Developer gets 4 years for activating network “kill switch” to avenge his firing
Disgruntled developer was caught after naming the “kill switch” after himself.
Dipshit. Just do bad coding and leave timebombs that could be considered an accident.
I mean, there's a reason he got fired and it wasn't because he's a genius...
Yeah, name it after the boss, not yourself!
Exactly, my coworkers at nearly every job have done this just by their disinterest in reading code and not caring about their craft.
It’s far more effective. Once you have a bad architecture and you keep adding to it over the years in haphazard ways, it becomes increasingly difficult to make any changes.
That just makes you a bad developer. And ripe for firing.
For developers in similar situations, where the corporate overlords make your life miserable; use dead man's triggers Instead of a simple killswitch: manually start handling certificates, introduce memory leaks that you can easily clear, have excessive disk filling logs that you can daily clear, and all kinds of other stuff that is a perpetual dumpster fire that you extinguish as part of your job. Oh, and don't forget to forget commenting and documenting. The next developer should instantly learn the pressure they have been putting on you.
Errr
That's EXACTLY why I did that in the past. It wasn't an accident at all. Nope. It was future proofing my job. Completely intentional.
I'd like to imagine countless instances of this that we never hear about because there just isn't anything concrete to write a news article about
Well the guy from the article is named David Lu and added a function with the name IsDLEnabledinAD. That by itself deserves an article.
So I've done plenty of that in my, ahem, practice. And honestly if I had a choice to concentrate and not do that, even if that meant losing my "dead man's triggers", then so be it. Extinguishing a perpetual dumpster fire as part of your job is not good. Also someone might be given that to fix after you leave, I've been in that role too.
You're an asshole
I have been burned out by project managers way too hard to have any respect for the capitalist tech world. I have more than 15 years of programming experience yet I'm literally looking for a job on a farm or warehouse.
They're not saying to do this at any/every job, just shitty ones with shitty people
company ruins life of employee: stonk
employee ruin company: immediate imprisonment
edit:
Ultimately, Eaton Corp. bore substantial costs getting its network back online
actually, it did nothing to the company but cost it a few bucks. do not pass go/collect $200.
this person was not fired, he was laid off. he was not actively harming the company until the company ruined his life.
I mean the guy was just laid off. They didn’t “ruin his life.” They employed him for 11 years.
4 years is a bit much though!
You guys are wild. Why do you think it’s okay to sabotage your company just because you got laid off? If everyone did that everyone would be collectively fucked over, including coworkers and customers. And why is the company evil for laying him off? Should they just employ him for no reason if they don’t need the person? What if it’s a small business? Weird ass logic. If you think ur life if ruined from getting laid off then Ur life sucks.
The defendant breached his employer’s trust
The company breached employee trust when they fired a bunch of people during a "realignment".
Four years is far too long. If he had run over the CEO in the parking lot he wouldn't have gotten four years.
It's because they can quantify damages that way. Because you legally cannot put a value on the life of a "human" (still unsure if CEOs are human, but legally they still are), it's just "murder" and not "you cost us eleventy billion dollars in downtime." One is more negotiable in terms of damages than the other.
4 YEARS?! And gaming companies can just build a kill switch into their game and get no penalty?
Tesla build them into fucking cars.
The difference is, the rich and powerful do their crimes with lawyers. A contractor could actually write something into their contract that allowed them to install such a kill switch. And it would be perfectly legal. No different than if you stop paying for a software license and the program stops working. But regular employees don't have the leverage to demand such a kill switch. Maybe more programmers should form unions. Write it into the contract that if the contract ever expires before a new one is signed, the union has the right to remotely activate a kill switch, shutting down crucial operations within the company. As long as this was all disclosed and signed to, it would be perfectly legal.
Have to make an example of them lest the surfs realize they have power
I actually cannot believe you have any upvotes for this type of comment.
If computers and networking were not involved, and we lived in the 1970s, this would be the equivalent of setting off a remote bomb in every factory across the country for your former company when you get fired.
This was a severe and premeditated act, and 4 years is what I would consider to be a moderate sentence for this type of computer crime.
You live in there modern world and see how things are going and your can't believe people support the destruction of established systems? Ok.
And how many people died or were injured? How much damage to property occurred?
Looks to me like he just wasted time and hurt revenue. That's not any of the above.
In the 1970s this, first, would be an equivalent of what another guy wrote, changing a lock combination and not telling people, a minor mischief, and second, he'd have a union protecting him.
This is clearly disproportional.
A bomb kills\maims people and harms equipment, this is very clearly not a bomb.
In the 1970s this would be a scandal.
No one reviwing his code? Sounds like a timebomb in its self.
This was my first thought. Just zero code review going on? Some random server only that dude knew about? tf kind of controls these people have in place?
Oh right, none of the shit the company should have had.
Instead of jail time, the government should consider giving this guy whistleblower status and investigating the corp for negligence.
Idk kind of standard practice to have free reign of the place in certain positions. In my entire career working for billion dollar companies it wouldn't be hard to bury anything like this. In fact I've done forensics on someone that did. Very few places outside government practice zero trust. Hell I'm sure the government fails to do this all the time too.
Gotta stay "lean".
Sounds like he could have been a bit more creative in implementing this. Having something immediately traceable back to a username is no bueno.
If he was smart he would not of done this in the first place
Is it even possible to do this in a way that can't be tracked back to you? Unless you're a Hollywood hacker that will rig something up to literally burn down the building the server the malicious code is contained on, there will always be some fingerprints left behind in the software. And there will almost always be a relatively short list of possible suspects. Even at large companies, there won't ever be more than a handful of people with the skills, motive, and access needed to pull something like this off. Oh, the company's entire database suddenly and mysteriously deleted itself? I wonder who caused that, maybe the disgruntled sysadmin we just fired? There really aren't that many suspects in situations like this. And once you're a suspect, they can get a warrant, seize all your computers, and scour them to dig up even more evidence against you. Hell, even just documentation of ill will against your old employer would be evidence in court. You better hope you really left no trace, otherwise you will be found out very quickly.
And really even in the best case scenario you still end up under heavy investigation, get all your computers seized, probably lose your new job, etc. Even if they can't pin it on you, if you are the only one with the means, motive, and opportunity? They'll tear your life upside down for years trying to prove it. Even if you are so good you can literally do it with no trace, no evidence in the code at all? It still won't prevent your life from being torn apart. It will just keep you out of jail at best.
He 100% didn't think this would result in criminal charges. A lot of people don't think through the "how will this company with lawyers react to my petty nonsense?" when doing stuff like this.
What he did was brazen and stupid but 4 years sounds a bit excessive. Unless the journalist is under reporting what happened, he didn't do any long-term damage just probably knocked them offline for a day and required somebody to come in and manually reset the drsm account in the domain controller.
But in a fit of rage and passion he built out booby traps and put his name all over everything. He wanted them to know it was him, How do you absolutely denied himself plausible deniability.
All he had to do was pretend he was inept and replace service accounts with his own login. Push 90-day password resets on the account for 'security'. Set up a house of cards out of security certificates.
The company probably walked into that court with a technically competent team of lawyers and a bunch of expert testimony, he probably had a state defender.
Kinda funny. 4 years seems excessive to me but what do I know.
Kinda heroic, ngl. I think the prison sentence is appropriate, but if I was let go after 11 years, I’d harbor fantasies of doing something similar. They’d stay fantasies, though.
Prison? For shutting down the computers? How many lives were lost because of his actions, how many were saved?
I don’t know what his former company does, but it’s easy to imagine scenarios on both ends of the spectrum. From processing Bejeweled microtransaction payments to ER intake or ambulance dispatch. Doesn’t really matter in the end. Software is everywhere and we all use it. Unless the company is so bad that damaging it is a political act of defiance against evil (I’m looking at you, Nestle, Blackwater, etc), then there’s really no good argument for employees burning shit on their way out.
Good, make sure you document that. Then be sure any such thing that accidentally happens is named after the person who most deserves to be pruned.
Got it. MouselemmingFromLemmyKillswitch.exe pushed to production
this was stupid. A career ending move. no one’s gonna hire someone who wrote a logic bomb at their last job.
Yeah they will.
He's going to end up running a consultancy where he charges absurd sums to give talks to corporate leaders on how to prevent this sort of attack. 😁
Good. Some one should sponsor and hire this guy.
I'm curious what this crowd thinks is an appropriate punishment here. No priors, found guilty, caused some lost revenue (which I have to admit doesn't mean you actually lost revenue). So, should they even be sent to jail? House arrest? Or do we just want consistency in punishments?
He should get a corporate level penalty. He made X dollars while working for that company but did something wrong while making that money. He should have to pay back .001% of his profits as a fine and the illegal stuff he did should then be ignored/forgiven. That is what corporations get as a penalty when they break the law, I think it should be applied when they are the victims.
That sounds fair.
Every user gets 0.003 cents as part of the settlement.
Honestly, it's kind of hard to tell. We're missing a hell of a lot of intent and access to the evidence here.
If he was just straight up vengeful, He should have been on the hook for the lost wages they paid for all the people that were knocked offline. The cost of whatever contractors they used to repair the problem. 6 months jail time and some psychiatric review.
If he had the intent of blackmailing them, then felony and probably pulling his work visa.
As it sits, even if he had some way to keep his right to work here, there are a few that would touch him with a 10-ft pole. He's required to disclose felonies as part of the hiring process pretty much everywhere. Anybody prospective employers are going to be extremely reluctant to give him any work that would afford him access to their network.
Usually a moderate prison sentence and a fine
5-10 years most likely
This is really well executed, too bad he didn't know enough to protect his identity.
Still, so much for that reduced cost of labor.
If more people reacted like this companies wouldn't be so fast to lay people off
Should have done a dead man's switch instead
No work you will ever do at a job is your labor. Employees are company property, their thoughts and achievements are company property.
It's petty to do this but it shouldn't be possible to get jail time.
Slow enshitification is easier and blameless.
I imagine you must be quite skilled to be able to manage your whole-ass company (and run their systems into the ground). So it shouldn't be a problem to get another job after being fired.
Why fuck with your future, just because of your own ego and a drive for revenge? That guy must've watched too many animes.
Because the rich and elite are powerful because people fear them.
Show them we aren't afraid. Thus guy will vs hired in no time
