Slashdot Mirror
Former Sysadmin Accused of Planting 'Time Bomb' In Company's Database (bleepingcomputer.com)
An anonymous reader writes: Allegro MicroSystems LLC is suing a former IT employee for sabotaging its database using a "time bomb" that deleted crucial financial data in the first week of the new fiscal year. According to court documents, after resigning from his job, a former sysadmin kept one of two laptops. On January 31, Patel entered the grounds of the Allegro headquarters in Worcester, Massachusetts, just enough to be in range of the factory's Wi-Fi network. Allegro says that Patel used the second business-use laptop to connect to the company's network using the credentials of another employee. While connected to the factory's network on January 31, Allegro claims Patel, who was one of the two people in charge of Oracle programming, uploaded a "time bomb" to the company's Oracle finance module. The code was designed to execute a few months later, on April 1, 2016, the first week of the new fiscal year, and was meant to "copy certain headers or pointers to data into a separate database table and then to purge those headers from the finance module, thereby rendering the data in the module worthless." The company says that "defendant Patel knew that his sabotage of the finance module on the first week of the new fiscal year had the maximum potential to cause Allegro to suffer damages because it would prevent Allegro from completing the prior year's fiscal year-end accounting reconciliation and financial reports."
They're using Oracle.
.....and, backups??! But of course, that's a silly question.
"Eventually, they traced the unauthorized access to Patel's second business laptop based on the device's "electronic fingerprint.""
Translation: Someone with a functioning braincell in the IT department googled about MAC addresses and thought maybe they should check the wifi router logs and look for unauthorised access by company issue laptops.
One more stupid question:
Have you ever worked anywhere before?
Who in the heck was monitoring for changes to Oracle's software? Too many unanswered questions.
Allegro's IT staff discovered the sabotaged Oracle finance module on April 14, 2016. Ten days later, on April 24, the IT staffers found Patel's malicious code after comparing the current database with a copy from older backups.
I am sure a big company like Allegro will have all the critical information replicated in multiple locations. I am sure they restored all the data in a few seconds and laughed at the stupid sys admin. Right? That is how the story should have ended
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
You think a malicious sysadmin wouldn't know to target the backups as well?
The article said he resigned.
In most cases of IT staff leaving a company, the word "resigned" is a euphemism, and should be written in quotes.
To this day (wow, has it really been 50 years?), I still don't know why Number Six resigned. Perhaps the reason he was kidnapped and taken to The Village, was that the government had serious concerns about what he was going to do next. Until you know why he resigned, it's really hard to guess anything else.
"Believe me!" -- Donald Trump
"This could also happen if they forgot to renew the software."
Absolutely. The biggest time bomb of all might be simply to decline to share the file of license renewals. The company starts to feel the results of *that* after the admin is long gone. And all the warning messages go to the admin's closed account, or to a service account that nobody checks since he left.
The problem is, the results are indistinguishable from the case where the admin passed the information to "transition management" prior to being outsourced, only to have them lose it, so he gives them his spare copy, and they lose that also, and then a few months down the road when appliances and software suddenly stop working, offshore management blames the former admins for the debacle(s).
Don't ask me how I know this.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
The other anon is right: in the real world, unless your employer is NSA or something of comparable caliber, as an admin you have access to everything - whatever you don't have access to, you can obtain, without the employer's knowledge.
The only defenses against rogue admins companies really have is to have more loyal admins, and not to piss admins off. Plus threat of lawsuit if the admin fails to cover his traces after going rogue. Essentially, you can only try to reduce damage after the attack, you can't prevent the attack.
And to have anything "better", you have to spend so much on security, that unless security is your *product*, you'll be creating losses.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2