Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb

http://www.thenewnewinternet.com/2010/12/20/fannie-mae-unix-engineer-gets-41-months-for-planting-logic-bomb/

by wglb • 16 years ago

84 49 16 years ago

thenewnewinternet.com

jarin• 16 years ago

While it will probably always be hard to stop inside-man attacks, it will probably always be easy to do backups :)

shashank2612• 16 years ago

Just imagine if that guy had been successful. Americans would have been debt free!!

endtime• 16 years ago

You think that debt wasn't leveraged? You think people can just not pay back loans and no one gets hurt?

InclinedPlane2• 16 years ago

Nope. There are plenty of backup records for all of the debts. Physical records of deeds, contracts, etc. And it's possible much of the data could have been restored through backups and data retrieval methods. What this would have caused would be delays and difficulties in handling existing mortgages but the biggest impact would have likely been an inability of people to apply for new mortgages using fanny mae, which is hardly a win for anybody.

zitterbewegung• 16 years ago

Actually what would happen is taxpayers would have to pay more to recover the data and go through the physical copies. So in reality we would be in more debt. Life isn't Fight club. (Movie not book)

thenbrent2• 16 years ago

And as Fannie Mae provided the inside-man with root access to all the main systems, it was apparently just as easy to destroy the backups.

Edit: also in reference to this comment: http://news.ycombinator.com/item?id=2054679

InclinedPlane2• 16 years ago

If root access to systems lets you destroy backups then they cannot rightly be considered backups.

stcredzero• 16 years ago

Also, while it will probably always be easy to accomplish inside-man attacks, it will also be generally harder to get away with them than you might think. (Especially if real money is involved!)

grantbachman• 16 years ago

Most of my student loans were issued by them, if only the logic bomb had executed and destroyed my loan data...

mahmud• 16 years ago

You would be debt-free for the 48 minutes it takes to restore from backups.

jser• 16 years ago

sallie mae = student loans. fannie mae and freddie mac are home mortgage only.

amackera2• 16 years ago

Did all the financial institutions in the States get together to come up with the most ridiculous sounding names?

patio11• 16 years ago

Those taxpayer subsidized loans to get you an engineering degree are such shackles...

bugsy• 16 years ago

"the malware was designed to spread throughout the Fannie Mae network of computers and destroy all data, including financial, securities and mortgage information"

Not really malware though, that sounds like a good thing.

michaelty• 16 years ago

"the malware was designed to spread throughout the Fannie Mae network of computers and destroy all data, including financial, securities and mortgage information"

Sounds like a prototype for the toxic mortgage derivatives spreading throughout the banking system.

catshirt• 16 years ago

What would the actual consequences have been had it worked?

blinkingled2• 16 years ago

5000 Servers. A "Senior Engineer" discovered this script. Probably it was a cron job or something which they review regularly?

Would be useful to know how exactly they got to that one script. Must have real good review practices , audits and logging in place if they were able to find it before it did the damage and then collect evidence to trace it back to the perpetrator.

btn• 16 years ago

According to an article about the indictment, it was discovered by chance:

"It was only by chance that [the Fannie Mae engineer] scrolled down to the bottom of the legitimate script to discover the malicious script"

http://www.computerworld.com/s/article/9127040/Fannie_Mae_en...

pedanticfreak• 16 years ago

More detail from the above article:

[quote] If the malicious script had gone undiscovered, it would have disabled monitoring alerts and all log-ins, deleted the root passwords to the approximately 4,000 Fannie Mae servers, then erased all data and backup data on those servers by overwriting with zeros.

"Finally, this script would power off all servers, disabling the ability to remotely turn on a server," said the government's complaint. "Subsequently, the only way to turn the servers back on was physically getting to a data center." [/quote]

blantonl2• 16 years ago

Does anyone know what the actual "logic bomb" consisted of?

My money is on a crontab that executed a simple set of ssh command attacks on the specified date.

As per the article, to destroy "all data, including financial, securities and mortgage information," it would be as simple as an "rm -rf" across multiple servers. Except for one critical item, he would have to have root access on all those servers.

Either the scope of his potential damage was very small, or Fannie Mae had some terrible security and change management policies in place.

I cannot decide which to pick.

blinkingled2• 16 years ago

More info here - http://news.softpedia.com/news/Rogue-IT-admin-Close-to-Shutt...

pyre• 16 years ago

The choice bits:

  > During this time Makwana had root access to all of the main
  > systems, credentials which the company failed to revoke until
  > the evening of the day of his layoff.

  > His intention was nothing short of replacing the entire financial
  > data, including the backups, from all of the company's production
  > servers, with zeroes.

  > the admin appended malicious code to a legitimate script, leaving
  > a page-worth of blank lines between the two in order to avoid
  > detection.

  > Had this malicious script executed, engineers expect it would
  > have caused millions of dollars of damage and reduced if not
  > shutdown operations at Fannie Mae for at least one week.

blantonl2• 16 years ago

During this time Makwana had root access to all of the main systems

This quote above, and the entire article boggles the mind. I've worked with big and small organizations that protected root on <10 machines like it was the key to preventing aging.

tbrownaw• 16 years ago

Or they have an automated system that has root access to everything (say, to push config changes), and he had access to that system, or he had a way to crash/corrupt their SAN, or they only do black-box testing and not full code reviews (and the next guy to get assigned a bug in that same program found it), or they have code reviews that can be dodged with faked documentation, or...

rbranson• 16 years ago

If he was part of the SA team for their production systems, it's likely he DID have root access to all of them, and that it was legitimate and had business justification. Even if he didn't have explicit root access, it's even more likely he had direct physical access, which is generally less carefully protected by IT policies and is usually all or nothing.

Granted, this isn't just run of the mill data, and Fannie Mae could have certainly had significantly better security policies in force, but I don't think they were below average for a corporation in their security policies.

cuppster• 16 years ago

I'll take a mortgage-reduction bomb any day...

mhansen• 16 years ago

We had a mortgage reduction bomb a while ago. It didn't work out well for very many people.

http://en.wikipedia.org/wiki/Financial_crisis_of_2007%E2%80%...

shashank2612• 16 years ago

How in the world can you stop that and why did the company have only 1 person handle such an important task?

ja272• 16 years ago

41 months seems exceptionally high given that it was discovered before execution. It would take me an hour to dig it all up, but there are federal sentencing guidelines based on the dollar amount of damages. I don't think they take potential damages into account.

bobz• 16 years ago

Funny, I came here looking for the exact opposite post to upvote. Seems exceptionally low to me, given the obvious malicious intent and potential damages. But I'm mostly ignorant about the relevant law.

martincmartin• 16 years ago

I assume you mean relative to other sentences/crimes you're aware of? It may be low compared to those, but in general, American sentences seem exceptionally high to me, and this is a good example.

I don't think a stronger sentence would have deterred him. I doubt he sat down and thought "If I get caught, I'll only get 3 1/2 years, which isn't too bad. Now, if I would get 10 years, that's another story..." I doubt he even knew the specific penalties for doing this. It seems to me he assumed he'd never get caught.

I think others reading this article will be deterred by the thought of losing 3 1/2 years of their life, and having their life after prison ruined in many ways. For example, try to explain a 3 1/2 year gap in your employment history during a job interview. And for the ones who aren't, I don't think a 10 year sentence would somehow deter them.

I don't think this guy is likely to commit another such crime after his release. I doubt he figures that 3 1/2 years in jail and putting his life back together isn't that big a deal and planting another logic bomb feels so good that it's worth it to do it again.

The only other motivation for punishing a crime is vengeance, an emotional feeling of hurting someone who tried to hurt us. That seems a poor motivation for taking away even more of someone's life.

He did something malicious that could have caused a lot of problems. He needs to be punished. But the punishment seems way out of proportion to what's needed to reduce crime.

thenbrent2• 16 years ago

If you'd be willing to take the time to dig something up on that I'd love to read it.

It seems surprising to me that potential damages would not be taken into account. By doing so, the accussed would essentially be rewarded based on chance - at least in this case.

ja272• 16 years ago

Ok, let me dig. It's been a while and I'm not a lawyer.

Looking at the actual indictment, I think he was charged with just violating Section 1030 (a)(5)(A)(i) of the U.S. Code. I don't think the other two sections mentioned are separate charges.

http://www.law.cornell.edu/uscode/html/uscode18/usc_sec_18_0...

If you've never read section 1030, it's surprisingly clumsy and vague to us non-lawyers. Two important things for most cases are that generally any computer that is (or even 'can be') connected to the internet is considered to be 'protected' as it may potentially be involved in interstate commerce. The second this is that for this section to apply, there must be at least $5000 in damages involved.

Then you can go look up sentencing guidelines. It's important to realize that these 'guidelines' are a lot more than just suggestions for federal judges. They can go outside of these guidelines but rarely do. http://www.sentencing.us has a great calculator. That quickly tells us to use section 2B1.1(a)(2) of the guidelines.

http://www.ussc.gov/Guidelines/2010_guidelines/Manual_HTML/2...

If you go look at those guidelines, there's a chart in (b)(1) that shows how much his base offense level would be increased depending on the damages. From the descriptions I've read, I would think the damage amount would be less than $120,000 (lost time, hours it took to clean up) so that's a +8 level increase.

Then there are a number of special modifiers that can increase the 'level' of the sentence guideline. It looks like (b)(14)(B) might apply due to the financial institution aspect, so that would be a +4, except if I read the awkward combination of (C) and (D) correctly, this automatically pushes him to a level 24.

So then you need to look at the sentencing table: http://www.ussc.gov/Guidelines/2010_guidelines/Manual_HTML/5...

The table takes his criminal history into account, which was likely none. Then we need to look at his level, which we still don't know.

If he caused under $120,000 in damages, his level should be a base of 6 plus 8 for the dollar amount. He could reduce this by 1 or 2 levels by accepting responsibility or other things. But if he was at a level 14, his sentence guideline should be 15-21 months. I would think that the damage amount could be even lower than that, especially if it had to be proved in trial. This is why I made my original statement that I thought it sounded quite high.

So they must have applied the (b)(14)(B) part to push him to level 24 for a range of 51-63. In which case his sentence of 41 months is then too low. So if he "accepted responsibility" he could reduce his 24 to a 22, getting him right at the 41-51 month range. Judges would almost always apply the lowest end of the range to a first time offender.

I think his 41 months can be split into two phases so he could spend half of it in an actual prison and then the rest on 'supervised release' - either monitored home detention or in a halfway house. He might even be able to spend the entire time on 'supervised release'. I couldn't find it but section 1030 offenses used to have a clause about mandatory 6 months 'imprisonment'.

Due to his offense level, he could have gotten 5 years probation, but 3 is typical. He will be required to make restitution to the victim for the damage amount. There's also a fine table that shows him with a $7,500 to $75,000 fine range. He'll have to make his best effort to pay those.

So that's the mechanics of federal sentencing.

This is something I wish they covered in every school program. It's amazing to realize that one angry act by a programmer or IT person could result in very severe consequences. So few people in our field realize how stiff the penalties can be, so this law isn't much of a deterrent.

known• 16 years ago

Actually it s very easy to plant a logic bomb using http://en.wikipedia.org/wiki/Bit_twiddler

alanh• 16 years ago

He added malicious scripts to the bottom of a legitimate one? I have seen Wordpress hacks obfuscate themselves ten times as cleverly. For example, by eval()ing rot13(), gzipped, and base64()'d code included from a file with a legitimate-looking name.

Aegean• 16 years ago

We don't know the whole story but if you hold that much grudge in yourself this is how you end up. Bad karma brought him bad karma.

hermanthegerman• 16 years ago

How did they prove in court that it was planted there by him ? After he gave his laptop away, everything could have happened to it. Maybe just a cheap trick to punish him for something they couldnt 'prove'.

manche• 16 years ago

Remind me again, how many months did the Fannie Mae executives get for bombing the economy?

Fannie Mae Unix Engineer Gets 41 Months for Planting Logic Bomb

Related Stories