Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twin brothers wipe 96 government databases minutes after being fired

arstechnica.com

Post reply on HN
Print view View original

171–180 of 463 posts

Re: Twin brothers wipe 96 government databases minutes after being fired

#171

Post by fc417fc802 »

scottlamb wrote: post #66
tempaccount5050 wrote: post #58

Earlier quoted context omitted.

Yeah I don't see why that's necessary. I'm sure you can always reach out to HR and ask (I have facilitated this in the past, pulling contact lists and phone numbers) but that also gives them ways to exfiltrate data. It's company data. Just think of all the info you have in your inbox. Unless you've managed offboarding for high level IT positions it seems harsh, but the risk is just too high to allow the user to do th…

> Just think of all the info you have in your inbox. Meh? Sure, stuff that would help assemble a credible phishing attack, but not customer SPII or huge amounts of intellectual property or anything. If the assumption is that employees' inboxes are full of dangerous things, I would focus on fixing that.

No you don't get it, we have to take a harsh approach to firing people because we keep pallets of high explosive in the break room and management doesn't want to change that. /s

Re: Twin brothers wipe 96 government databases minutes after being fired

#172

Post by dullcrisp »

xethos wrote: post #161
r3trohack3r wrote: post #153

Earlier quoted context omitted.

Murder by computer keyboard: https://www.deseret.com/1997/7/6/19322063/mother-charged-wit... Murder by ethernet cable: https://www.gainesvilletimes.com/news/dead-woman-found-in-pa... Murder by laptop: https://www.riverfronttimes.com/william-lynn-gunter-sentence... Murder by cellphone charger: https://lawandcrime.com/crime/pennsylvania-man-admits-to-str... Murder by desk lamp: https://www.pressdemocrat.com/2009/01/08/…

My larger point is that nobody - nobody - defaults to telling us the coffee mug is unregulated, as AI allegedly ought to be. They always compare it to something much more commonly used as a weapon; something that, when asked to name a household object likely to be used as a weapon, the average person would guess.

Your point is that people make a stronger argument even when a weaker one would be sufficient?

Re: Twin brothers wipe 96 government databases minutes after being fired

#173

Post by ddosmax556 »

ponector wrote: post #168
tempaccount5050 wrote: post #45

Earlier quoted context omitted.

When you are talking about access like they had "make firings as abrupt as possible including terminating all access immediately" not doing this is incompetence. This is absolutely a standard and has to be for these kinds of positions. I've never worked anywhere where it wasn't for the majority of IT staff. You meet with HR, someone clears your desk, and security walks you out.

If you don't trust your people so much, why to hire them in a first place? Looking at it from Europe - it is such a weird inhumane practice. Someone decided your position is redundant. Okay, shit happens, economic downturn, etc. Then you have extra 3-6 months of work to pass your knowledge, train replacement and document everything.

Looking at it from Europe, this definitely also happens. It depends on the situation. I know of ppl who were kept bcs the parting was in good faith (which was less a firing and more an agreement that parting is in everyone's interest), but I also know of ppl who had their access revoked before firing bcs it wasn't. The latter had unilateral system access as well, which added to it. It's not about humane or inhumane, it's about risk. The 3-6 months being nice is also a fairytale that I have only ever heard in a positive light from employees who are not particularly ambitious or awake or in any way satisfied with their jobs or the prospect of a future job. On the other hand from the perspective of employers it's consistently hard to effectively restructure, it's expensice and awkward to have to pretend to want to keep someone around that you or they don't want around.

It's just one of these rules that unfortunately in Europe allow people to view life purely as the time between jobs. I'd never tell that to someone's face but it's simply a fact that the world stops of people don't work and no matter what the ideal world looks like in your dreams, working is the only real way forward for anything. It's part of the reason why Europe is falling behind on everything.

Re: Twin brothers wipe 96 government databases minutes after being fired

#174

Post by notahacker »

JumpCrisscross wrote: post #144

> Muneeb and Sohaib Akhter, now both 34, had been in trouble before. Back in 2015, the brothers pled guilty in Virginia to a scheme involving wire fraud and computers. Muneeb was sentenced to three years in prison, while Sohaib got two. After their stints in jail, the brothers worked their way back into the tech world. In 2023, Muneeb got a job with a Washington, DC, firm that sold software and services to 45 federal…

The fraud conviction seems totally inappropriate for a government contractor and yet... somehow totally appropriate for someone appointed to work directly for the upper echelons of federal government. Hell, everyone else hacking government officials emails and tax returns and randomly deleting stuff for the lolz in February 2025 was being paid by DOGE.

Re: Twin brothers wipe 96 government databases minutes after being fired

#175

Post by oliyoung »

t0mas88 wrote: post #148
game_the0ry wrote: post #41

Earlier quoted context omitted.

> At 4:59 pm, he asked an AI tool, “How do i clear system logs from SQL servers after deleting databases?” He later asked, “How do you clear all event and application logs from Microsoft windows server 2012?” So many red flags, I can't even.

> In the space of a single hour, Muneeb deleted around 96 databases with US government information. He downloaded 1,805 files belonging to the EEOC and stashed them on a USB drive, then grabbed federal tax information for at least 450 people. Maybe whoever runs infosec at that place should also be fired?

Brave of you to assume they had anyone running infosec by the sounds of it

Re: Twin brothers wipe 96 government databases minutes after being fired

#176

Post by scottlamb »

tempaccount5050 wrote: post #125
lesuorac wrote: post #76

Earlier quoted context omitted.

Yeah but if you defense against somebody erasing a database is "we remove their access when they're fired" then your defense is garbage. Like there's so many other attack vectors besides an upset ex-employee.. Like all those articles about NK employees who presumably are trying very hard not to be fired. Or employees using company provided insecure email software leaving them vulnerable to ransomware et al.

I'm talking about off-boarding not general day to day security.

But I'm talking about general day-to-day security as well as off-boarding. What stops a single disgruntled employee from doing this before being fired? And if you have a good story there, why do you need the most extreme approach to "off-boarding"?

It makes sense to terminate someone's high-risk credentials immediately when they're fired. But it's extremely worrying if every credential held by every employee is considered high-risk. It suggests a bigger failure. "Unilateral access to a database filled with plain-text passwords" shouldn't ever exist. "Email account filled with dangerous stuff" should at least be unusual.

Re: Twin brothers wipe 96 government databases minutes after being fired

#177

Post by Beestie »

I don’t know where to start with this other than to point out that there is no way in hell these two clowns had the security clearance necessary to access a prod DB at DHS. I can only assume they stole creds from another employee who had that level of clearance. Also, tax records are not stored in a DHS domain .

I think this story has been sanitized to mask some details which is ok I guess but I ain’t buying the back story.

Re: Twin brothers wipe 96 government databases minutes after being fired

#178

Post by notahacker »

JuniperMesos wrote: post #165
JumpCrisscross wrote: post #144

> Muneeb and Sohaib Akhter, now both 34, had been in trouble before. Back in 2015, the brothers pled guilty in Virginia to a scheme involving wire fraud and computers. Muneeb was sentenced to three years in prison, while Sohaib got two. After their stints in jail, the brothers worked their way back into the tech world. In 2023, Muneeb got a job with a Washington, DC, firm that sold software and services to 45 federal…

No, this is exactly what giving people second chances looks like. It means taking a risk that they're the sort of person who is likely to commit a crime and who will commit a crime again after being given the second chance. The only way to prevent this is to have a blanket policy against giving second chances to people convicted of crimes, which harms people who genuinely intend to reform and not commit crimes again,…

There are literally thousands of occupations a former computer based wire fraudster can be given a second chance in that aren't here's a computer full of sensitive government files, with CRUD privileges.

Like... I think ex drugs dealer deserve a chance of legitimate employment, but perhaps doling out prescription drugs is best left to someone that doesn't need a "second chance" to demonstrate they're unusually trustworthy and unlikely to be tempted by the possible side incomes.

Re: Twin brothers wipe 96 government databases minutes after being fired

#179

Post by lazide »

mquander wrote: post #146
stronglikedan wrote: post #136

Earlier quoted context omitted.

The first option is flipping one switch. The second option is flipping some switches now, and flipping the rest later. Of course the safest (first) option is the correct option from a liability standpoint, which is all a company should operate on since it's first responsibility is to protect the company for those that are still there. There's plenty of ways to communicate with ex-colleagues that don't involve company…

> Of course the safest (first) option is the correct option from a liability standpoint, which is all a company should operate on since it's first responsibility is to protect the company for those that are still there. Isn't this an unrealistically black-and-white mode of thinking? Humans are complicated and have many values and perceived responsibilities. It's not healthy for them to throw them all out and act as i…

So, never lived in corp land? Healthy isn’t on most corporations radars except where it causes liability to them.

Re: Twin brothers wipe 96 government databases minutes after being fired

#180

Post by avereveard »

mquander wrote: post #146
stronglikedan wrote: post #136

Earlier quoted context omitted.

The first option is flipping one switch. The second option is flipping some switches now, and flipping the rest later. Of course the safest (first) option is the correct option from a liability standpoint, which is all a company should operate on since it's first responsibility is to protect the company for those that are still there. There's plenty of ways to communicate with ex-colleagues that don't involve company…

> Of course the safest (first) option is the correct option from a liability standpoint, which is all a company should operate on since it's first responsibility is to protect the company for those that are still there. Isn't this an unrealistically black-and-white mode of thinking? Humans are complicated and have many values and perceived responsibilities. It's not healthy for them to throw them all out and act as i…

System security is not a human value. Access key rotation effective immediately is a compliance requirement, and completely orthogonal to human decency, which is delivered trough garden leave or severance, not extended system access
Post reply on HN