fiscal year. According to court documents, after resigning from his job, a former sysadmin kept one of two laptops. On January 31, Patel entered the grounds of the Allegro headquarters in Worcester, Massachusetts, just enough to be in range of the factory's Wi-Fi network. Allegro says that Patel used the second business-use laptop to connect to the company's network using the credentials of another employee. While connected to the factory's network on January 31, Allegro claims Patel, who was one of the two people in charge of Oracle programming, uploaded a "time bomb" to the company's Oracle finance module. The code was designed to execute a few months later, on April 1, 2016, the first week of the new fiscal year, and was meant to "copy certain headers or pointers to data into a separate database table and then to purge those headers from the finance module, thereby rendering the data in the module worthless." The company says that "defendant Patel knew that his sabotage of the finance module on the first week of the new fiscal year had the maximum potential to cause Allegro to suffer damages because it would prevent Allegro from completing the prior year's fiscal year-end accounting reconciliation and financial reports."
Seriously, why would it even be an issue? Critical code and data, but not backed up?
They're using Oracle.
.....and, backups??! But of course, that's a silly question.
"Eventually, they traced the unauthorized access to Patel's second business laptop based on the device's "electronic fingerprint.""
Translation: Someone with a functioning braincell in the IT department googled about MAC addresses and thought maybe they should check the wifi router logs and look for unauthorised access by company issue laptops.
One more stupid question:
Have you ever worked anywhere before?
Who in the heck was monitoring for changes to Oracle's software? Too many unanswered questions.
Allegro's IT staff discovered the sabotaged Oracle finance module on April 14, 2016. Ten days later, on April 24, the IT staffers found Patel's malicious code after comparing the current database with a copy from older backups.
I am sure a big company like Allegro will have all the critical information replicated in multiple locations. I am sure they restored all the data in a few seconds and laughed at the stupid sys admin. Right? That is how the story should have ended
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Eventually, they traced the unauthorized access to Patel's second business laptop based on the device's "electronic fingerprint."
By "electronic fingerprint", I suspect they're referring to the MAC address of the laptop's WiFi adapter, in which case the guy is a bit of a noob for not spoofing it.
The article said he resigned.
In most cases of IT staff leaving a company, the word "resigned" is a euphemism, and should be written in quotes.
... for a sysadmin.
Know where the logs are and erase the goddam things.
It little behooves the best of us to comment on the rest of us.
To this day (wow, has it really been 50 years?), I still don't know why Number Six resigned. Perhaps the reason he was kidnapped and taken to The Village, was that the government had serious concerns about what he was going to do next. Until you know why he resigned, it's really hard to guess anything else.
"Believe me!" -- Donald Trump
Not disagreeing with you, but I've seen a few people "rage quit". This incident would seem to fit that pattern. On the bright side, at least he didn't walk in with a machine gun.
Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws-Plato
"This could also happen if they forgot to renew the software."
Absolutely. The biggest time bomb of all might be simply to decline to share the file of license renewals. The company starts to feel the results of *that* after the admin is long gone. And all the warning messages go to the admin's closed account, or to a service account that nobody checks since he left.
The problem is, the results are indistinguishable from the case where the admin passed the information to "transition management" prior to being outsourced, only to have them lose it, so he gives them his spare copy, and they lose that also, and then a few months down the road when appliances and software suddenly stop working, offshore management blames the former admins for the debacle(s).
Don't ask me how I know this.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
The other anon is right: in the real world, unless your employer is NSA or something of comparable caliber, as an admin you have access to everything - whatever you don't have access to, you can obtain, without the employer's knowledge.
The only defenses against rogue admins companies really have is to have more loyal admins, and not to piss admins off. Plus threat of lawsuit if the admin fails to cover his traces after going rogue. Essentially, you can only try to reduce damage after the attack, you can't prevent the attack.
And to have anything "better", you have to spend so much on security, that unless security is your *product*, you'll be creating losses.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Probably for the same reason I know that.
Sigh.
-- Tigger warning: This post may contain tiggers! --
Whatever the circumstances, professionals do not sabotage their former employers (or current employers, for that matter).
Besides compromising your professional integrity, and risking criminal charges, it's just not work your time. Move on and live your life.
https://www.linkedin.com/in/ni... Although I'd consider that there is a possible chance that they were actually hacked instead.