Slashdot Mirror
Wall Street IT Engineer Hacks Employer To See If He'll Be Fired (bleepingcomputer.com)
An anonymous reader writes:
A Wall Street engineer was arrested for planting credentials-logging malware on his company's servers. According to an FBI affidavit, the engineer used these credentials to log into fellow employees' accounts. The engineer claims he did so only because he heard rumors of an acquisition and wanted to make sure he wouldn't be let go. In reality, the employee did look at archived email inboxes, but he also stole encryption keys needed to access the protected source code of his employer's trading platform and trading algorithms.
Using his access to the company's Unix network (which he gained after a promotion last year), the employee then rerouted traffic through backup servers in order to avoid the company's traffic monitoring solution and steal the company's source code. The employee was caught after he kept intruding and disconnecting another employee's RDP session. The employee understood someone hacked his account and logged the attacker's unique identifier. Showing his total lack of understanding for how technology, logging and legal investigations work, the employee admitted via email to a fellow employee that he installed malware on the servers and hacked other employees.
Using his access to the company's Unix network (which he gained after a promotion last year), the employee then rerouted traffic through backup servers in order to avoid the company's traffic monitoring solution and steal the company's source code. The employee was caught after he kept intruding and disconnecting another employee's RDP session. The employee understood someone hacked his account and logged the attacker's unique identifier. Showing his total lack of understanding for how technology, logging and legal investigations work, the employee admitted via email to a fellow employee that he installed malware on the servers and hacked other employees.
Yes...
It didn't seem to occur to him that if he hacked them, it would make the answer to the question of "will he be fired?" a very definite "yes".
Of course, that's if we take his claims at face value; he was clearly looking to get a lot of other stuff, and that's the best excuse he could find. But he's still an idiot for thinking he wouldn't get caught and admitting in an email that he did it.
So a guy hacks his employer to steal proprietary code, gets caught and arrested? Who would have thought!
If you want news from today, you have to come back tomorrow.
Meanwhile, the last guy who stole code from Wall Street, Sergey Aleynikov, who inspired the book, "Flash Boys: A Wall Street Revolt" by Michael Lewis, is still in the legal system after eight year.
http://nypost.com/2017/02/23/ex-goldman-programmer-appeals-court-conviction/
And more productive than anything Wall Street does.
putting the 'B' in LGBTQ+
Typical shenanigans of a newly minted Admin who thinks he suddenly is the master of the universe. I doubt he is even the master of his own domain.
putting the 'B' in LGBTQ+
"Aleynikov worked as a programmer for Goldman’s high-frequency trading operation until 2009, when he left to take a similar job at a Chicago firm, Teza Technologies....Aleynikov made a copy of the bank’s source code. Goldman complained to the FBI, which arrested Aleynikov at Newark airport.....Aleynikov doesn’t dispute he took the code, but claims he wanted to study it. His lawyer says that he didn’t break any criminal laws, and the matter should be a civil dispute."
Sort of reminds me of a certain Uber employee who took 19000 documents from Google on their self driving car, and insists he never read them and in no way have they been used by Uber, which bought his 'skills' when they aquired his self driving company.
Once upon of time this was corporate espionage, now it seems to be common place.
Blaming your actions and choices n prior choices made by someone else is just plain immature and reeks of the "Well *he* started it..." line that virtually every parent has heard from their kids when trying to diffuse a situation involving them with another child.
I'm just somewhat surprised that someone who apparently hasn't grasped the concept of personal accountability has a good enough work ethic to even get a job where they would have the ability to do what he did.
File under 'M' for 'Manic ranting'
Want to really get the dirt? Bug your bosses phone. That's how it works in the real world.
Considering "bugging your bosses phone" is one of those red flags that indicate that maybe it's time for a long vacation or for a major change in your career path.
Other red flags:
- asking a trusted coworker to setup parental control on your work laptop so you can't use it to watch porn in the bathroom
- knowing how many heartbeats it takes to do the elevator ride up to your floor
- opening multiple sock puppet Facebooks to see if the cute girl in HR would ignore friend requests from strangers like she ignored yours
- knowing the cleaners schedule so you can sift through people's trash cans after business hours without being caught
lucm, indeed.
How do people like this even have enough brain cells to remember to breathe, let alone perform technically advanced jobs?
File under 'M' for 'Manic ranting'
If he wasn't aware of the possible consequences of his actions, then he isn't an engineer.
I am employed by a company I love working for, with I boss I think is wonderful. I expect to be terminated shortly, for reasons that are partly -my- fault, party just business.
Yeah, I'd totally not even think of doing something like this. First of all, it's completely unethical. Second, it's against my ethics. Third, it violated the System Administrators Oath.
https://lopsa.org/CodeOfEthics
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
Anything worth doing is worth overdoing. A hail to code optimization!
Initially, the optimized function bool::willIBefired() will always return true.
After optimization the result actually must be one of true or false.
Lesson learned: Don't let context influence optimization.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
Yep. They'll deny and lie and lie again until it comes out in the Press - you'll only know for sure about 3 hours after the rest of the world does.
All you losers using the lame vi protocol are stuck in the last century.
The guy hacked A UNIX NETWORK! I heard those networks are hardcore, some even use the vi protocol to load balance the kernel across multiple NFS loopbacks. It's basically POSIX grade security with layers upon layers of nmaps.
But is this UNIX webscale ? And does it enough Apps to synergize the user experience integration with cyberwarfare cryptosecurity ?
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Knowing wall street firms, they will be kind to their fellow criminals and use him to hack their rival firms, one would think.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Seriously, what sort of a dumbass do you need to be to not think you'll be fired after this. Normally ethically functioning people will update their resumes and web sites and as a side bet apply for a few jobs.
---- The above post was generated by the Turing Institute. Maybe.
At least the outcome will be far more useful to the average person.
And less damaging, too.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I worked for a certain state agency. They used QMAIL and if you don't know all mail is stored as a flat file. So on occasion we'rd have to manually edit that mail file to snip out something that would cause POP and IMAP clients to freak out. One day our Admin Director is having email troubles so I go back to my desk and she tags along. She was aghast that I could read her email. I explained there was way too much integrity among IT staff and we'd never disclose what we saw.
Showing his total lack of understanding for how technology, logging and legal investigations work, the employee admitted via email to a fellow employee that he installed malware on the servers and hacked other employees.
This doesn't gibe with the previous paragraph.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
That smart people can be drooling idiots.
Social engineering would have got him a LOT more information with no trail of evidence. But then that is asking an engineer to do social interaction... Not something they are capable of.
Do not look at laser with remaining good eye.
Wall Street IT Engineer Hacks Employer To See If He'll Be Fired
What is it with people in this industry who fear getting laid off (or fired, which is distinct)? You should expect a turnover every 4-5 years and plan accordingly. Unless you live in the middle of nowhere where employers are scarce (NYC certainly does not fit that label), all you need to do is brush up your skills, be proactive and cultivate a professional network to survive turn-overs.
If you are passive and lackadaisical with your career, however, I can see why you'd shit bricks every so often enough to think hacking your employer this way is a good idea :/
You know, the one where a kid figured out how to refine thorium by reading the Golden Book of Chemistry and turned his mother's garden shed into a Superfund site.
The moral of the story is that even a stupid human being can be pretty smart. Particularly a sufficiently motivated stupid person.
Of course it also helps that intelligence comes in different flavors. Some people are good at spatial reasoning, others are good at verbal reasoning. But we often overlook social reasoning because it's not part of the traditional IQ tests. I think another reason that Social IQ testing hasn't caught on is that there is good reason to believe that social reasoning ability isn't fixed. Changes in attitude can strongly impair or enhance an individual's ability to process social information.
Which leads to the flip side of the stupid people being able to be smart: even smart people can be stupid, particularly in making social judgments.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
No, actually, I don't know that.... what the fuck is someone doing continuing to work for somebody that they don't feel they can trust to be honest with them?
And if you never feel you can trust people you work for, then what would make you think that the problem isn't you, and not them?
I've once had the misfortune of working for an employer that I quickly came to realize I couldn't trust. I quit after just under three months.
File under 'M' for 'Manic ranting'
He probably watched Mr. Robot and thought he is as slick as the protagonist.
sudo rm -r -f --no-preserve-root /
The guy hacked A UNIX NETWORK!
No, he didn't. He had some credentials, both his own and some stolen . Nothing was "hacked".
(emphasis mine)
Getting into a system using stolen credentials is an activity known colloquially as "hacking in to an account".
From the article:
"starting December 2016, when Zhang was promoted to his supervisor role, the suspect installed malware on the company's servers to record credentials for other users...
"Zhang had used these credentials to access and steal parts of the source code of the company's trading platform and trading algorithms...
"Zhang rerouted traffic to backup proxy servers, managed by KCG, to hide the data transfers that exfiltrated the proprietary source code to a remote server."
So, he installed malware, stole access credentials, accessed other users' accounts, and rerouted data transfers through a different proxy server to avoid security. Yeah, that's hacking.
Have you ever considered you might have aspirer syndrome?
Asperger syndrome
No, Asperger syndrome is completely different. We're talking about aspirer syndrome here.
* Make sure your networking is good
* Update your resume
* Put in applications
Hacking your employer and spying on internal documents/connections... that's just idiotic. In that case you might as well add another one:
* Buy some soap on a rope
This is the very definition. This guy was dumb - seriously... the depth of hacking he did was amazing. You'd think at some level one might step back and think "well if they weren't going to lay me off.... this step will definitely get me **fired**"
Extra years for "dumb-assery"
I love working for, with I boss I think is wonderful.
you have an iBoss? NEAT! I did not know that apple was shipping those yet
It's the latest update of Wife 1.0
The attack was fairly sophisticated and perhaps the "fear of getting fired" story was simply that, a cover story. It seems like the real target was the source code.
It's a bit of a genericized trademark, since it's applied to Unix-like OS's like AIX or HP/UX.
When you see the name UNIX, which of these do you think of? https://en.wikipedia.org/wiki/...
If you are giving your two week notice, then you should already have another job lined up anyways... so that's not a problem. You would be available to start the job as soon as you tell your employer, and you could collect two weeks of extra pay while you work for someone else earning money there as well.
File under 'M' for 'Manic ranting'
we're also looking into commissioning a pilot for a new show called NCIS:Cyber, featuring the Naval Criminal Intelligence agencies that protect our brave Marines from hackers.
... and protect them against vaping also, I hope?
lucm, indeed.
I'm afraid that I've encountered a few engineers who refuse to acknowledge the distinction between UNIX operating systems, which follow certain detailed standards documented in the "Single UNIX Standard" at https://www2.opengroup.org/ogs... and other operating systems whose kernels, and whose core libraries, have critical distinctions. MacOS, for example, is. Linux is not, as documented at https://www.iso.org/standard/3... . Solaris was, and SCO OpenServer was, as was AT&T SysV.
Following a standard in every detail can be difficult, confusing, and expensive to verify. This is partly why genuine UNIX operating systems have fallen out of favor in many environments.
You are fucking clueless and should excuse yourself from further posts on this topic.
Why do you keep going on about trust? Many companies just have a bad quarter/year and need to make cuts. Sometimes, it's a change in direction or company merger. There's countless reasons why you don't tell people ahead of time, from reasons that vary from panic to sabotage to misinformation to violent reactions. Talk to an experienced HR. Or watch the George Clooney movie about mass layoffs. But you are fucking naive and/or inexperienced in the workforce.
Because of course insulting a person's inteligence is such a classic way ot showing how they are wrong....
File under 'M' for 'Manic ranting'
Sure, but there's fewer reasons to not tell them if they actually ask. Again, if you cannot trust the employer to be honest with you about the security of your position when directly asked about the matter, then you probably should not be working for them in the first place
File under 'M' for 'Manic ranting'
I've never seen that happen personally. What happens is that the person who has given notice works another two weeks, and never has precisely two weeks' work to do. In some circumstances it would make sense to get the guy out the door immediately, but not anywhere I've worked.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Some people need the paycheck, and can't find an employer they can trust immediately. Some figure they have a better job than they're likely to get elsewhere, and are willing to take the chance. On my first job, there was a round of layoffs, and management promised it would be the last, and it was until the end of the next month. Morale among the newly hired dropped like a rock.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
I get that, but then he reasonably should have already been looking for other work already, and it rightly wouldn't have mattered if there were actually plans to let him go or not that he otherwise didn't know about since he would be intent on leaving as soon as he finds something else anyways.
File under 'M' for 'Manic ranting'
It raises the risk of your best talent becoming aware of the cuts and leaving, with only the dead wood remaining. A significant amount of my salary comes from helping clean up after that when the people who really understand the technology leave.
It's a matter of magnitude. A goon with a sack of license plates can ruin one life at a time. A wall street locust with computer support can ruin many, many thousands per second.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.