Rogue System Administrator Faces 10 Years In Prison For Shutting Down Servers, Deleting Core Files On the Day He Was Fired (techspot.com) 237
Joe Venzor, a former employee at boot manufacturer Lucchese, had a near total meltdown after he got fired from his IT system administrator position. According to TechSpot, he shut down the company's email and application servers and deleted the core system files. Venzor now faces up to 10 years in prison and a $250,000 fine. From the report: Venzor was let go from his position at the company's help desk and immediately turned volatile. He left the building at 10:30AM and by 11:30, the company's email and application servers had been shut down. Because of this, all activities ground to a halt at the factory and employees had to be sent home. When the remaining IT staff tried to restart them, they discovered the core system files had been deleted and their account permissions had been demoted. Eventually the company was forced to hire a contractor to clean up all of the damage, but this resulted in weeks of backlog and lost orders. While recovering from the attack was difficult, finding out who did it was simple. Venzor was clearly the prime suspect given the timing of the incident, so they checked his account history. They discovered he had collected usernames and passwords of his IT colleagues, created a backdoor account disguised as an office printer, and used that account from his official work computer.
At a boot manufacturing facility? (Score:5, Funny)
I guess he did not like getting the boot.
Re:At a boot manufacturing facility? (Score:4, Funny)
When the remaining IT staff tried to restart them, they discovered the core system files had been deleted and their account permissions had been demoted.
I don't understand what kind of boot manufacturing facility cannot boot their servers. Surely not one that I would buy my boots from!
Re: (Score:2)
The servers were UEFI, their boots only work with the BIOS.
Re: At a boot manufacturing facility? (Score:2)
James Bond: "I gave him the boot."
Re: (Score:2)
Re: (Score:2)
I guess he did not like getting the boot.
Which is kind of fucked up because getting the boot once or twice is part of life.
Re: (Score:2)
Disguised as an office printer (Score:5, Funny)
It all happened so fast, officer. He ran that way. He was short, beige and had a tattoo that said Lexmark.
Probably stale (Score:3)
Those core files were probably stale anyway.
I don't quite get it (Score:5, Informative)
Are we supposed to be outraged or something? It sure sounds like the guy deserved to be fired - and, based on the actions he took after being fired, he deserves prison time and a significant financial penalty.
Re: (Score:2)
nah, everyone is supposed to rant and rave, and then they can run their sentiment-detection algorithms on the comment pool. it's kind of like a poll, but more participatory.
Re: (Score:2)
Re: (Score:2)
Are we supposed to be outraged or something?
Based on what he did, no. However we'd like to get more information on how he was fired. Everyone needs some respect in that case, especially someone who has admin access to all systems.
Nope (Score:3)
We should mostly agree that 'don't be stupid' is a good rule to follow. Though we man rant about having similar feelings about past employers, just not enough to take any such actions.
Re: (Score:2)
Shouldn't have taken so long to fix I guess. VM restored from backup, base system installed fresh... But then again, maybe this is why they fired the guy.
What's the benefit of throwing him in jail (Score:3)
Re: (Score:2)
By the sound of it this was a spur of the moment/rage thing.
You're right, he's a genius that should be free! Because his "spur of the moment rage thing" involved him, in the hour after he was fired, to invent a time machine that allowed him to go back and make a collection of his co-workers account/password information and set up his back doors. What kind of person who has just been fired has the presence of mind to invent time travel in only an hour? A frickin' GENIUS, that's what kind.
Oh, you didn't RTFA, did you. Nope.
He deliberately, and meticulously plan
Backups? (Score:3)
Re: (Score:2)
Catch-22: Who's in charge of backups?
Re: (Score:2)
Everything should be running in VMs,
I am a VMS fan myself but I wouldn't recommend using it on a new project in this day and age. HP don't support it well enough.
Physical access (Score:2)
He had physical access. What good is a VM?
Backups yes. "Everything in VMs", no. (Score:2)
"Everything" is a bad word to use when describing something outside of your own workplace in terms of what applies inside yours.
In the MS world VMs are the bandaid solution to poor resource management by an OS. Outside of the MS world there is less need and very frequently you want a piece of h
Re: (Score:2)
That's a very 1990 way of looking at things in server space (IBM etc was doing it then). Zones (AKA containers) are a less wasteful way separate things and unlike recent VMs there is some consideration of security. "Everything" is a bad word to use when describing something outside of your own workplace in terms of what applies inside yours. In the MS world VMs are the bandaid solution to poor resource management by an OS. Outside of the MS world there is less need and very frequently you want a piece of hardware (or a cluster) to be dedicated to a single task - so a VM is pointless in that situation apart from convenience of backups (which once again outside of the MS world is trivially easy).
A VM, is pointless?
In the real world you properly assess risk and impact, define an SLA, virtualize all critical servers in VMWare, and run encrypted snapshot backups multiple times a day, written to tape nightly and kept offline as well as offsite, away from any risk of "rouge" attack. Proper snapshots capture the entire server (including those pesky "core system files"). Had they used and protected VMs properly, it would have likely resulted in little more than getting admin rights back and restoring t
Re: (Score:2)
Kind of make you wonder who should be gaining a custodial sentence the wacko help desk dude or the crap sys admins, I mean, really, really bad sys admins. The help desk guy did, should only be a overnight fix. For them to claim damages the bulk of which is as a result of incompetence is kind of extreme. Sorry nothing more than a tiny bit of incompetent vandalism, the rest that is incompetent sys admins and the crazy help desk dude basically did management a favour in letting them know how incompetent their
Re: (Score:3)
Whoops forgot the required car analogy. It was like the help desk guy cut them off and as a result of really poor management all four wheels fell of the car when they swerved due to no lug nuts, the front of the car dug into the road, the car then flipped and went off a cliff. Dude just cut them off, the wheels should never have fallen off.
Re: (Score:2)
It's 2017. Everything should be running in VMs
Including the host? And the host that the host runs as a guest on? And the host that the host that the host runs as a guest on?
In your world view, I guess it's turtles all the way down.
and snapshots of those VMs should've been backed up.
Right, because a sysadmin can never manipulate backups...
I always delete core files (Score:5, Funny)
They are a bloody nuisance and just take up disk space.
Re: (Score:2)
Well, once they are loaded into memory, yes.
More info (Score:3)
Re: (Score:2)
http://www.kvia.com/crime/fbi-... [kvia.com]
Thanks for that. Of note:
"a list of account usernames and passwords for network systems and services" -- Not of his coworkers.
"Venzor allegedly used a separate Lucchese network account named elplaser" -- Does not say he created it like the 1st article.
Strange that there is a delta in the information provided by the two articles.
Sloppy. (Score:5, Informative)
Come on, people, if you are going to get revenge on the company that canned you, you're supposed to set up a daemon on day one that checks to see if you have logged in the last month and then begins corrupting backups as they are made for the next 5 months, at which time it will execute a total system meltdown that results in total data loss! I swear, you youngin's know nothin' about properly destroying the lives of those who have wronged you! ;)
Re:Sloppy. (Score:5, Interesting)
And while I know you are sarcastic, it's people that think in this manner that ruin people's lives for years. I Almost lost my company if it was not for my backup policy. I would do back-ups monthly myself on Saturday morning and retrieve the cassettes Sunday afternoon, take them home and store. an employee that I fired for doing something real bad did a time bomb on the payroll system and sent a system-wide delete. well long story short, 3 days of employee's working part time with note pads I got a basic restore done, then one system at a time did re-installs ... 2 weeks later we were back in business.
to this day I keep backup's of data, spare computer laptops just in case, and 1 month payroll and 1 month of expenses LOL never again I hope
if the business would have failed, it would have cost 38 people's employment and my business ruined.
safe to say, that I never let only 1 person handle backing up the systems ever
Re: (Score:2)
And while I know you are sarcastic,
He wasn't. He was joking. Sarcasm is a form of irony that targets one of the listeners/readers. This was neither irony nor did it target someone.
Re: (Score:2)
And while I know you are sarcastic, it's people that think in this manner that ruin people's lives for years.
indeed. some people have not faced exceptionally emotionally stressful situations or do not know how to properly cope with strong emotions. At our core, we are still just animals that have only recently begun to act (slightly more) civilized.
Re: (Score:3)
I was accused of doing this at a former employer. I was fired for "job abandonment" and later that day some of their systems went down. Fortunately, it was easy to prove I wasn't responsible. There's no internet in the intensive care unit. (Which was why I didn't show up for work or call in sick.)
Now my medical alarm has a Pi attached that will tweet my family...and my employer.
They didn't offer to re-instate me either. Cool beans. I was about to quit anyway because they were not nice people. Always, but al
Re: (Score:2)
I hope you've been living comfortably on the proceeds from the lawsuit.
10 years in prison? (Score:4, Insightful)
Don't get me wrong, this guy certainly deserves punishment if guilty, but 10 years? Did any CEOs or politicians get 1 day of jail time for the 2008 financial crisis?
Re: (Score:3)
CEOs and politicians are not accountable for their actions these days. Their crimes are "to big to be punished".
Help Desk?!? (Score:3)
Re:Help Desk?!? (Score:5, Interesting)
The answer is "small" not dumb. If there isn't a lot to do a single server can get the job done.
If I was in that situation I'd want to keep the server hardware up to date and have a working older server ready to turn on when something goes wrong, but I don't see that a single server was the problem here.
Re: (Score:3)
Re: (Score:2)
I've known a 'CIO' that had to get approval for any expense greater than $50.
He had negotiated the title in lieu of a raise. Moron. He was still just the 'computer guy'.
Re: (Score:2)
...a company that is dumb enough to run it's entire business applications from a single server. http://www.kvia.com/crime/fbi-... [kvia.com] "Investigators learned that the server controlled the company's production line, warehouse, distribution center and its ability to take orders."
Uh, a company "dumb enough"? This "single server" is also known as an ERP system. And a shitload of large companies around the world run ERP systems. The dumb part is not protecting them with a valid DR strategy.
Re: (Score:2)
Exit Interview (Score:2)
I suppose the exit interview did not go well.
Curious writings though: "What happens though if the person being fired is an IT system administrator in charge of managing those accounts?" "Venzor was let go from his position at the company's help desk and immediately turned volatile."
Something's missing. They call him an IT system administrator in one sentence, then say he was a part of the company's help desk in the next. Collecting usernames and passwords, this I see, and an account 'disguised' as a printer
Re: (Score:2)
Re: (Score:3)
and an account 'disguised' as a printer...
If they used a really old Unix server, chances is that the lp user account didn't have a password by default.
Ten years? Less time if he'd punched out his boss (Score:3)
Re: (Score:2)
I would like to know what the sentence would have been if he'd taken a baseball bat to the server and backup media instead of using electronic means.
Re: (Score:2)
Re: (Score:3)
Re: (Score:3)
It is. People are still exceptionally stupid and this is one thing they understand even less (it that is possible).
For Starters You Should Delete Old Accounts (Score:3)
I used to work at a $Very Big Transportation Company from 1982 to 1998. They are now clients of our company. Earlier this year Transportation Company needed to give me access to some of their systems. My old username and account, from 1998, were still in their systems.
Re: (Score:2)
at the boot factory (Score:3)
I see what you did there
Re:this is why you need two factor auth (Score:4, Insightful)
An admin can still override authentication. Whats needs is to bring the new admin in before you sack the old one. He removes admin privileges from the guy being sacked. That, or isolate the system from the outside world for a while but in this day and age that may be impossible from a business perspective.
Re: (Score:2, Insightful)
in this case, they did remove admin privileges from the guy being sacked, he used other people's accounts to access things remotely.
Two Factor authentication could have blocked that by preventing him from impersonating other admins.
Re: (Score:3)
Realistically you can't keep him out. He could have created a fallback account to use.
Remote access (Score:3)
You can, I've been there and done that during a layoff in a place I'd never been to before. You disable all remote access until you are certain what is at the other end of each remote access method. One time the former sysadmins had VPNs to their home machines (in 2002 so not as common as today), which was totally legit when they had a job but completely undocumented, yet it still wasn't hard to stop until it was clear where everything was going.
Re:Remote access (Score:4, Interesting)
In a professional environment yes, but in some places the sysadmin would be most of the IT department, leaving nobody to shut down remote access. Many places these days rely on cloud services for B2B and retail. Shut down the internet and you stop the business. You could shut down remote VPN access but who is to say he hasn't got his own version of a daemon running somewhere?
Re: (Score:2)
You disable all remote access until you are certain ...
You can never be 100% certain. Otherwise, we wouldn't have events like "Pwn2Own" ... and those don't even have a malicious insider involved. Give any decent hacker a year of root access on a system, then there is no way that you can ever be "certain" that it is free of backdoors without a complete wipe and re-install.
You should read this: Ken Thompson: Reflections on Trusting Trust [cmu.edu].
Re: (Score:2)
Which is what was effectively done on the gateway - a new box doing what the old one was supposed to do. It's a long way from impossible. Sometimes it's not even difficult.
Re: (Score:2)
Yep indeed, you need layers and layers of IDS watching each other and some qualified humans to make sense of the reports (e.g. yet another layer of unknown working for the company teams). This has become ridiculously expensive to manage lately but remains the only way to go IMHO.
Re: (Score:2)
You can, I've been there and done that during a layoff in a place I'd never been to before. You disable all remote access until you are certain what is at the other end of each remote access method.
I'd fire you if you sprouted such nonsense.
A sysadmin doesn't have to use the known remote access routines, but can add his own hidden ones.
If a sysadmin leaves and can't be trusted, any machines that are not air gapped must be considered compromised and reinstalled (from media the sysadmin never had access to). You have no way of knowing what backdoors exist, including ones that are initiated from the inside, not the outside.
For every way of blocking a former superuser, I can think of three other ways for
Re: (Score:2)
Re: (Score:2)
Appearing before Senior United States District Judge David Briones, Venzor pleaded guilty to one count of transmission of a program to cause damage to a computer. By pleading guilty, Venzor admitted that on September 1, 2016, after being terminated from his position at the company’s help desk, he logged onto the company’s network through an administrator account and shut down the company’s email server and application server while deleting systems files essential to restoring computer operations.
But of course, both the original submission and the register [theregister.co.uk] claim that he was a sysadmin. Probably because a hell desk jockey shouldn't be able to create sysadmin accounts in the first place. I wonder who left their password on a post-it stuck to the bottom of their keyboard this time.
Re: (Score:2)
And who will do the auditing? I know places like this. The IT manager is king and nobody knows what he does.
Re: (Score:2)
Where I am, IT manager is not king. If I see something out of place, I can go directly to the CEO. I create the audits and then the CIO will audit it. We do this quarterly. We compare all users to a list of current employees from HR to verify that we don't have any "accidental" users not disabled / deleted.
Perhaps we are unique that we actually do try to take security seriously.
Re: (Score:2)
I create the audits and then the CIO will audit it. We do this quarterly. We compare all users to a list of current employees from HR to verify that we don't have any "accidental" users not disabled / deleted.
... except for any ones that you might have removed from the audit before handing it over.
Quis custodiet ipsos custodes?
Re: (Score:2)
And that's why what I hand off gets audited by him. If I have a special account, he will see it during his audit.
If you hand it to him, you also have the ability to modify what gets handed to him.
Even if he shoulder rides you, it's easy to hide things like accounts. Like replacing commands like cat and cp with ones that grep out what you don't want seen.
And how do you know that formeruser1 doesn't have backdoor access to currentuser2 or automatedaccount3 that bypasses the authentication scheme? The ways to set up that are endless.
Re: (Score:3)
Infosec teams often have direct read-only access to equipment and audit logs to central servers, with alerts on use-cases such as turning off logging, modifying account permissions etc. etc. In some circumstances even command history is logged.
It's hard to imagine why infosec would conspire to hide an account. If it has a good reason to exist, the case can be made to the CIO.
It might be possible to circumvent this stuff if you have physical access during a network outage, but your card access logs wou
Re: (Score:2)
but your card access logs would still be in the system,
Who set up the card access?
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Venzor admitted that on September 1, 2016, after being terminated from his position at the company’s help desk, he logged onto the company’s network through an administrator account and shut down the company’s email server and application server while deleting systems files essential to restoring computer operations.
Why a help desk monkey was able to create accounts with admin privileges is a question left unanswered. Also, it was Windows, because if it were any of the *nixes, it would be root privileges if you really wanted to do s
Re: (Score:2)
Re: (Score:3)
How about teaching your users: under no circumstances does anybody else ever need to know your password.
And the higher-ups who insist that they don't need passwords? Because it's "their" computer. even though it's not? And "passwords are hard".
Re: (Score:2)
Re:this is why you need two factor auth (Score:4, Insightful)
You're spelling it g-o-o-d but pronouncing it "evil and incompetent".
It's not your system--it's your employer's. If you feel that you have to make yourself "indispensable" in such a fashion, you're doing it wrong.
Re: (Score:2)
very factual. ownership of the resource is the company, not the admin, the Admin is the manager of 1 of the many resources. such a simple concept but for years people don't get it. and it's in every industry that I know of.
Re: (Score:3)
Re: (Score:2)
So much for "taking ownership of a problem." Success is everyone's happy child, failure is a miserable orphan.
Re: (Score:2)
Basic asymmetry. It's the admins responsibility/problem but someone else's property.
Re: (Score:2)
Which works until the admin is in an induced coma for a couple of days after a really bad accident. The canary dies and at the very time the admin would be hoping for sympathy and some leeway due to her long upcoming recovery, she is instead fired and eventually ends up in prison and bankrupt and unable to ever again get a job in IT (or, perhaps anywhere).
Re:this is why you need two factor auth (Score:4, Interesting)
A good canary won't rely on the owner hand feeding it; but will accept food from authorized automatons.
If the user's account is closed, the canary will no longer be fed by the golems, and will peck the neener button. But the user going on vacation or to hospital won't cause the account to be closed, and the golems continue feeding the canary.
Re:this is why you need two factor auth (Score:5, Interesting)
I seem to remember some years ago stories of suppose dead man switches and sabotage would come out when the reality was fragile systems carefully looked after by people who never got to train a replacement.
This story is of course different - but ten years? Corporate crime with consequences of shutting down companies completely doesn't get ten years, serious embezzlement doesn't get ten years - why should this sort of corporate crime get ten years?
Re: (Score:2)
"why should this sort of corporate crime get ten years?"
Because "computers."
Re: (Score:3)
It is scary just how hard it can be to detect a rogue employee trying to sabotage you. There are only a few things you can actually do to limit impact to a reasonable level.
Re: (Score:3, Insightful)
If you want to be vengeful, thank your former employer for the job on the way out the door and ask for a letter of reference. Then go get a similar job at another company at a higher wage knowing you would never have gotten such a raise at your former employer's.
Re: (Score:2)
Just makes this attack a bit more difficult. Even if many people on the business side are putting their heads in the sand about this, it remains true that there is no protection against competent system administrators except keeping them happy.
Re: (Score:2)
He should have deleted the files a little bit later, tho :)
Obvious solution (Score:2)
The obvious solution to the rogue admin problem : Use Linux :)
A study has shown that when using Linux, admins are 47,5% happier on average.
By using Linux you can nearly guarantee that you will not have a sour relationship to your admin, and probably don't have to be in this situation
Re: (Score:2)
The obvious solution to the rogue admin problem : Use Linux
Flashback to the Slashdot of last century!
Re: Obvious solution (Score:2)
Re: (Score:2)
Not really a good strategy imho.
Re: (Score:2)
So an admin that is looking to cause problems could do so silently, even with nightly backups.
Re: (Score:2)
Indeed. There is no protection against a system administrator. A system administrator _needs_ the possibility to screw up everything in order to do his job, there is no way around that. Solution: Keep them happy, give golden parachute when firing them, etc. You know, the things that CEOs get for doing nothing nearly as valuable.
Re:Horrible spelling on Slashdot, again -- not (Score:2)
A random AC said:
It's "rouge". Rogue is what old-fashioned women apply to their faces so they'd look healthier.
Umm, no. You got it backwards, and (for once?) the Slashdot editors do it better than the random contradicting AC.
"Rouge" (French for "red", same Latin origin as "ruby") is the cosmetic, and rogue (from Latin "rogare", "ask"/"beg", same origin as "interrogate") is a excellent word to describe the guy in this story. Just because it's on Slashdot doesn't mean it's *wrong*.
I don't care about correcting AC who will probably never see this, but some poor guy might read that and believe it...
Re: (Score:2)
Does not matter. If he had not, he could have placed a dead-man-switch.
Re: (Score:2)
For this use case, they are secure.