3 ms·

More info here - http://news.softpedia.com/news/Rogue-IT-admin-Close-to-Shutting-Down-Mortgage-Giant-103292.shtml http://news.softpedia.com/news/Rogue-IT-admin-

• pyre 16y ago
  The choice bits: > During this time Makwana had root access to all of the main > systems, credentials which the company failed to revoke until > the evening of the day of his layoff. > His intention was nothing short of replacing the entire financial > data, including the backups, from all of the company's production > servers, with zeroes. > the admin appended malicious code to a legitimate script, leaving > a page-worth of blank lines between the two in order to avoid > detection. > Had this malicious script executed, engineers expect it would > have caused millions of dollars of damage and reduced if not > shutdown operations at Fannie Mae for at least one week.
• blantonl 16y ago
  During this time Makwana had root access to all of the main systems This quote above, and the entire article boggles the mind. I've worked with big and small organizations that protected root on <10 machines like it was the key to preventing aging.
  • jrockway 16y ago
    Not sure this matters much. Most places I've worked have considered local root exploits not worth patching. So if you have a user account, you have root.
  • triffidhunter 16y ago
    The more systems there are, the more likely this kind of thing is.
  • dspeyer 16y ago
    Still, somebody has to have it. If the number of people is too low, you risk them all being unavailable when you really need them. And there isn't a whole lot you can do to stop a malicious actor who already has root.