Dev Gets 4 Years For Creating Kill Switch On Ex-Employer's Systems (bleepingcomputer.com) 53
Davis Lu, a former Eaton Corporation developer, has been sentenced to four years in prison for sabotaging his ex-employer's Windows network with malware and a custom kill switch that locked out thousands of employees once his account was disabled. The attack caused significant operational disruption and financial losses, with Lu also attempting to cover his tracks by deleting data and researching privilege escalation techniques. BleepingComputer reports: After a corporate restructuring and subsequent demotion in 2018, the DOJ says that Lu retaliated by embedding malicious code throughout the company's Windows production environment. The malicious code included an infinite Java thread loop designed to overwhelm servers and crash production systems. Lu also created a kill switch named "IsDLEnabledinAD" ("Is Davis Lu enabled in Active Directory") that would automatically lock all users out of their accounts if his account was disabled in Active Directory. When his employment was terminated on September 9, 2019, and his account disabled, the kill switch activated, causing thousands of users to be locked out of their systems.
"The defendant breached his employer's trust by using his access and technical knowledge to sabotage company networks, wreaking havoc and causing hundreds of thousands of dollars in losses for a U.S. company," said Acting Assistant Attorney General Matthew R. Galeotti. When he was instructed to return his laptop, Lu reportedly deleted encrypted data from his device. Investigators later discovered search queries on the device researching how to elevate privileges, hide processes, and quickly delete files. Lu was found guilty earlier this year of intentionally causing damage to protected computers. After his four-year sentence, Lu will also serve three years of supervised release following his prison term.
"The defendant breached his employer's trust by using his access and technical knowledge to sabotage company networks, wreaking havoc and causing hundreds of thousands of dollars in losses for a U.S. company," said Acting Assistant Attorney General Matthew R. Galeotti. When he was instructed to return his laptop, Lu reportedly deleted encrypted data from his device. Investigators later discovered search queries on the device researching how to elevate privileges, hide processes, and quickly delete files. Lu was found guilty earlier this year of intentionally causing damage to protected computers. After his four-year sentence, Lu will also serve three years of supervised release following his prison term.
Re: (Score:1)
Earlier he was saying how he hates safety regulations and healthcare.
Such strong opinions from a retired keyboard jockey.
Re: (Score:2)
-1 Offtopic
Re: (Score:2)
Re: (Score:2)
"punishing shitheads is frowned upon by the Slashdot population" Selective memory. It's easy, only remember what supports your view. Even little kids do it.
Re: (Score:2, Offtopic)
No, that's the president.
Yeah, Clinton is quite the monster.
Re: (Score:1)
Yeah, Clinton is quite the monster.
You think that's some kind of burn, but fuck Clinton.
You also think that's insightful, but Cheeto Benito was Epstein's best buddy and wingman. Clinton was an Epstein customer, Trump was an Epstein partner.
Re: (Score:3)
...fuck Clinton.
I'd rather not, thanks. Plus I'm way too old for him.
Re:Four years? (Score:4, Informative)
I'd rather not, thanks. Plus I'm way too old for him.
I don't recall Clinton even being accused of fucking any kids. The tangerine terror, on the other hand...
Re: (Score:2)
Re: (Score:2)
Don't you remember that the Clintons were part of a global elite paedophile ring, based out of a pizza restaurant basement?
The fact that some guy went there, armed, and found nothing, hasn't disproven it for some dedicated QAnon followers. I'm sure it's just coincidence that Clinton's rival's name is definitely in the Epstein Files.
Re: (Score:2)
You have zero evidence for any of that and the assertion is a retarded as you are.
Trump obviously does not believe there are any unexplainable connections between him and Epstein, or that he ever did anything with Epstein that would ultimately be judged unacceptable by the public.
He cautioned a lot of names would turn up, but also ran on releasing those files. Trump also being Trump expected to win! He knew he'd be in a position to release the files and given his other follow thru probably expected to do.
Re: (Score:2)
He cautioned a lot of names would turn up, but also ran on releasing those files
And the MAGA fools believed him. The believed someone with a history of lying.
Did I miss Trump releasing his tax returns, as he promised in 2016?
Re: (Score:2)
Re: (Score:2)
As for Trump I see long lists of incriminating and creepy things that he has done given as "proof." But what I don't see is actual und
Re: (Score:2)
Re: (Score:2)
Yeah, that would have accomplished something. Or not. Well, it might have satisfied your sadism.
I am always surprised how many unrefined primitives are around even today.
Careless (Score:4)
Dude should have made it so if his manager's account was disabled. It would have been obvious if it was checking for his account. Consider it a parting gift. /s
In all seriousness, kill-switches should only be created for military systems to self-destruct the device so that hardware that falls into the hands of the enemy self-destructs rather than remains operable. It makes it impractical of course in case someone loses the device.
Any other situation, kill switches aren't even necessary, if you're someone vital to the operational stability of the company, then the minute you're gone, your presence missing will be noticed as maintenance stops functioning.
Re:Careless (Score:4, Informative)
kill-switches should only be created for military systems to self-destruct the device
They are actually commonly used in the software industry for the purpose of disabling systems ifn case the customer forgot to make a payment to renew their license. For example: Backup software license expired, so the next day all the scheduled backup jobs are failing. Also, the buttons to start a manual backup or initiate a restore are greyed out requiring you to contact the vendor and pay for more time on that program's copyright license.
Re: (Score:2)
> if his manager's account was disabled
Oh the chaos that would ensue. :)
Narcissists often get caught because they lack subtlety.
Re: Careless (Score:1)
Re: (Score:2)
Any other situation, kill switches aren't even necessary, if you're someone vital to the operational stability of the company, then the minute you're gone, your presence missing will be noticed as maintenance stops functioning.
The world is full of people who see themselves as vital, who actually aren't. This is how they cope with that reality.
Re: (Score:2)
People that consider themselves vital, but then have to take steps to create artificial vitality - their own actions are proving them wrong.
If you were truly vital, your simple absence would be a disaster all by itself. If you have to engineer that condition, you're NOT vital. This is just an arrogant, self-important narcissist behaving badly and getting what they've got coming, at the cost of others.
I don't think there are enough stories like this in the news. It's pretty easy to find accounts BY such i
Re: (Score:3)
The world is full of people who see themselves as vital, who actually aren't. This is how they cope with that reality.
In a large company, if there is someone who is truly vital, then management at that company has failed. It's the bus test: "what would happen if xzy fell under a bus tomorrow?".
While no-one is truly irreplaceable, the issue is cost and time. In a small company, the cost and time to replace some employees may be fatal to the company.
Fool (Score:5, Funny)
"how to elevate privileges, hide processes, and quickly delete files"
He had to look that up? What an incompetent fool. He deserves his sentence.
Makes the rest of us look bad.
Re: (Score:2)
I'm not sure hiding processes would be considered basic knowledge.
Re:Fool (Score:4, Funny)
Does sound like amateur hour. After I left the company contracted me to fix a few things because they didn't hire a replacement in time and the guy they got couldn't wrap his head around the systems I had built. Didn't even have to try to sabotage anything, and it was all well documented. All you really need to do is rely on the company to screw it up themselves.
Re:Fool (Score:5, Insightful)
It is not surprising he had to look this up. A competent IT security person would not have done it, because it is exceptionally likely that you will get caught. It is always the amateurs with delusions that do this crap.
Re: (Score:3)
Imagine for a moment if the company wasn't competent enough to trace it back to him.
They would then have no idea that the damage happened as a result of his firing.
Can you really enjoy your revenge, if the victim doesn't even know that it was revenge ?
I think it is a bit of a conundrum. It might be why he didn't even try to hide it.
Re: (Score:2)
Good point. Angry, aggressive, out for revenge and not thinking about the consequences for himself at all. Essentially an intellectual child.
The demotion is probably a clue... (Score:2)
...that the company already realised that the guy was a bit of a jackjass. A demotion is a clear message that "we think you're a waste of desk space but you're not so useless that we can fire you but perhaps you should think about looking elsewhere"
Re: (Score:2)
Generally but not always. I used to work with a guy who got promoted to director. He wasn't terribly good at it. It was a shift lower management that he was very good at. However it also represented the change from tactical problem solving to strategic thinking and to pitching ideas and convincing people you mostly report to ie VPs, and C-Suite, vs organizing people who mostly report to you.
It was perfectly clear to everyone, including him after 8 months or so he was just not working out in the new role
Re: (Score:2)
I've always avoided moving into management despite having had the oipportunity a few times. I'm not a people person, I'm not interested in managing them or dealing with their issues, I'm far better doing stuff on a computer. Probably cost me a fair amount of money in the long run but I've no regrets.
Sigh (Score:4, Insightful)
Tell me why a dev has access to AD enough to lock out other people, including admins.
This is just dumb-ass network management.
Re: (Score:2)
I would guess it is pretty common in large enterprises. Most of them will have some custom identity and access management solutions, even if it just glue to make some actions in PeopleSoft/SAP/Pick-your-HR-IS-SaaS-thing trigger events in AD:DS/Entra/Okta/AWS-IAM/etc.
Maybe they don't have an account themselves with access but if they commit some code that gets promoted to production and runs with account privileges that do...well bob's your uncle.
Re: (Score:2)
Because the PHB thinks it's a good idea.
Security is important until the president is shown a presentation of this cool new gizmo/fad.
Re: (Score:2)
Tell me why a dev has access to AD enough to lock out other people, including admins.
Perhaps it is because Windows has frequent security issues?
IsDLEnabledInAD (Score:2)
Shows he either really likes his initials, or did not care if he got caught, or both.
In the good old days, he could have used self-modifying code to try to cover his tracks a little bit.
Re: (Score:2)
Shows he either really likes his initials, or did not care if he got caught, or both.
You could call it WatermelonRutabaga and the test would still have to point to the account in order to function, so it would still be self-documenting.
Well... (Score:2)
That guy just made sure he will never be hired again for the same or similar functions again.
Re: (Score:2)
Re: (Score:2)
No. People that full of themselves (and malice) do not learn. I wouldn't hire someone with that poor of judgement, and that delusional a view of their own abilities, to flip burgers.
kill switch (Score:2)
Re: (Score:2)
Yeah, lots of red flags all over the place. If one person can create a disaster like this, what else is this company doing horribly wrong? I wouldn't trust them with my information, that's for sure.
Re: (Score:2)
Now, why he had access to AD, that's a different and very interesting question that does raise the same sort of question you're alluding to.
Re: kill switch (Score:1)