How in the world can you stop that and why did the company have only 1 person handle such an important task?
Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb
11–20 of 54 posts
Re: Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb
#12While it will probably always be hard to stop inside-man attacks, it will probably always be easy to do backups :)
Just imagine if that guy had been successful. Americans would have been debt free!!
Re: Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb
#13Does anyone know what the actual "logic bomb" consisted of? My money is on a crontab that executed a simple set of ssh command attacks on the specified date. As per the article, to destroy "all data, including financial, securities and mortgage information," it would be as simple as an "rm -rf" across multiple servers. Except for one critical item, he would have to have root access on all those servers. Either the sc…
More info here - http://news.softpedia.com/news/Rogue-IT-admin-Close-to-Shutt...
Re: Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb
#1441 months seems exceptionally high given that it was discovered before execution. It would take me an hour to dig it all up, but there are federal sentencing guidelines based on the dollar amount of damages. I don't think they take potential damages into account.
Re: Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb
#15Does anyone know what the actual "logic bomb" consisted of? My money is on a crontab that executed a simple set of ssh command attacks on the specified date. As per the article, to destroy "all data, including financial, securities and mortgage information," it would be as simple as an "rm -rf" across multiple servers. Except for one critical item, he would have to have root access on all those servers. Either the sc…
Or they have an automated system that has root access to everything (say, to push config changes), and he had access to that system, or he had a way to crash/corrupt their SAN, or they only do black-box testing and not full code reviews (and the next guy to get assigned a bug in that same program found it), or they have code reviews that can be dodged with faked documentation, or...
Re: Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb
#16Does anyone know what the actual "logic bomb" consisted of? My money is on a crontab that executed a simple set of ssh command attacks on the specified date. As per the article, to destroy "all data, including financial, securities and mortgage information," it would be as simple as an "rm -rf" across multiple servers. Except for one critical item, he would have to have root access on all those servers. Either the sc…
More info here - http://news.softpedia.com/news/Rogue-IT-admin-Close-to-Shutt...
The choice bits:
> During this time Makwana had root access to all of the main
> systems, credentials which the company failed to revoke until
> the evening of the day of his layoff.
> His intention was nothing short of replacing the entire financial
> data, including the backups, from all of the company's production
> servers, with zeroes.
> the admin appended malicious code to a legitimate script, leaving
> a page-worth of blank lines between the two in order to avoid
> detection.
> Had this malicious script executed, engineers expect it would
> have caused millions of dollars of damage and reduced if not
> shutdown operations at Fannie Mae for at least one week.Re: Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb
#17Does anyone know what the actual "logic bomb" consisted of? My money is on a crontab that executed a simple set of ssh command attacks on the specified date. As per the article, to destroy "all data, including financial, securities and mortgage information," it would be as simple as an "rm -rf" across multiple servers. Except for one critical item, he would have to have root access on all those servers. Either the sc…
More info here - http://news.softpedia.com/news/Rogue-IT-admin-Close-to-Shutt...
During this time Makwana had root access to all of the main systems
This quote above, and the entire article boggles the mind. I've worked with big and small organizations that protected root on <10 machines like it was the key to preventing aging.
Re: Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb
#18Actually it s very easy to plant a logic bomb using http://en.wikipedia.org/wiki/Bit_twiddler
Re: Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb
#195000 Servers. A "Senior Engineer" discovered this script. Probably it was a cron job or something which they review regularly? Would be useful to know how exactly they got to that one script. Must have real good review practices , audits and logging in place if they were able to find it before it did the damage and then collect evidence to trace it back to the perpetrator.
According to an article about the indictment, it was discovered by chance:
"It was only by chance that [the Fannie Mae engineer] scrolled down to the bottom of the legitimate script to discover the malicious script"
http://www.computerworld.com/s/article/9127040/Fannie_Mae_en...
Re: Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb
#20While it will probably always be hard to stop inside-man attacks, it will probably always be easy to do backups :)
Just imagine if that guy had been successful. Americans would have been debt free!!
You think that debt wasn't leveraged? You think people can just not pay back loans and no one gets hurt?