Slashdot Mirror
Wall Street IT Engineer Hacks Employer To See If He'll Be Fired (bleepingcomputer.com)
An anonymous reader writes:
A Wall Street engineer was arrested for planting credentials-logging malware on his company's servers. According to an FBI affidavit, the engineer used these credentials to log into fellow employees' accounts. The engineer claims he did so only because he heard rumors of an acquisition and wanted to make sure he wouldn't be let go. In reality, the employee did look at archived email inboxes, but he also stole encryption keys needed to access the protected source code of his employer's trading platform and trading algorithms.
Using his access to the company's Unix network (which he gained after a promotion last year), the employee then rerouted traffic through backup servers in order to avoid the company's traffic monitoring solution and steal the company's source code. The employee was caught after he kept intruding and disconnecting another employee's RDP session. The employee understood someone hacked his account and logged the attacker's unique identifier. Showing his total lack of understanding for how technology, logging and legal investigations work, the employee admitted via email to a fellow employee that he installed malware on the servers and hacked other employees.
Using his access to the company's Unix network (which he gained after a promotion last year), the employee then rerouted traffic through backup servers in order to avoid the company's traffic monitoring solution and steal the company's source code. The employee was caught after he kept intruding and disconnecting another employee's RDP session. The employee understood someone hacked his account and logged the attacker's unique identifier. Showing his total lack of understanding for how technology, logging and legal investigations work, the employee admitted via email to a fellow employee that he installed malware on the servers and hacked other employees.
Yes...
It didn't seem to occur to him that if he hacked them, it would make the answer to the question of "will he be fired?" a very definite "yes".
Of course, that's if we take his claims at face value; he was clearly looking to get a lot of other stuff, and that's the best excuse he could find. But he's still an idiot for thinking he wouldn't get caught and admitting in an email that he did it.
So a guy hacks his employer to steal proprietary code, gets caught and arrested? Who would have thought!
If you want news from today, you have to come back tomorrow.
Making license plates and office furniture.
It's probably going to be a more productive use of his time.
Meanwhile, the last guy who stole code from Wall Street, Sergey Aleynikov, who inspired the book, "Flash Boys: A Wall Street Revolt" by Michael Lewis, is still in the legal system after eight year.
http://nypost.com/2017/02/23/ex-goldman-programmer-appeals-court-conviction/
Typical shenanigans of a newly minted Admin who thinks he suddenly is the master of the universe. I doubt he is even the master of his own domain.
putting the 'B' in LGBTQ+
There's that weasel magical unicorn word "Unique Identifier". It's like we're watching an episode of star-trek; there's a plot, then plot break, then we interject this magical unicorn technology, which leads to another plot and plot breaks. If I were the hacker, of course I'd author an e-mail from the guy to his boss to cover my tracks.
https://www.linkedin.com/in/zhengquan-zhang-216515a
Guy was attending Tsinghua University then transferred here in the late 00's. He's probably a H1B, possibly a green card holder.
Few items for the educated here.
The only way he is that motivated to risk jail-time is if job-loss means being shipped back. Company dug their own grave on that one.
Want to bet if he was going to get shipped back, someone in China was in contact with him to steal whatever they could get their hands on or he was thinking about rebranding their software? I'd do it too. We all would.
Finally, Execs never talk about IT staff via e-mail. It's always done through phone calls and meetings. Want to really get the dirt? Bug your bosses phone. That's how it works in the real world.
"Aleynikov worked as a programmer for Goldman’s high-frequency trading operation until 2009, when he left to take a similar job at a Chicago firm, Teza Technologies....Aleynikov made a copy of the bank’s source code. Goldman complained to the FBI, which arrested Aleynikov at Newark airport.....Aleynikov doesn’t dispute he took the code, but claims he wanted to study it. His lawyer says that he didn’t break any criminal laws, and the matter should be a civil dispute."
Sort of reminds me of a certain Uber employee who took 19000 documents from Google on their self driving car, and insists he never read them and in no way have they been used by Uber, which bought his 'skills' when they aquired his self driving company.
Once upon of time this was corporate espionage, now it seems to be common place.
Blaming your actions and choices n prior choices made by someone else is just plain immature and reeks of the "Well *he* started it..." line that virtually every parent has heard from their kids when trying to diffuse a situation involving them with another child.
I'm just somewhat surprised that someone who apparently hasn't grasped the concept of personal accountability has a good enough work ethic to even get a job where they would have the ability to do what he did.
File under 'M' for 'Manic ranting'
Want to really get the dirt? Bug your bosses phone. That's how it works in the real world.
Considering "bugging your bosses phone" is one of those red flags that indicate that maybe it's time for a long vacation or for a major change in your career path.
Other red flags:
- asking a trusted coworker to setup parental control on your work laptop so you can't use it to watch porn in the bathroom
- knowing how many heartbeats it takes to do the elevator ride up to your floor
- opening multiple sock puppet Facebooks to see if the cute girl in HR would ignore friend requests from strangers like she ignored yours
- knowing the cleaners schedule so you can sift through people's trash cans after business hours without being caught
lucm, indeed.
How do people like this even have enough brain cells to remember to breathe, let alone perform technically advanced jobs?
File under 'M' for 'Manic ranting'
I noticed every negative comment about the editors get a -1 with no reply. Pretty obvious the editors are downvoting people, because no one here likes the editors.
Yup
If he wasn't aware of the possible consequences of his actions, then he isn't an engineer.
Hmm good point, I've never seen a comment defending them and admitted they downvoted someone.
The bad posts and spelling are one thing, but if they are voting people to -1 that they don't like they really should be fired.
What are you smokin', bro? You know that wouldn't work. At all.
Found all the potential idiots in their systems, exploited them, and then did it for free. Manager's dream employee
I am employed by a company I love working for, with I boss I think is wonderful. I expect to be terminated shortly, for reasons that are partly -my- fault, party just business.
Yeah, I'd totally not even think of doing something like this. First of all, it's completely unethical. Second, it's against my ethics. Third, it violated the System Administrators Oath.
https://lopsa.org/CodeOfEthics
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
Anything worth doing is worth overdoing. A hail to code optimization!
Initially, the optimized function bool::willIBefired() will always return true.
After optimization the result actually must be one of true or false.
Lesson learned: Don't let context influence optimization.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
This is the same company that had that "uat automated simulator released to production" error that cost them millions.
But yeah, very poor judgment on the engineers part.
Yep. They'll deny and lie and lie again until it comes out in the Press - you'll only know for sure about 3 hours after the rest of the world does.
All you losers using the lame vi protocol are stuck in the last century.
The guy hacked A UNIX NETWORK! I heard those networks are hardcore, some even use the vi protocol to load balance the kernel across multiple NFS loopbacks. It's basically POSIX grade security with layers upon layers of nmaps.
But is this UNIX webscale ? And does it enough Apps to synergize the user experience integration with cyberwarfare cryptosecurity ?
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Knowing wall street firms, they will be kind to their fellow criminals and use him to hack their rival firms, one would think.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Seriously, what sort of a dumbass do you need to be to not think you'll be fired after this. Normally ethically functioning people will update their resumes and web sites and as a side bet apply for a few jobs.
---- The above post was generated by the Turing Institute. Maybe.
The word is trademarked, and the word UNIX is capitalized. And no, "UNIX" is not "Linux".
I worked for a certain state agency. They used QMAIL and if you don't know all mail is stored as a flat file. So on occasion we'rd have to manually edit that mail file to snip out something that would cause POP and IMAP clients to freak out. One day our Admin Director is having email troubles so I go back to my desk and she tags along. She was aghast that I could read her email. I explained there was way too much integrity among IT staff and we'd never disclose what we saw.
Showing his total lack of understanding for how technology, logging and legal investigations work, the employee admitted via email to a fellow employee that he installed malware on the servers and hacked other employees.
This doesn't gibe with the previous paragraph.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
We have combed through millions of their files. And our sentinels have set their scanners to scan for the low hanging fruit.
What makes this degenerate a special snowflake is that it seems he never saw a single episode of Sesame Street, nor even played a game called What happens next?; none of his friends --if he had any --explained the concept behind a game called Truth or Consequence
does dumbass neckbeard thing. news at 9
That smart people can be drooling idiots.
Social engineering would have got him a LOT more information with no trail of evidence. But then that is asking an engineer to do social interaction... Not something they are capable of.
Do not look at laser with remaining good eye.
Wall Street IT Engineer Hacks Employer To See If He'll Be Fired
What is it with people in this industry who fear getting laid off (or fired, which is distinct)? You should expect a turnover every 4-5 years and plan accordingly. Unless you live in the middle of nowhere where employers are scarce (NYC certainly does not fit that label), all you need to do is brush up your skills, be proactive and cultivate a professional network to survive turn-overs.
If you are passive and lackadaisical with your career, however, I can see why you'd shit bricks every so often enough to think hacking your employer this way is a good idea :/
How is this offtopic? It directly relates to a guy being bad at his job.
OK, so he is aware of rumors of an acquisition and fears he will lose his job.
So, what he should have done is start a stealth job search. That way, he could be a "passive candidate" and get recruiters tripping over themselves to recruit him.
But nooooooooooooooooooooo.
Now he's fired. So, on top of the discrimination he will face for being out of work, now he has to explain how and why he left his last position.
You know, the one where a kid figured out how to refine thorium by reading the Golden Book of Chemistry and turned his mother's garden shed into a Superfund site.
The moral of the story is that even a stupid human being can be pretty smart. Particularly a sufficiently motivated stupid person.
Of course it also helps that intelligence comes in different flavors. Some people are good at spatial reasoning, others are good at verbal reasoning. But we often overlook social reasoning because it's not part of the traditional IQ tests. I think another reason that Social IQ testing hasn't caught on is that there is good reason to believe that social reasoning ability isn't fixed. Changes in attitude can strongly impair or enhance an individual's ability to process social information.
Which leads to the flip side of the stupid people being able to be smart: even smart people can be stupid, particularly in making social judgments.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Slashdot has editors? What editors?
No, actually, I don't know that.... what the fuck is someone doing continuing to work for somebody that they don't feel they can trust to be honest with them?
And if you never feel you can trust people you work for, then what would make you think that the problem isn't you, and not them?
I've once had the misfortune of working for an employer that I quickly came to realize I couldn't trust. I quit after just under three months.
File under 'M' for 'Manic ranting'
It kind of has to be that way. If they were to tell him a couple weeks ahead of time, people do things like this. In most firms I've been in, if you go give your 2 week notice they will pay you for the next 2 weeks, but you get walked out of the door immediately.
He probably watched Mr. Robot and thought he is as slick as the protagonist.
sudo rm -r -f --no-preserve-root /
The guy hacked A UNIX NETWORK!
No, he didn't. He had some credentials, both his own and some stolen . Nothing was "hacked".
(emphasis mine)
Getting into a system using stolen credentials is an activity known colloquially as "hacking in to an account".
From the article:
"starting December 2016, when Zhang was promoted to his supervisor role, the suspect installed malware on the company's servers to record credentials for other users...
"Zhang had used these credentials to access and steal parts of the source code of the company's trading platform and trading algorithms...
"Zhang rerouted traffic to backup proxy servers, managed by KCG, to hide the data transfers that exfiltrated the proprietary source code to a remote server."
So, he installed malware, stole access credentials, accessed other users' accounts, and rerouted data transfers through a different proxy server to avoid security. Yeah, that's hacking.
Have you ever considered you might have aspirer syndrome?
Asperger syndrome
No, Asperger syndrome is completely different. We're talking about aspirer syndrome here.
* Make sure your networking is good
* Update your resume
* Put in applications
Hacking your employer and spying on internal documents/connections... that's just idiotic. In that case you might as well add another one:
* Buy some soap on a rope
This is the very definition. This guy was dumb - seriously... the depth of hacking he did was amazing. You'd think at some level one might step back and think "well if they weren't going to lay me off.... this step will definitely get me **fired**"
Extra years for "dumb-assery"
I love working for, with I boss I think is wonderful.
you have an iBoss? NEAT! I did not know that apple was shipping those yet
It's the latest update of Wife 1.0
Crazy in the market I'm who cares, there's so many unfilled jobs in field here it's crazy. #ottawa
The attack was fairly sophisticated and perhaps the "fear of getting fired" story was simply that, a cover story. It seems like the real target was the source code.
> the employee admitted via email to a fellow employee
If all they have is an admittance via email, and there have been obvious intrusions into the network, why are they so sure it was actually the owner of that email address? Sounds like a super easy, obvious scapegoat.
Not to say that it isn't possible that it was indeed him, but it's hard to believe that he would admit to such a thing... and much easier to believe someone is trying to pin it on him.
If you are giving your two week notice, then you should already have another job lined up anyways... so that's not a problem. You would be available to start the job as soon as you tell your employer, and you could collect two weeks of extra pay while you work for someone else earning money there as well.
File under 'M' for 'Manic ranting'
we're also looking into commissioning a pilot for a new show called NCIS:Cyber, featuring the Naval Criminal Intelligence agencies that protect our brave Marines from hackers.
... and protect them against vaping also, I hope?
lucm, indeed.
You are fucking clueless and should excuse yourself from further posts on this topic.
Why do you keep going on about trust? Many companies just have a bad quarter/year and need to make cuts. Sometimes, it's a change in direction or company merger. There's countless reasons why you don't tell people ahead of time, from reasons that vary from panic to sabotage to misinformation to violent reactions. Talk to an experienced HR. Or watch the George Clooney movie about mass layoffs. But you are fucking naive and/or inexperienced in the workforce.
Because of course insulting a person's inteligence is such a classic way ot showing how they are wrong....
File under 'M' for 'Manic ranting'
Sure, but there's fewer reasons to not tell them if they actually ask. Again, if you cannot trust the employer to be honest with you about the security of your position when directly asked about the matter, then you probably should not be working for them in the first place
File under 'M' for 'Manic ranting'
Hacked Unix network, did not understand technology, used RDP. Those three do not go together. Why should Unix network have RDP? Crack and install on Unix he could, but of logs never heared of?
I've never seen that happen personally. What happens is that the person who has given notice works another two weeks, and never has precisely two weeks' work to do. In some circumstances it would make sense to get the guy out the door immediately, but not anywhere I've worked.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Some people need the paycheck, and can't find an employer they can trust immediately. Some figure they have a better job than they're likely to get elsewhere, and are willing to take the chance. On my first job, there was a round of layoffs, and management promised it would be the last, and it was until the end of the next month. Morale among the newly hired dropped like a rock.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
I get that, but then he reasonably should have already been looking for other work already, and it rightly wouldn't have mattered if there were actually plans to let him go or not that he otherwise didn't know about since he would be intent on leaving as soon as he finds something else anyways.
File under 'M' for 'Manic ranting'
It raises the risk of your best talent becoming aware of the cuts and leaving, with only the dead wood remaining. A significant amount of my salary comes from helping clean up after that when the people who really understand the technology leave.
The blog or and best that is extremely useful to keep I can share the ideas of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
animal jam | five nights at freddy's | hotmail login