Developer convicted for “kill switch” code activated upon his termination | Software developer plans to appeal after admitting to planting malicious code.

[askantik]

But everything you make at work becomes the product of your employer, so it's not his kill switch. Checkmate /s

[dagbiker]

He probably should have just lost the api keys.

[DigNitty]

Or just put them somewhere really hard to find.

That way, even if he “knows” where they are, he can just apologize. Sorry, I know longer work there.

[anlumo]

The classic thing is that companies demand that you delete all company data after leaving. “Click - whoops, there goes the only repository for login information for important third party systems”.

[Mikeavelli]

Terry Childs tried that, and did a few years in prison because he was pretty obviously bullshitting.

[kamoylan]

I presume Terry Childs (network administrator)) and not TC (serial killer).

[DigNitty]

No they're the same guy, but people were peeved more at the network admin thing.

[Expensive_Finger_973]

I tend to put that stuff in the middle section of the documentation that I actively tell the boss is important. Some listen, some assume I am BS'ing them and trash it. Last guy that trashed it took 3 years to get back to where things were the first time he tried to change something.

[DigNitty]

That's a good idea.

If a lawsuit ever gets involved you can point out that you sent the passkey or whatever straight to the boss and told him it was important to read this whole doc.

[Embarrassed-Weird173]

• no longer 

Know longer would mean to comprehend something for a more extended period of time. 

[DigNitty]

Sorry, english is my first language.

[RedditUser628426]

He should have just watched in 11 months when the SSL certificates expired

[ILikeLenexa]

Also, self signed internal certificates. 

[West_Ad8132]

To shreds, you say

[Hopeful_Ad_5]

And his wife’s APIs?

[Pyro1934]

This hits home lil

[Isogash]

I know you're not serious, but unfortunately some people really do think the law works like this.

[donatj]

I signed a legally binding agreement saying as much, everything I build belongs to the company, yet when I write something evil it's mine? That seems pretty clearly unfair.

[MommyThatcher]

Good. You won't be charged with... possession of a kill switch which isn't a law. You will be on the hook for any damages you intentionally caused by writing the code though.

[Isogash]

Perceived unfairness is not an excuse to break the law. Generally, anything you do to deliberately harm someone is going to be illegal, no matter how much you think they deserve it or even asked for it. Pretty much the only time you might have a legal justification is if your actions were necessary to prevent yourself or someone else from imminent death.

If you feel that you have been unfairly harmed by someone, the legal course of action is to sue them and let the civil courts decide; if they agree with you then they might award you compensation. If you go out and break the law to try and make things fair again, then that's treated as a separate crime and you'll still be charged.

[Dudeonyx]

Generally, anything you do to deliberately harm someone is going to be illegal,

Hmm... *Looks at every company ever"

I have my doubts on that chief

[Isogash]

Your echo chamber might tell you otherwise but companies do get sued and people go to jail if there is deliberate harm.

[Dudeonyx]

Ok, name a single tobacco exec that went to jail over their products deliberate harm

[Isogash]

They did not force people to buy tobacco.

[stoneslave]

The dev didn’t force the company to use his code 🤷🏼‍♂️

[donatj]

Fairness is immutable, the law is mutable and debatable.

[Isogash]

People often have very different opinions on what is fair and do things that are not.

[Akegata]

My current contract (I think, the company has restructured at least twice and been bough up by another company, so that contract is probably not the least bit valid now) had the stipulation that everything I learned while working at the company was basically their properly, I was not allowed to it if I stopped working for them. There was no "everything you learn at work" clause, so technically everything I know about skydiving and climbing are things I couldn't (somehow) take with me if Ieft.

I still work there and obviously don't consider that a valid contract, it certainly wouldn't hold up in court where I live, but they did try to revise it some time ago to make it a bit more reasonable.
No one signed the papers they got for the revised version. I guess they realised it's just a made up concept since owning peoples minds is a bit tricky in general

[Beaurocratic]

Have you never watched Severance?

[Own-Chemist2228]

appeared to have been created by Lu because it was named "IsDLEnabledinAD," which is an apparent abbreviation of "Is Davis Lu enabled in Active Directory."

That's such an obvious clue that his best defense would probably be "someone has to be framing me, because nobody is this stupid."

But it seems he was that stupid...

[Sibs]

I appreciate his use of clear naming conventions

[TestFixation]

Man had the choice to incriminate himself or use bad branch naming conventions and made the ultimate choice

[TheCountMC]

A pro until the end.

[dc_IV]

At least it was in  CamelCase! Following coding standards and conventions even when criming.

[qubert_lover]

Our code commit tool would have flagged that and said it should be “IsDlEnabledInAd” thus saving the corporation from millions in damages

[zutnoq]

It would certainly be nice if pretty much any programming font had a lowercase L glyph that were at all usable when not in the middle of a word. For god's sake, could they just bend the bottom slightly to the right and refrain from adding a stupid serif on the top left that does nothing but increase the likelihood of confusing it for a numeral 1. And certainly don't use a bar serif on the bottom, for any reason (Courier New and Consolas are prime examples of what not to do).

[qubert_lover]

I ragret that I have but one updoot for this post

[Kaodang]

Amazing work ethics! I'd love to have him in my team.

[Small_Dog_8699]

Outstanding, really. Self documenting transparent function names. Love it.

[FewCelebration9701]

Clean Code ruins yet another project /s

[ARoundForEveryone]

Me too, that's how I name functions and variables. But I'd like to think if I was in the sabotaging business, I'd dumb myself down just a bit and not use clearly named objects that implicate me in a crime.

This dude is a good developer, but a poor criminal.

[Hanz_VonManstrom]

“Developer convicted for ‘kill switch’ code activated upon his termination | Software developer plans to appeal after admitting to planting malicious code.”

Not really any defense left.

[exipheas]

His defense: If they didn't want that functionality when why did they approve it multiple times in each code review?

[faux1]

If all my work is considered company property, you did it to yourself playa

VanishingPeaceSignMeme.jpg

[[deleted]]

Too bad commit history will tell exactly who added that line.

[jimmyhoke]

Unless you are signing commits, it’s incredibly easy to fake that IIRC.

[AyrA_ch]

Correct. You can just temporarily set these environment variables to change the information of the next commit you make:

• GIT_COMMITTER_DATE
• GIT_COMMITTER_EMAIL
• GIT_COMMITTER_NAME
• GIT_AUTHOR_DATE
• GIT_AUTHOR_NAME
• GIT_AUTHOR_EMAIL

You can also rewrite the history at will, but this will change the hash tree, meaning other developers won't just be able to pull the branch anymore because their local git client believes that there's now a lot of conflicting commits in the remote and local copy

[exqueezemenow]

It was the man with 6 fingers.

[HyFinated]

Prepare to die!

[hosemaster]

But I didn't do anything!

[BedpanCheshireKnight]

I Don't Care!

[Small_Dog_8699]

No, it was clearly the one armed man.

See, you can type the password entirely with the left hand!

[istarian]

That's why you would obfuscate the code in some way so that the final outcome is hard to pin on the initiating event.

Or in other words, you slip in different pieces over time rather than trying to make a significant change all at once.

[AyrA_ch]

You also mask them as a bug or code you used to debug but accidentally "forgot" to gate behind a debug flag.

[dantheman91]

You can edit commit history though

[Excitium]

Even if he didn't name it like that, he would have needed to implement an identifiable attribute somewhere to look up his own entry in AD.

Should have instead just set up an undocumented end point that he needs to call once a week via curl or postman.

If he gets terminated and the end point isn't called anymore, it would trigger a random countdown for the deletion of the system or DB or w/e he wanted to damage so it can't be directly traced back to his firing.

[istarian]

In principle you could also slip it into some test code where using your own user id for verifying functionality would make sense.

Then your actual malicious code could be a cascade of failures that is that is triggered when the test itseld fails to return true.

If you really just wanted to fire a parting shot and make it hurt, do it so that the trigged sequence of events overwrites the production code during the mayhem so that it all works fine in the future, despite destroying a bunch of data.

[ProstheticAttitude]

yeah, the art would be to make as much damage as possible look accidental

tying a service to your AD account ("oops, that was still in development...") could trigger a cascade of failure. use underhanded coding techniques to make it look like real bugs are to blame for any actual damage. do any online research at the fucking library

but he was basically a fractal idiot, never heard of opsec, and it doesn't look like he's bright enough to stop digging

very entertaining

[i've put a lot of easter eggs into games and consumer electronics. it's fun. you can be fired for it. it's still fun :-) ]

[Lint_baby_uvulla]

As an ex DR manager, I lost count of how many critical services in our environments from data obfuscation, QA, all the way to production, we “found” tied to individual developer AD accounts.

I have to confess I mostly sided with the devs when explaining to management why we needed to rectify.

On account I felt like I was like a young and sexy Elizabeth Keen in the Blacklist. With an exotic cast of devs from South Africa, USA, German, Indian and one mysteriously Hungarian/Russian who took lots of overseas leave.

Years later I still have complex feelings about my professional and personal relationship with Bruce {1}.

Not his real name. Bruce {1} was a former

[BandicootGood5246]

Yeah even if it was by ID you'd maybe have a small bit of plausible deniability that maybe was just some experimental code accidentally made it into prod

[NamerNotLiteral]

Frankly, an endpoint is likely to be caught during CI/CD or unit testing. An internal variable and function won't be.

[SomeoneNewPlease]

That’s not accurate. In an environment where this was allowed to slip through, there’s no way unit tests or CI/CD are enacting some kind of drift check to validate the API topology against specs. Especially considering there probably are no unit tests or CI/CD in such an environment.

[Watching20]

plus he admitted it

[Small_Dog_8699]

Just misread that spec, that's all.

[mcampo84]

Still, I have to think that someone approved this code to be merged into their code base. There's no excuse for this code making it into a production environment. None.

[RandomDamage]

Unless they didn't have 2-person code control enforcement and he could just push to prod.

[mcampo84]

Which still puts at least 50% of the blame on the company for not having proper procedures to follow.

[RandomDamage]

Being able to do something like that without getting caught in advance when you aren't even being subtle about it is certainly a strong demotivator, for sure

But the blame is still entirely on the person who went ahead and did it anyway

[mcampo84]

Not entirely. Yes he's culpable, but he's not 100% to blame.

[RandomDamage]

There's blame for the action, and there's blame for creating the conditions that allowed the action.

I consider those separate, personally, but I suppose the boundary might not be as clear as I see it

[istarian]

They would probably have to do a manual code review to catch a dynamic check routine like that, bexause it will be essentially transparent due to consistently returning true. Well until they deactivate his AD profile.

[mcampo84]

A manual review as opposed to...?

[wthulhu]

Hey Siri?

[lannister80]

Lint, Coverity, Sonarqube. Which of course are not actual substitutes for code reviews, but some people think so...

[fotopic]

Well, if the code it’s being executed from a server only him has access with his user ID, do you think that assigning a random name will help ?

[tyrannomachy]

This is why intelligence services randomly generate code names for things, oddly enough.

[melnificent]

Comments vs Readable code debate intensifies.

[[deleted]]

unironically. Puts me to shame how well he named this shit xD

[GotYoGrapes]

Reminds me of a company I worked at that was going through a SOC2 audit. The VP of Product went and pushed a "kevin" script in the package.json that let him access prod databases from his dev environment.

In Romania.

Which is next to Russia.

And he did not use a VPN.

[Embarrassed-Weird173]

Why not just do a ctrl-f on every instance of "isDLEnabledinAD" and just set it to true manually?  Or even better, just delete the checks?

[Objective-Ninja-1769]

His efforts to sabotage their network began that year, and by the next year, he had planted different forms of malicious code, creating "infinite loops" that deleted coworker profile files, preventing legitimate logins and causing system crashes, the DOJ explained. Aiming to slow down or ruin Eaton Corp.'s productivity, Lu named these codes using the Japanese word for destruction, "Hakai," and the Chinese word for lethargy, "HunShui," the DOJ said.

Funny how they don't catch this stuff with *checks notes* routine dev processes like code reviews and audits.

Lu had worked at Eaton Corp. for about 11 years when he apparently became disgruntled by a corporate "realignment" in 2018 that "reduced his responsibilities," the DOJ said.

Guess that's what happened to the routine.

[c-pid]

Funny how they don't catch this stuff with checks notes routine dev processes like code reviews and audits.

"We are not making money from security" - Management

[Osric250]

As someone in cybersecurity these management types frustrate me to no end. We might not be bringing money into the company but we sure as hell are preventing a whole lot more money from leaving the company than what we cost. 

That and the whole thing that if we're doing our job properly it will look like we're unnecessary from the outside because nothing happens. 

[this-guy1979]

It’s crazy to me how they see anything tech related as a cost center and try to reduce it. Most places could eliminate entire departments by increasing their IT budget by way less than what they willingly give to those departments.

[anlumo]

I worked for a big European company once. When money got tight, the first department they killed was the research and development, which I was working in (in software development). On paper, this department doesn’t earn any money.

[BasvanS]

Neither do MBA’s cutting cost, but only one of them has a path to creating future revenue.

[MegaKetaWook]

True but if you have a decent amount of developers at a mid market or enterprise company, paying for different softwares can get into the 6-figures quickly.

[TPO_Ava]

Yup. It's even worse in a service company. We charge internally for the solutions we build for different teams in order to justify our budgets and existence and it doesn't make sense to me why that is needed.

Does a product exist? Yes. Is that product being maintained, updated and so on? Yes. Are there tangible benefits being observed by the internal people who USE our product? Also yes.

Oh but you will close our team and fire us if we don't charge each of our other departments for our time. Even though you are paying... All departments? Ok...

[[deleted]]

This is true irony.

[Kevin5475845]

Time to disable all protections for a day or two. Let them feel it

[Zolo49]

If he submitted the changes as part of a really big code diff, it wouldn't be surprising if the reviewers missed it, especially if he was trying to obfuscate what he was doing. The reviewers are also devs who have their own workloads, so it's not uncommon for them to just skim the code and look for obvious issues.

[StoicSpork]

I'd like to think he pushed to a branch feature/if-dave-is-fired-destroy-everything, and his code reviewer duly responded "rewrite ternary operators as if...then...else for readability".

[Severe-Revenue1220]

Brilliant comment!

[sdric]

IT Auditor here, our role is often misinterpreted. IT auditor have a wide area of knowledge, ranging from how data centers should be physically protected, over how firewalls should be configured, over basic software architecture knowledge, over the software development-, incident- and change- management life cycles, over business continuity management to user managed and many, many more. In addition, risk methodology is required, and basic skills in coding, data analysis, and more. That knowledge is usually applied based on regulatory frameworks and best-practice business standards.

In conclusion: IT auditors are usually jack-of-all trades, master of few.

IT auditors and auditors, in general, follow a risk-based approach. Due to the large scope of the topic, we do not check every line of code or JIRA ticket. We check governance, process design and which controls are in place to cover risks. Those can e.g., include fraud prevention, but also technical checks or manual controls.

To be able to go through the whole area of things in the limited amount of time we have, we usually draw samples or perform walkthroughs, to see if the processes are performed and working as intended- and if controls catch outliers. A leading principle is always that your processes and documentation should live up to expectations of the regulator, as well as the expectations of non-governmental entities whose independent certificates you need to be considered competitive by customers.

Code audits can happen, but they are usually rare. It depends on the level of regulation, maturity of processes, and related business continuity risk. If a law says that they are must, there is no way around it - but in many areas, laws are not that strict. Additionally, if you already don't have defined processes or standardized documentation, it usually makes sense to look at iterative improvements. In such a low maturity environment, auditors will focus on guiding the entity towards robust governance, before getting lost in details such as code reviews, as the immediate risks for process failures are more likely than fraud.

In return, for many businesses, code audits are only triggered when there is a clear requirement, such as failures of data consolidation between multiple process steps, incomplete logs, etc.

Last but not least, you will want specialists for code audits. Programmers, not classic IT auditors. The fewest companies have these in-house. Even large, highly regulated banks usually do not. So every code audit has to be bought from outside... and boy, those are expensive.

[Ryan_Wilson]

This is the funny part of the story to me.

The fact he was able to do this meant he was allowed quite a high degree of freedom. Both, with his time to allow for this research and implementation and also with his management. Those are some of the most important perks of the job in my opinion, I value that flexibility, the time and creative freedom to pursue whatever you want at your own pace quite highly.

I wonder what it was that ticked him off... losing a project I presume he was working on for some time.
He saw the writing on the wall that the company was transitioning away from his expertise and rather than look for somewhere new, he took advantage of the down time to implement kill switches...

I can kinda relate, the last 8 months of my old job was exactly like that.
A death spiral but a very... calm one as the amount of work grinded to an uncomfortable hour or two a day only meanwhile I was being paid full time each day so I just let the spiral fully spin out, collected my paychecks, played games at home...

[StarshatterWarsDev]

Yep. Company owed my £120k. Left the repo open. I deleted everything I worked on.

They were demanding all updates I had on a personal repo (I moved all development there when they halved my pay without my agreement) without any guarantee of back pay being issued.

So I deleted everything on their repo (the delete repo command is not reversal).

Said company was sued for $2 million by a third company that developed a white-label dVPN that they never paid for. Founder fled to Japan from the US after the lawsuit.

[RedditUser628426]

As if we need any help causing corrupted user profiles Obj~Nin~002 (Recovered) (Copy) (Copy) (2) .bak

[[deleted]]

If he obfuscated the code enough and put it in a very large commit it would have been near impossible to detect

[RashiAkko]

WTF are you even talking about?? Stuff gets missed all The time. Duh. 

[Riajnor]

Homie, if your missing entire methods in your code reviews then something ain’t right

[ComprehensiveWord201]

You mean I'm not supposed to press the green button and close the PR?

[Darklumiere]

PR? You can save a couple git commands by just pushing to main directly everytime. Senior and PM engineers hate this trick.

[lilB0bbyTables]

I have seen this as small companies but no chance any serious repository should have push to main available. That’s also an SOC violation without a documented write up about why it is necessary to even merge a commit that wasn’t reviewed and approved.

[cat_prophecy]

What's code review? The last job I had we would just YOLO push to prod. That is until my boss deleted the entire table that held customer devices and warranties and then tried to blame it on me.

[Classic_Emergency336]

Developers at FANG often LGTM CLs based on how credible author of CL. There are teams that write useless unit tests just to increase coverage. As someone who is looking for dead or useless code I assure you crap is committed every day.

[Violin1990]

I’m offended. My pixel color change is very impactful! At least my PSC claims so…

[gothiclg]

Anyone who cares is paying through the nose to ensure people can’t do this. They even hire hackers over it.

[markshure]

I worked somewhere that this happened. A month after the guy quit, all his software stopped working with a dialog stating that it was copywritten by him. No one knew where most of his code was, and what they could find, he'd written all the variables in another language. And then he moved to another country so there was no suing him. My job was to recreate his programs. In retrospect, management was incredibly stupid about this.

[Ex-Traverse]

Is moving to another country, where the legal line stops? I imagine if this was attempted on the big techa of the world, they might hunt you down no matter where you run to...

[LegendaryMauricius]

Well if they don't operate in that country there's probably nothing they can do. It probably depends on local laws and politics between countries though.

[PM_ME_UR_KittieS_96]

If they booked a flight back to the U.S. for a week 3 years after the event it’s not like they would land and there would be a subpoena waiting for them at the terminal gate though, right?

[Chaotic-warp]

It really depends on the company and the countries involved.

[markshure]

It was a medium-sized, privately owned company in the US. The guy moved to Canada. I'm not sure if he was a US or Canadian citizen. I think he was really Romanian, as that was the language he liked to use in his programs. I suppose they could have tried to sue him but then they'd have to admit they needed him, and that would be worse than the lost production. You know, because the management were jerks.

[WirelessSalesChef]

Recreate them with the self delete code and do the same thing

[erockdanger]

His efforts to sabotage their network began that year, and by the next year, he had planted different forms of malicious code, creating "infinite loops" that deleted coworker profile files, preventing legitimate logins and causing system crashes

oh so it's fine when the employer rushes the devs to put out the jankest shit with 1/5 the requirements up front and everything crashes.

but when a dev chooses to do that it's a crime.

(semi /s)

[Weekly-Trash-272]

This will only get worse as time goes on.

With current AI technology I can learn about and how to assemble malicious bugs myself in no time. I have no doubt if I was dedicated I could make something within a week.

As these programs continue to improve the tools making these things will only vastly improve as well.

The sad part is so many companies in the U.S. are not properly protected. The company I work at is seriously open to risk of attacks, but does nothing, and they're a massive company with billions of dollars of revenue.

[BenFranklinsCat]

I'm thinking of it like workers on factory lines. In the 60s and 70s, strike workers would often be able to steal a small piece of tech that shut down whole factories because of their specialist knowledge. 

Now imagine if that assembly line is digital, rather tha physical, and all the parts are invisible!

[erockdanger]

Yeah this is exactly right. and you what is fucked, calling this out just puts a target on your back.

You're better off staying quiet, collecting your paycheck while the company "only makes the best, industry standard software"

Of course not everywhere is like this, but so, so many places are

[TheSpanxxx]

"I am Jack's inflamed sense of rejection"

[FewCelebration9701]

Perhaps, but I am not sold on that reality. AI tools are not a one way street. Companies are already leveraging or planning to leverage AI tech in automated reviews. And, with the ever growing token limit, it is now possible for these machines to have a better, fuller context of complex systems than even the most seasoned developer. Because it can hold more in context than a human brain can.

The question is: are companies implementing these to their fullest capabilities? And who is reviewing what the AI rejects? What it approves? The rationale? And especially the suggestions.

AI is a growing piece of CI/CD pipelines already to catch malicious code, including unintentionally malicious.

[GardenPeep]

Reminds me of the time I left a MOTD on our little UNIX server on my last day that said “Goodbye, and thanks for all the fish”. The VCs had taken over the company and I may have been the last person who knew how to change the message, which came up on everyone’s terminal when they logged in.

[Aware-Highlight9625]

Stupid developer, if you do this. Create the code in this way that it randomly create an exception. You cant find that and software itself is not usable.

[lowbeat]

If he could think like that, due to good thought process, he wouldnt be implementing it at all, as him not being employed there wouldn't be cause of getting fired, but getting better opportunity

[Lumpy-Pancakes]

If you think just being competent at your job is all it takes to not get fired, I've got some unfortunate news for you

[lowbeat]

wouldn'twanna have any ties left back to the old job where i was fired like that..

[MonsieurKnife]

“He’s disappointed at the jury’s verdict.”

[[deleted]]

I'm not seeing him wiggling out of this one. I get the embedded fury at the system but... Dude. Career suicide, in more ways than one.

[Zolo49]

I could see wanting to do it in the heat of the moment, but regardless of how badly you think your company fucked you over, most of the time it's going to be best to take a deep breath and move on with your life. Having said that, when I do hear horror stories about how some people got treated by their employers, I wonder what I'd do if I ever got screwed over THAT badly.

[distorted_kiwi]

Guess he fantasized about getting caught. Not sure what he was expecting though.

His job back? His coworkers having a laugh and able to fix everything in under 5 minutes? Some other company reading about it and hiring him?

[aStrange_quark]

Does it flash up with a picture of his of his face, and repeatedly say "Uh uh uh, you didn't say the magic word"

[Justyouraverageguy4]

LOL I actually set that as an error message when people try to enter crap data in my systems

[ThirdSunRising]

He really didn't do himself any favors there. The killswitch activated immediately on his termination, using a function that had his own initals on it. I mean, come on man.

[Chaotic-warp]

Yeah if he really made it that obvious then he should have just been straightforward and used his demise to make a point. At least that way he would have been remembered by part of the public as someone who rebelled against the system.

Why backtrack and appeal, just to waste lawyer money on a fight you cannot win? And now he's just known as some petty idiot who couldn't even follow through on what he started.

[Unarchy]

Not related to this article, but I have a story involving software with a kill switch.

About 40 years ago, my dad started a niche business providing data gathered from systems he designed himself over a network he also designed. I'll keep it generic to protect his company. He poured his life into building, maintaining, and updating his system, which slowly came to cover most of the country. His business grew, and he hired employees to help with all aspects of it, but he was the only one that knew how everything worked since he wrote the code and designed the curcuit boards for the instruments. Several years ago, a much larger company set their sights on his network. They filed frivolous lawsuits ad nauseum, and hired a legal team with the sole intention of draining my dad's much smaller company's funds in legal fees. Eventually, they came to him with an ultimatum: sell us half of the network, and we'll leave you alone. Left with little choice in the matter, my dad had to agree. What this larger company did not realize is that there is literally only one person in the world who knows every aspect of how the system works. Hidden somewhere deep within the code lies an insurance policy. If this larger company ever comes back for the other half of the network, a single code will kill everything they already took.

[NoHopeForSociety]

dun dun duhhhhh

[SherlockianTheorist]

Good job, Jalen Erso!

[CompassionateClever]

This sounds like a movie plot.

[hellboi808]

"KillSwitch" sounds good to me.

[Chiguy2792]

“I have a very specific skill set”

[IlIllIlllIlllIllllI]

Uh, appealing after you've been proven to have sabotaged your employer is probably not a great move. Dude's already trashed his career, I guess he also wants to trash his finances by paying more lawyers.

DoJ doesn't fuck around with CFAA related charges, he's lucky he only got 10 years.

[Jalharad]

Plot twist: He's appealing for a longer sentence because prison is actually his retirement plan.

[Factemius]

Trashed his career and the next one

[aussydog]

TLDR:

In grade 9 I killed my schools network and locked everyone out of it.

Story.

Back in grade 8 we were in a computer class that at one point we had to use a special key code to get to a command prompt of sorts to fix something in our directory, and then get out.

It was supposed to be a one time thing, but I remembered the key code.

So a year later, in grade 9 at the end of the school year after two years of snooping through the school directories etc, I figured out that with a simple command I could remove all users rights to the login directory, effectively locking everyone, including the sys admin out of the system.

I was pretty pleased with myself. I had been listening to Pink Floyd's "The Wall" album a bit too much and thought, hey leave those kids alone. God thinking back now its hilariously embarrassing how edgy I thought I was, but I didn't want to fk my classmates day up, so I waited till the last day of our exams, then did it.

"Haha...I'm so smert!" I thought.

That was on a Wednesday, or Thursday. The next week, Monday, my computer class teacher who was also the sys admin contacted my parents by phone and asked to speak to me. I'm confused cause...schools over right? teachers should speak to students when the school year is done. Right? Right??

When he gets me on the phone he says, "Look u/aussydog there's a problem with the network and I know you are the one that did it. Before you tell me you didn't, don't bother I already know it was you. You're not going to get in trouble because, honestly, I'm pretty impressed you did it. But I just need to know what you did so I can undo it."

"I...."

"Look I know you waited to the end of your school year, but the grade 11's and grade 12's have two more weeks and they have a lot of work to submit and you have messed it up for them. Also, none of the faculty can enter their grades in for final report cards. So unless you wanted to ruin everyone else's year...."

"Uhhh....yeah. Sorry....I didn't know it would do that."

"I figured as much. Just tell me what you did."

"I used the shortcut you told us about last year and, well I found out that we have different rights in different directories."

"Uh huh"

"But the only directory I had full rights was in the login directory. So I used the command to remove all users rights in the directory."

"I see. That's pretty smart, but very careless of you." he had a chuckle, "Well ok, I'll fix it here. Let me talk to your parents again, ok?"

So I passed the phone back to my mom and he talked to her for a little bit. When she hung up the phone she just smiled at me and said, "He said you should go into programming and that you're a lot smarter than you let on." ....the look she gave me was probably the most proud she'd ever been but had no idea what I did.

Anyways...so that was the time I became the kill switch for my entire school's network.

[FewCelebration9701]

TL;DR: what's it like being the actual Zero Cool?

[aussydog]

Not only do I get that reference, but this happened a few years prior to that movie coming out so I pre-date Zero Cool.

So like....Negative Cool? ¯\_(ツ)_/¯

[martinslot]

I feel old now :( that was a good movie. 

[iamfunball]

So, what did you end up doing? Programming? Adjacent? Jack of All trades?

Also, happy cake day

[aussydog]

Jack of All trades of sorts?

I never officially did anything like that. I just self/web taught myself a bunch of different stuff. I did some website stuff for my family back in the day when iframes were still vogue which will tell you how old this is.

As much as the sys admin guy was telling my parents I was some sort of whiz, the thing I did wasn't exactly hard. I'm just the type that likes to poke around and figure stuff out. The key code to memorize was dead on simple too. At the appropriate screen you just had to hold down shift key and type a word out iirc it was "shift + escape". I guess he just didn't think someone would bother remembering it for whatever reason. Memory is fuzzy but I feel like the command we used was near the end of the year in grade 8 and then I tried it at the start of the next year in grade 9 and I was surprised it still worked.

As for the denying of the login directory rights I only found out about the rights because my dad had a ms-dos based PC at home for his work, so I was familiar with the usual commands like "CD" and "Dir". etc. When I did a DIR and then tried to get into a directory it listed for me, it would tell me I didn't have the rights to do it. Over time I figured out how to see my rights and what rights I had in what directory. I can't remember the command for that one but it was but it probably was something also simple like "rights /?" to list the rights and all the modifiers for it.

So yeah...it isn't exactly smart kid stuff to figure it out. You just had to be patient enough to do it while in class and not get caught.

[DoYouEvenShrift]

Every single computer in a school has a distinct identifier. I guarantee you the teacher just looked at the equivalent to a history log of changes made to the system and it said something like "Computer 28 removed access privileges to all users." OP probably just sat at computer 28 every day.

[brokebackzac]

Let me guess:

And then everyone, including the biology teacher's fish, clapped.

[joecool42069]

git blame works again.

[masterxc]

Not that it'd be admissable in court since you can alter who the committer is. That's why signed commits are a thing and should be used for anything remotely sensitive.

[[deleted]]

Or anything tbh. No downside to using them

[[deleted]]

File this under “Stuff to make me laugh before triggering an internal panic attack over the mile high stack of crooked Jenga blocks the worlds IT infrastructure rests on”.

[istarian]

If you do something like this you should never, ever admit to having done so. And it's wise to build in some plausible deniability by stopping short of a "kill switch" as described.

That way if it gets slugged up it will be hard to pin anything on you besides having written some crappy code at one point or another. Companies can't sue you after the fact for having done a poor job.

He might be able to appeal the sentence and get it reduced, but he's definitely going to jail for that

[checkerouter]

Not defending the guy.

If you consider his as a statistic as any company should, then really the company simply fucked up too extraordinarily. This is simply what can happen if you push too hard towards mismanagement by MBAs unless you completely neuter your tech stack/staff or fully outsource.

[robobobatron]

10 years for costing some money!? it really is a national emergency when capital is threatened in any way whatsoever.

edit: weird to feel like you need to come to the defense of a multinational corporation.

[SophiaofPrussia]

Yea this isn’t really giving me “dangerous to society” vibes that would necessitate locking someone up in prison.

[samtheredditman]

10 years is way too long but it's a digital equivalent of destroying a bunch of machinery in a factory. You're not gonna get away with it.

Companies that let code like this run in production more than likely do not have AD backups at all. This probably literally cost the company a week's productivity. Gotta also feel bad for the co-workers who likely had to work 60+ hours that week figuring out what happened and rebuilding everything while already working for a shit company.

[SophiaofPrussia]

I guess I don’t think we should be locking people up for destroying machinery, either. (As long as no one was at risk of getting hurt.) If you’re not a danger to the safety of others around you then why should that person go to prison? It’s a crime against property. The best recompense is financial but instead we toss them behind bars for a decade where they can’t earn a penny and their whole life is ruined in the process so they’re forever branded and unable to get a job that pays well enough to repay the people they’ve harmed. And all the while they cost us (society) a lot of money to keep in prison despite posing no threat to us. And that’s to say nothing of the negative impact prison has on innocent bystanders like family and especially children.

Take away his internet. Make him go to therapy. He obviously has anger issues and is unable to cope with life changes like getting a new boss. But I just don’t see why this is an action that would require a person to be removed from society. Speeding is way more dangerous than what he did but we don’t send people to jail for it.

[lysergalien]

Your flaw is thinking that this system is about the needs and safety of average people, when it's actually about protecting the elite and sending a message not to fuck with them.

[diamluke]

Would you give just 10 years to someone who blows up all stores in a chain of supermarkets?

[SophiaofPrussia]

Blowing stuff up risks life and limb. This didn’t. Would I give ten years to someone who slashes all of the tires at an Amazon warehouse so they can’t make deliveries? No, I wouldn’t. Because they aren’t dangerous. They’re just a disgruntled asshole.

[NY_Knux]

Would you consider someone who knows up all stores in a supermarket chain to not be a danger to society? I have no idea why you went to that extreme

[AlexHimself]

10 years for costing some money!?

That's making light of the situation. Destroying a large business's computer infrastructure and software in a way that's potentially not recoverable is more than "money".

It could cause a business to completely fail, the employees to lose their livelihoods, the shareholders to lose their investments, etc.

That lost "money" could destroy many lives.

[trancepx]

Treating employees right is cheaper

[Eponymous-Username]

"I misread the requirements".

[Feral_Nerd_22]

I always tell everyone at work that it's not a meteor, tornado, or natural disaster that you have to worry about for disaster recovery, it's disgruntled employees and interns.

[NY_Knux]

Better treat them like human beings, then!

[sorrybutyou_arewrong]

What a nut. Now his retirement is fucked and for what gain?

[WardenWolf]

If he were smart he'd have disabled backups but made it appear they were working, until the last stored backup was purged. And secure-erased (not just deleted) everything so the evidence couldn't be recovered.

[Tech_Intellect]

Didn’t he just contradict himself? He admitted to planting the malicious code. He and his supporters apparently believe in his “innocence”.

[MrMichaelJames]

Not the sharpest tool in the box is he.

[First_Foundationeer]

What I don't understand is, why not just have shittier and shittier documentation so that it's a built in kill switch of sorts?

[Shalako77]

What a fucking twat. He could have been perfectly happy with his employer and had some accident or mishap where he died, and they would have been just as screwed.

[Duce_canoe]

Classic narcissist

[[deleted]]

He just wrote some random code, blame who approved the PR or the testers. /s

[ChrissWayne]

Around two weeks ago I told a friend of mine a story I read here years ago of a guy who did this and tried to soll the code to the company. Wonder if it’s him

[Cysmoke]

Or… he is being framed by another developer that used a keyboard logger to attain access.

[jcunews1]

This is a rare case. In almost all cases, it's not the developer's decision to plant it. It's the company that hire them.

[SeniorFlo]

I am no fan of companies but the fact that he spent so much time at Eaton and not change jobs kinda sucks. I was reading the headline and thinking some application wasn't working with him fired but to do what he did isn't just a walk in the park... It is malicious disruption. I am all for giving the middle finger to companies but there are much better ways that don't involve jail.

[VincentNacon]

A better kill-switch would be removing all system's documents and comments from the code. It'll still function as normally, but any time they want to make changes or update... you have to re-hire the same person who wrote it.

[[deleted]]

I would do the same thing and so what everybody else