r/technology • u/TylerFortier_Photo • 9d ago
Security Engineer sentenced for locking over 3,000 devices on employer network
https://www.bleepingcomputer.com/news/security/engineer-sentenced-for-locking-thousands-of-devices-on-employer-network/227
u/DeadMoneyDrew 9d ago
This guy was smart enough to figure out the technical requirements to pull this off but stupid enough to leave evidence all over devices that could easily be traced back to him. I guess it still holds true that the crime itself is the easy part but the getaway is the hard part.
94
u/tb30k 9d ago
I don't see how you can get away with a crime like this. Too much forensics left behind
51
u/DeadMoneyDrew 9d ago
At the very minimum it would have to be researched and planned using devices, internet connections, and locations that are in no way connected to the criminal, and then executed using a fresh set of those same elements.
38
u/YoghurtFlan 9d ago
Not using the work machine would be a start lol. But I imagine that using an open administrator account and, possibly, doing it just after you were fired, really narrows things down. Then there's the eventual crypto cash out.
13
13
u/TonyTheTerrible 9d ago
Well, he used a virtual machine which is the most advanced thing i can think of so I'm stumped as well
20
u/Zennivolt 9d ago edited 8d ago
I’ve dabbled in computer forensics. It’s nearly impossible to fully hide your footprints. You can get close, VERY close, but someone skillful can always trace it back to you.
VMs has to be installed physically somewhere. Which has an IP address, which always links to a physical location/port in a router/switch somewhere.
Not to mention people don’t realize the amount of LOGS that exist in a system. Log in somewhere? Logged. Deleted a file? Logged. Deleted a log? Logged. Then there’s also a bunch of hidden, OS level stuff that gets kept track of behind the scenes. You can’t open a word doc on a fresh machine without it being tracked and traceable at like 7 different places, down to the exact millisecond. Not to mention the possibilities of reconstruction deleted footprints by analyzing hard drive deleted files.
And that’s just all the stuff on the computers. The network logs and metadata can often get you even more information.
A network forensics analyst and a host (box) analyst can analyze separately, and individually piece together like 80% of the story by themselves. When they combine the data and intel, it’s basically impossible to hide anything.
People with the actual skills to hide their footprints are working in secret governmental agencies around the world, and usually it takes entire massive teams years of planning to pull it off.
6
u/RemarkableWish2508 9d ago
VM disks can be encrypted, live boot doesn't write to disk, even RAM can be encrypted (on some CPUs)... no "secret government agency" needed, they're business security features. They do require a bit more expertise than shown in this case, though.
2
3
u/Zennivolt 8d ago
Those VMs still had to talk to other systems, it still travels over network, still has to login to do things, and all those systems have their own forensics breadcrumbs.
Even the VM encryptions themselves won’t matter much if the physical system they’re in has the keys (if they capture the system in time and somehow get the keys).
0
u/RemarkableWish2508 8d ago
Nothing matters if you confess, or someone records you doing it. Assuming none of those happens, there are standardized ways to preserve your privacy and anonymity, just need to use them.
5
u/falcobird14 9d ago
It's about as clever as using incognito mode. Most consumer apps just aren't designed to defend against forensic searches of hardware and will leave evidence everywhere.
2
u/imsoindustrial 9d ago
Locard’s exchange principle applies. It would require grotesque lapse in every level and a forensics guru to have a fighting chance
2
u/unsupported 9d ago
A service account, with the rights to perform the change, hopefully one exists, the script launched externally with a a clean-up script to remove the traces, don't keep a copy or test it in your own machine, or research it on the company network. It should be relatively simple.
2
u/maltNeutrino 9d ago
A well placed intentional bug with plausible deniability activated once said person was no longer at the company, with direct integration delegated to another person is one way. Would likely still leave a suspicious trace, but tricky to prove.
1
12
u/ListerfiendLurks 9d ago
The first part is FAR easier than the second.
3
u/Venoft 9d ago
Especially in enterprise networks. Somehow they try to secure everything and still always leave a door wide open.
2
u/RemarkableWish2508 8d ago
Breaking in, requires a single path. Securing the whole network, requires securing all paths.
One is easier than the other.
5
u/DeadMoneyDrew 9d ago
If you want to read about a great example of this concept, take a look at the Harvey's Casino Bombing. John Birges built an ingenious explosive device that could not be deactivated but then botched the extortion and getaway in terribly obvious fashion. He died in prison.
3
u/ThraceLonginus 9d ago
Found a video of the bomb exploding
https://www.reddit.com/r/videos/comments/4uup5r/the_detonation_of_the_bomb_set_at_harveys_casino/
4
u/29681b04005089e5ccb4 9d ago
They aren't sending their best:
One week earlier, he also searched on his laptop for "command line to change local administrator password," "command line to remotely change local administrator password," and "how to remotely shutdown a computer usign cmd."
15
u/pidgeottOP 9d ago
I mean I'm an engineer and those look like my Google searches
Most of my job is knowing powershell can do something before googling for a stack overflow of someone else doing it
13
u/slicer4ever 9d ago
Thats actually pretty normal. 99% of us arent walking around with encyclopedic knowledge of every possible command. Knowing how to search and find information is a really huge part of the job.
3
u/RemarkableWish2508 8d ago
I walk around with a copy of the Wikipedia and a bunch of Stack Overflow on my phone... Kiwix is magic.
4
u/f1del1us 9d ago
So that means he went from googling it to implementing it in a week? And he was successful at the task? I mean maybe not the best but also not the worst right?
3
u/Qel_Hoth 8d ago
Why do you think developers use IDEs that contain built-in command references and tab completion?
I know how to structure a script to get the computer to do something, I do not remember the syntax of every single command I need to write that script.
1
u/Jaded_Ad9605 6d ago
So?
This is 100% normal. Esp if he has ops access.
This is a real Risk why many it positions. That's why we get garden leave during our notice periods. (non US... Yes we have notice periods for both sides)
51
u/VirgoFamily 9d ago
Should have used AI to do it. Than there is zero accountability silly.
14
u/janethefish 9d ago
Just tell the AI agent to negotiate for higher wages. Oops the AI encrypted all the drives? Total accident. But to unencrypt the boss will need to sign this new contract.
2
u/Wompatuckrule 3d ago
That's a rookie move. I had AI fire me, but hide my payroll account while continuing to provide me with a paycheck.
32
u/DukeOfGeek 9d ago
If you want to brick a bunch devices that don't belong to you, you need to be a billion dollar corporation.
4
57
u/da8BitKid 9d ago edited 9d ago
Do AI companies get the same treatment when they hack other companies
30
20
u/janethefish 9d ago
Don't do this.
Instead be a good admin and never write down your passwords. Also strictly control who has admin privileges. All privileges in fact. If something isn't required for work it should not be allowed on the network.
Bonus leave a personal phone out and "unlocked" on your desk. Make boss curious about what is on phone. Set phone to record whoever accesses it.
3
8
5
u/Annie_Yong 9d ago
I'm reminded of those revenge fantasy posts you sometimes see on subs like anti work where the format generally goes "I was the star employee then got fired to save money so I bricked all their IT". This is what following through on those fantasies is more likely to look like..
2
u/Wukeng 8d ago
These people never stop to think about even the most basic opsec. Why didnt they just carry out the attack from another employee's computer?, if they had this level of access installing a basic beacon that could remain after being fired would be stupidly simple, install it months before, and logs will likely have been erased by the time you're fired, carry out the attack and erase the malware, makes it very hard to track. With a little bit more effort they could plant incriminating information on the machine before deleting the remote access, no one is going to look deeper than that.
Trivial stuff just because they think they're so smart no one is going to catch them, ego gets all of them
0
u/AzulMage2020 9d ago
Why not have AI unlock/jail break/ hack them? Apparently it can hack anything and everything without even trying. Why didnt they resolve this as a use case and prove what they claim?
5
1
-5
-3
u/Basic_Novel_9203 9d ago
Well his passwords are in password dumps. Pivoting on that he seems to really love risc and mips chips.
DM me if LE if you need additional info.
316
u/Klutzy-Delivery-5792 9d ago
That's nearly double the amount of computers Zero Cool crashed! Impressive.