He didn’t hack anything. He used a password that wasn’t changed.
Which was also used repeatedly over the course of 3-4 months to gain access via a non-corporate laptop without the IT doing anything about it.
Yeah that seems pretty negligent on their part.
I’ve been in IT for a few years and I’ve changed companies a few times. I just checked my login creds for various systems of 3 previous employers and like half of them still work. Unfortunately it’s a lot more common than any IT department would like to admit
It’s only hacking if it’s in a CVE.
Anything else is just sparkling unauthorized access.
That’s just not true.
- Zero days
- Social Engineering
- Things that just don’t receive a CVE, because there are many more vulnerabilities than there are CVEs
Social engineering isn’t hacking. It’s social engineering
Hacking humans, not technology
Social engineering = human hacking
But clickbait…
I hack my supermarket by stealing mangoes.
Technically he was not authorized to use the computer system due to his termination which the law looks at and calls hacking.
No, the law specifically called this “unauthorized access to computer material”. It’s right there in the article.
I said the law looks at whether it was authorized access or not, I was not citing any literal lines from the law. Didn’t read the article because I know this already because of the industry I work in and I took a course a number of years ago that literally was about this.
I’ll give you half a point because technically you are right.
He also didn’t delete servers
That might be slightly illegal.
That person might be slightly doomed.
Companies need to remember to change the login password BEFORE firing people with login passwords.
One man IT shop maybe? Usually stuff like that goes through IT, because who in their right mind would give HR modify access to active directory?
Read the article.
As a former user of “the other site”, I find this suggestion highly offensive /s
Generally a firing is decided the previous day or at least an hour before it happens. Discussions are made prior to the actual meeting where the firing occurs. IT is on standby. They either deactivate the AD account and related auth methods when the employee walks in the office to have the discussion. This is a well oiled machine, so that all parties know their parts. The meeting/discussion is solely a formality and by two minutes into it, theres no longer any access granted. Security shows up at the meeting to escort the employee out and collect their badge or keys. Maybe they let the employee walk by their desk to collect their stuff, maybe the employer ships it to them later, depends on the circumstances and office layout.
In well-run orgs, yes. Most places are not well-run.
At my last job I was informed that I’d be terminated, then had to work normally for another month (the termination period), where I still had full domain admin access to all our own and our customers’ systems.
On my last day I myself had to write down a list of all the logins I had and give that to my boss, because no one else knew what accesses I even had.
During the last hour I wiped my own company PC and gave back all hardware I was given. Again, there wasn’t any record of what I was given over the years so they took my word for it. This included unencrypted USB drives with sensitive medical data on them.As someone who worked for German, as well as North American companies, your experience is not the norm in NA. Wish it was.
I was let go somewhat recently and I noticed just yesterday that I still have admin access to their facebook app.
Time to get busy and say it’s a pen test of their systems.
I mean kind of depends. I got a soft layoff so worked 6 months more and got 3 months pay for the transfer to India.
I think best practices for highly secure environments is at the time of notice you lock the account and give that person 2 weeks off.
Most normal company’s it’s cool work till your last day, do your exit interview and we lock your account on Friday afternoon or Monday
Also you never want to change someone’s password on termination. What if their login is running some business critical tasks? Not best practices but I can tell you it happens a lot especially for reporting. If you lock the account you can always just reenable it and work to fix the issue
Last year, I tried my admin creds at my old job and it still worked. I was afraid of retaliation so I sent them a message from a throwaway email about changing their passwords.
Legally, it would have been better to send the mail from your personal account.
Otherwise there’s a possibility that something happens to get fucked up right around the time you logged in, they pull the logs and find your access.
Bam, motive and opportunity, and no way to provide an alibi.
NCS is a company that offers information communication and technology services.
Wait…
he used his laptop to gain unauthorised access to the system using the administrator login credentials.
Okay, what the guy did was immature and shitty, but holy hell this company is incompetent. How did their own internal IT not lock him out of anything even remotely sensitive the moment he was fired?
Probably HR (or the NCS equivalent) never told the right people. I am not saying this is actually what happened, but a lot of IT bemoan the fact they are never told some rando employee was fired because HR neglects to inform them. Sometimes it takes months to discover, and even with a 90 day password/login lockout, some halfway decent admin could get around this by secretly building a back door, and using the messed up communication and politics between departments to hide this. Even in the 1990s, I saw people put in “time bombs” in their code that “if such and such is not updated in 6 months, run destructo-script A.”
But imagine someone like Kandula Nagaraju here. Worked in QA, probably did a great jobs with some skills, but had the personality of swallowing broken glass. He was terminated in October 2022 due to “poor work performance,” which could mean anything. “Not a team player.” Or maybe he really was an idiot: I mean, a smart person would have a conniption, but get employed elsewhere and then slam his former company at parties. “Those NCS folks didn’t know what they had with me!” But this guy was probably someone with some anger management issues, probably a jerk, and possibly stupid. He might have had revenge fantasies, and set up a small virtual server posing as a backup code mirror. But outside the audits, it allowed ssh from the outside, and hid it through a knockd daemon. Or maybe only launched ssh at certain hours before shutting it down again. Silently working away in a sea of virtual servers with little to no updated documentation. He gets in, has internal access, and runs a script with admin credentials because they don’t rotate their AWS keys/secrets quickly enough. Or didn’t even know he was let go.
After Kandula’s contract was terminated and he arrived back in India, he used his laptop to gain unauthorised access to the system using the administrator login credentials. He did so on six occasions between Jan 6 and Jan 17, 2023.
That’s embarrassing to the company. Not only did he get in, but SIX TIMES after he was let go. he probably knew what order to run the delete commands (like, say, an aws “terminate-instances” cli command from a primary node), and did so one by one, probably during hours with the least amount of supervision, where the first few alerts would take hours to get someone in the monitoring chain to wake an admin. Given his last day was in November, and he got back in January, the admins probably thought their 90 access credential rotation was “good enough,” but he got in on his 80th day or whatever.
I know this because I have had to do triage when a former contractor did this to a company I worked for. But instead of wiping out instances, he opened a new set of cloud accounts from the master account, put them in an unmonitored region (in this case, Asia), and spun up thousands of instances to run bitcoin mining. Only because AWS notified us of “unusual traffic” were we made aware at all, and this guy knew his shit and covered his tracks very well. He did it at a speed that could have only been automated. Thankfully, AWS did not charge us the seven figure amount that this activity amassed in just three days.
I’ve had people above me fired in a startup and I was asked by the board of the company to lock their accounts and seize their professional laptops while they were in a meeting informing them they were fired.
The idiots had tried to stage a “coup” against the CEO which failed spectacularly.
in my org it’s a single process to deprovision someone of access to all tools including home devices.
Makes sense, this was decades ago in a small startup. Nowadays HR systems are usually synched with the IAM.
If its the NCS (National Computer Systems) that was bought by Pearson a few years ago, then what they sell is the hardware/software that reads all the “fill in the circle with a #2 lead pencil” forms.
I’m going to take a guess this is the guy that removed access from fired people under hr request, for $999.999
It usually happens the other way in large companies. They take away access first thing in the morning then they send the Bobs in later to inform them that their services are no longer needed.
Company deserved it if they didn’t have backups and didn’t change the admin passwords
Classic victim blaming. They were asking for it. They didn’t deserve a malicious actor.
victim blaming
Can’t tell if this is sarcasm, but corporations are not people, they are soulless, for-profit enterprises that will, for damn sure, abuse and exploit any one and any thing they can in the name of profit. They don’t get the defense of “victim blaming”.
If they open themselves up to malicious actors through improper security, or lawsuits due to improper practices, then that’s their own fault.
Mom and pop grocery store - incorporated because they aren’t idiots - gets robbed. Not victims because they are a corporation?
It’s their own fault if they didn’t take the reasonable precautions that anyone should be aware of when going in to business for profit.
Notice how in my original comment I added “through improper security” and “improper practices”.
If you are running a business and get robbed without security cameras, insurance, and other reasonable protective and preventative methods, then you are at fault.
Ehhh I dunno. Saying it’s the stores fault they got robbed feels wrong. It’s the robbers fault for, you know, robbing. I mean, how far does that go? They had locks but not good enough locks. Yeah they had locks but no security system. Well they had a security system but no guard. At some point the blame is on the person that actually committed the crime.
My point is that corporations cannot be victims because they’re not people, they’re a legal construct. They cannot be victims any more than a table can be a victim when I spill my drink over it. The term “victim”, whether intentional or not, is an emotive word that invokes ideas of injustice and suffering.
Marketing teams and corporate executives convinced people and legal systems that corporations are people in an attempt to engender sympathy, personification, and to avoid responsibility for their own failures, like the case in this article where managerial and procedural failures by those in charge led to the ability for this ex-employee to be able to do what he did.
You didn’t answer the question.
No, you just didn’t get the answer you wanted.
You’re right, I wanted an answer to my question and instead you rephrased my question, which avoided my actual point, and then only kind of answered that question.
Let me try to rephrase to get to my point: this shop has security cameras, insurance, and other reasonable protective and preventative methods, they get robbed (which still result in a financial hit). Are they victims?
It’s their own fault if they didn’t take the reasonable precautions that anyone should be aware of when going in to business for profit.
Yes I did.
That’s cherry picking a single scenario which allows you to sort of maintain your position, but still doesn’t even answer the question in that particular case, and certainly does not answer the question as to whether that mom and pop shop can be a victim.
He did answer the question, you just didn’t understand his answer.
Pretty clear by the fact they keep asking for further clarification. Why’s everyone so afraid to try and engage further?
Bet they’ll be going zero-trust next project increment though lol
Question. Where does this “value” come from? Loss of business? Downtime? Labor loss due to people unable to work? Pull a number out of a hat?
These servers had no production data on them. Ideally with a proper DR solution you just restore and presa charges.
I would guess man hours.
Because it’s going to take time to put those servers back in production. Depending what they did it might have causing outage to external facing customers, which will have a higher impact than internal facing. But with that amount of money, it actually seems fairly low to me so I’m guessing they weren’t public facing servers.
So it was probably the time that it takes to recreate all those servers get everything back up and running, and delayed work caused by the outage.
That’s just my guess though
As an armchair economist, lots of things. Loss of money from workers standing around unable to do their jobs because of the technical issues, the cost of doing a restore from backup (technician time, extra help, direct costs of accessing the data), etc. Opportunity costs from having to send business away, or otherwise unreasonably delay taking/delivering orders that have either been given to competitors or cancelled because of the issues.
Even the dang electricity costs of keeping the lights on while waiting for a fix…
Large companies calculate this value as a “burn rate”, which is to say, how much is it directly or indirectly costing to have everyone here, ready to work, and unable to do so because of an issue that affects everyone. Usually measured in dollars per hour. So if their burn rate is 100k/hr, and it takes 10 hours to fix the problem, it’s ~$1M in losses.
They may be able to recoup some of those losses by adding an extra shift or granting overtime to catch up, but for the most part, a large percent of that money is simply gone.
That’s pretty god. Our fired employee just logged into the wifi from outside and changed the status on every helpdesk ticket to “Paul is a nob”.
Couldn’t think of anything other than an insult a 7-year-old would come up with, huh?
In fairness to him, Paul was indeed a nob. And you don’t really want to do anything that might bring legal action against you, like I dunno, deleting a load of servers and losing your company close to a million. Just as a random example.
And the wifi password is now a long complicated string of characters that only gets given to a few people, rather than just being the company name with 123 at the end.
What the hell is a “nob”
that’s-a-penis.gif
They will think twice before fire someone else. Well done
Server IP address: 192.168.1.1
Username: admin
Password: 12345
— Access Granted —
sudo rm -rf / --no-preserve-root
