Slashdot Mirror
Wall Street IT Engineer Hacks Employer To See If He'll Be Fired (bleepingcomputer.com)
An anonymous reader writes:
A Wall Street engineer was arrested for planting credentials-logging malware on his company's servers. According to an FBI affidavit, the engineer used these credentials to log into fellow employees' accounts. The engineer claims he did so only because he heard rumors of an acquisition and wanted to make sure he wouldn't be let go. In reality, the employee did look at archived email inboxes, but he also stole encryption keys needed to access the protected source code of his employer's trading platform and trading algorithms.
Using his access to the company's Unix network (which he gained after a promotion last year), the employee then rerouted traffic through backup servers in order to avoid the company's traffic monitoring solution and steal the company's source code. The employee was caught after he kept intruding and disconnecting another employee's RDP session. The employee understood someone hacked his account and logged the attacker's unique identifier. Showing his total lack of understanding for how technology, logging and legal investigations work, the employee admitted via email to a fellow employee that he installed malware on the servers and hacked other employees.
Using his access to the company's Unix network (which he gained after a promotion last year), the employee then rerouted traffic through backup servers in order to avoid the company's traffic monitoring solution and steal the company's source code. The employee was caught after he kept intruding and disconnecting another employee's RDP session. The employee understood someone hacked his account and logged the attacker's unique identifier. Showing his total lack of understanding for how technology, logging and legal investigations work, the employee admitted via email to a fellow employee that he installed malware on the servers and hacked other employees.
Yes...
It didn't seem to occur to him that if he hacked them, it would make the answer to the question of "will he be fired?" a very definite "yes".
Of course, that's if we take his claims at face value; he was clearly looking to get a lot of other stuff, and that's the best excuse he could find. But he's still an idiot for thinking he wouldn't get caught and admitting in an email that he did it.
So a guy hacks his employer to steal proprietary code, gets caught and arrested? Who would have thought!
If you want news from today, you have to come back tomorrow.
Meanwhile, the last guy who stole code from Wall Street, Sergey Aleynikov, who inspired the book, "Flash Boys: A Wall Street Revolt" by Michael Lewis, is still in the legal system after eight year.
http://nypost.com/2017/02/23/ex-goldman-programmer-appeals-court-conviction/
And more productive than anything Wall Street does.
putting the 'B' in LGBTQ+
Typical shenanigans of a newly minted Admin who thinks he suddenly is the master of the universe. I doubt he is even the master of his own domain.
putting the 'B' in LGBTQ+
"Aleynikov worked as a programmer for Goldman’s high-frequency trading operation until 2009, when he left to take a similar job at a Chicago firm, Teza Technologies....Aleynikov made a copy of the bank’s source code. Goldman complained to the FBI, which arrested Aleynikov at Newark airport.....Aleynikov doesn’t dispute he took the code, but claims he wanted to study it. His lawyer says that he didn’t break any criminal laws, and the matter should be a civil dispute."
Sort of reminds me of a certain Uber employee who took 19000 documents from Google on their self driving car, and insists he never read them and in no way have they been used by Uber, which bought his 'skills' when they aquired his self driving company.
Once upon of time this was corporate espionage, now it seems to be common place.
Want to really get the dirt? Bug your bosses phone. That's how it works in the real world.
Considering "bugging your bosses phone" is one of those red flags that indicate that maybe it's time for a long vacation or for a major change in your career path.
Other red flags:
- asking a trusted coworker to setup parental control on your work laptop so you can't use it to watch porn in the bathroom
- knowing how many heartbeats it takes to do the elevator ride up to your floor
- opening multiple sock puppet Facebooks to see if the cute girl in HR would ignore friend requests from strangers like she ignored yours
- knowing the cleaners schedule so you can sift through people's trash cans after business hours without being caught
lucm, indeed.
If he wasn't aware of the possible consequences of his actions, then he isn't an engineer.
I am employed by a company I love working for, with I boss I think is wonderful. I expect to be terminated shortly, for reasons that are partly -my- fault, party just business.
Yeah, I'd totally not even think of doing something like this. First of all, it's completely unethical. Second, it's against my ethics. Third, it violated the System Administrators Oath.
https://lopsa.org/CodeOfEthics
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
Anything worth doing is worth overdoing. A hail to code optimization!
Initially, the optimized function bool::willIBefired() will always return true.
After optimization the result actually must be one of true or false.
Lesson learned: Don't let context influence optimization.
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
Well, it was a job at Wall Street. Their "good work ethics" radar is probably somewhat out of alignment. ;-P
The guy hacked A UNIX NETWORK! I heard those networks are hardcore, some even use the vi protocol to load balance the kernel across multiple NFS loopbacks. It's basically POSIX grade security with layers upon layers of nmaps.
But is this UNIX webscale ? And does it enough Apps to synergize the user experience integration with cyberwarfare cryptosecurity ?
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
At least the outcome will be far more useful to the average person.
And less damaging, too.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I suspect he was planning to market the data, or already had a buyer. His explanation doesn't make sense.
Wall Street IT Engineer Hacks Employer To See If He'll Be Fired
What is it with people in this industry who fear getting laid off (or fired, which is distinct)? You should expect a turnover every 4-5 years and plan accordingly. Unless you live in the middle of nowhere where employers are scarce (NYC certainly does not fit that label), all you need to do is brush up your skills, be proactive and cultivate a professional network to survive turn-overs.
If you are passive and lackadaisical with your career, however, I can see why you'd shit bricks every so often enough to think hacking your employer this way is a good idea :/
You know, the one where a kid figured out how to refine thorium by reading the Golden Book of Chemistry and turned his mother's garden shed into a Superfund site.
The moral of the story is that even a stupid human being can be pretty smart. Particularly a sufficiently motivated stupid person.
Of course it also helps that intelligence comes in different flavors. Some people are good at spatial reasoning, others are good at verbal reasoning. But we often overlook social reasoning because it's not part of the traditional IQ tests. I think another reason that Social IQ testing hasn't caught on is that there is good reason to believe that social reasoning ability isn't fixed. Changes in attitude can strongly impair or enhance an individual's ability to process social information.
Which leads to the flip side of the stupid people being able to be smart: even smart people can be stupid, particularly in making social judgments.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
The guy hacked A UNIX NETWORK!
No, he didn't. He had some credentials, both his own and some stolen . Nothing was "hacked".
(emphasis mine)
Getting into a system using stolen credentials is an activity known colloquially as "hacking in to an account".
From the article:
"starting December 2016, when Zhang was promoted to his supervisor role, the suspect installed malware on the company's servers to record credentials for other users...
"Zhang had used these credentials to access and steal parts of the source code of the company's trading platform and trading algorithms...
"Zhang rerouted traffic to backup proxy servers, managed by KCG, to hide the data transfers that exfiltrated the proprietary source code to a remote server."
So, he installed malware, stole access credentials, accessed other users' accounts, and rerouted data transfers through a different proxy server to avoid security. Yeah, that's hacking.