11 ms·
Cloud engineer gets 2 years for wiping ex-employer's code repos
- charcircuit 3y agoDeleting a github repo doesn't actually fully delete it though. https://docs.github.com/en/repositories/creating-and-managing-repositories/restoring-a-deleted-repository#restoring-a-deleted-repository-that-was-owned-by-an-organization https://docs.github.com/en/repositories/creating-and-managin...
- hartator 3y agoThey probably use a custom solution. (Bank nonsense)
- reactordev 3y agoProbably Bitbucket...
- charcircuit 3y agoThe article said it was a github repo >Accessed FRB's GitHub repository and deleted the hosted code
- oldpersonintx 3y ago[dead]
- whalesalad 3y agoYou can cause mayhem by force pushing all refs as empty though. Then you would likely need to get GH support on the line to restore a backup, if they had them for you.
- dvngnt_ 3y agoI feel like at least one employ would have a clone of the repo no more than a few hours old.
- freedomben 3y agoIronically a lot of banks and big corps are moving to "cloud dev environments" so it's possible that Brody could have deleted all the dev containers too...
- whalesalad 3y agoyeah for sure that is definitely an urgent pagerduty request I might have sent once or twice before: /!\ DO NOT CLONE/PULL, DISCONNECT YOUR LAPTOP FROM WIFI
- sbergot 3y agoIt is really easy to protect you main branch. Github will actually warn you if don't have any protection policy on it.
- whalesalad 3y agoIt's also really easy to turn that off.
- telios 3y agoBut the commits will still be there even if the refs aren't, afaik? GitHub doesn't run gc that often.
- whalesalad 3y agoPossible? Try it and see =)
- robotnikman 3y ago>The court documents state that Brody's employment was terminated after he violated company policies by connecting a USB drive containing pornography to company computers. And this is why you have one laptop for work, and one for personal stuff, and never use your work laptop as your personal laptop.
- deleted 3y ago[deleted]
- pram 3y agoSomeone should have told this guy you can look at porn on your phone!
- blitzar 3y agoNot your work phone ...
- charcircuit 3y agoWork phones typically can't detect that as they have a security model that better protects the user's privacy.
- alwa 3y agoAnd yet, like many things you could do undetected, you still probably shouldn’t do that. Assuming it’s against work’s rules for their phones, anyway.
- blitzar 3y ago+ phone + usb drives
- silisili 3y agoKinda weird line, to me. Curious if it was for connecting a third party USB drive at all, and if so, why mention the porn. It seems like companies either have a strict USB policy, or don't. If they allow USB drives, it feels odd to me to fire someone over a drive containing porn. What if it was a genuine mistake of confusing two drives or something? Or a genuine drive that happened to just contain something copied by accident. But if OP was say, copying, streaming, or uploading the files, then that seems like a more clear violation than what the article states.
- hartator 3y agoAnd this is one why US engineers are paid way more. Good luck doing that in Europe.
- bberrry 3y agoWhat in the world do you mean exactly?
- roncesvalles 3y agoBetter legal repercussions. In most parts of the world if you went to the cops and said an ex-employee deleted your codebase and wrote mean things on your Intranet, they would chuckle and go back to work. It's probably a huge hassle to file a civil suit against someone who did that either, if it's even possible.
- reactordev 3y agoNot true. Company code repo's are company property. They have a case in pretty much all of the EU.
- hartator 3y agoYou won’t go to jail over this in the EU. Could you find a case?
- bberrry 3y agoAnd how does that translate to lower pay in your mind?
- filoleg 3y agoEach hired person carries massively more potential cost to the employer, due to the employer being unable to do much if the employee does things like watch porn on their work equipment, sabotage the company’s tech infrastructure before leaving, or just plainly suck at their job. That extra potential cost has to be paid from somewhere, which is typically coming from the total compensation, which translates to lower factual pay. Kind of like how working in software dev as a contractor typically nets you more raw money than working in a comparable role doing a similar job for someone else. However, as a contractor you are responsible for paying for things like health insurance yourself. As a hired employee, you will typically have those things provided to you by your employer, but you will get paid less in raw money, because those things get priced into your salary (sidenote: which your employer probably has a discount rate for anyway, so even if it was paid out to you in cash and you paid your own insurance, you would have had net less money, so it is kind of a comparative win-win for both sides here). For me personally as an employee, I would rather my employer be able to fire me for watching porn on my work equipment or be able to go after me for intentionally sabotaging company’s infra. Because I do not plan on doing either of those things, so just having that extra money in exchange for not being able to do those things unpunished is the easy choice, personally.
- jihadjihad 3y ago> connecting a USB drive containing pornography to company computers. What is this, 2005?
- sonicanatidae 3y agoHi, SysAdmin here. We typically allow exceptions for those that have a common need to use a flashdrive and cannot leverage the typical network for access to the data. That being said, we prefer not to create these exceptions, for reasons just like this, but it's not always our choice.
- pc86 3y agoI think they're wondering why the pornography is offline on a USB drive, not the existence of the drive itself.
- sonicanatidae 3y agoMaybe, but USB drives are a common attack vector and had there been an AD policy or similar, in place, that flashdrive would have been moot. My interest is in what kind of grand mal idiot thinks throwing pr0n on a work computer is a good idea!?!?
- DeathArrow 3y ago>My interest is in what kind of grand mal idiot thinks throwing pr0n on a work computer is a good idea A naive guy that maybe doesn't think everything he does on the computer is recorded.
- sonicanatidae 3y agoHe was a cloud developer. That implies some basic technical acumen/knowledge. It's not about if you are being monitored, it's more about you don't know when/if you are being monitored and how, so why risk it over garbage like pr0n? I know this, because I've been asked to monitor a number of fellow emps in my career (SysAdmin/Support) and there are just too many bases to cover, so why even bother? There's simply no way he couldn't afford some beater laptop.. (pun intended..lol)
- forgottentea 3y agoConcerning!
- manbart 3y ago>Inserted 'taunts' in the code, including references to "grok" This line gave me a chuckle
- deleted 3y ago[deleted]
- yunesj 3y agoFrom the court docs: > As alleged, Brody left a few "taunts" in the code that he unleashed on FRB. In particular, he is alleged to have used the word "grok," which the government explains is a misspelling of "grock," which, in turn, means to understand.
- garciasn 3y agoCan someone please explain to me how 'grok' (regardless of spelling) is a taunt, because I'm just not following.
- BobaFloutist 3y agoMy guess is he said "you can't grok this"
- wiml 3y agoI'm pretty sure it was "grok" in SiaSL. Is there some other origin?
- deleted 3y ago[deleted]
- ksd482 3y agoIT also failed to put enough checks here. The article states that the employee still had a valid company account that he could use to access the repos. The access should have been cut off right away.
- next_xibalba 3y agoI believe this line of thought is commonly called “blaming the victim”.
- plasmatix 3y agoI mean, if someone dies in a car crash and they weren’t wearing their seat belt, is it victim blaming to say they should have been?
- pipes 3y agoYeah but if someone purposely drives into that car with the intention of killing the driver, I'd hope they went to prison even if the victim wasn't wearing a seatbelt
- 11101010001100 3y agoIn the US, the person who sold the car will go to jail as an accessory to murder .
- BobaFloutist 3y agoMany such cases. Sad!
- 11101010001100 3y agoYes, theoretically we're all guilty of felony murder.
- foobarbaz333 3y ago
- oseityphelysiol 3y agoI would wonder what would happen whenever I was frustrated and now I know, thanks. I'll look for a new intrusive thought to have as a coping mechanism.
- hitpointdrew 3y agoAnd this is why you terminate access, then fire, not the other way around.
- BobaFloutist 3y ago"Hey, why can't I log in?" "Don't worry about it."
- madamelic 3y agoWhen will the FBI catch the notorious hacker grok?! Ugh, it could be anyone of us!
- bitwize 3y agoReminds me of the furry who got fired from a company and used a backdoor into their web server to tamper with their site after the fact. Only he knew how the server actually worked because it was a custom server whose scripting language was the FurryMUCK extension language. He blogged about this casually on his LiveJournal like it was no big d. Very Dennis Nedry of him. Few years later he was involved in the Ginko Financial scam on Second Life. Some men just want to watch the world burn.
- gtroja 3y agoWould love to rear that story
- nashashmi 3y agoHad he done this while he was an employee, there would be no legal repercussions.
- aobdev 3y agoAre you sure about that? I was under the impression that the CFAA is broad enough that even if you have credentials to access computer systems, but do so in a way that was not intended, then you have broken the law. Intentional damage is included in that definition too. Section (a)(5)(A): knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer
- pierat 3y agoThis is no different than someone with access to expensive machinery gets wooden shoes, chains, corundum grit, etc thrown in. Sabotage is sabotage. Just because it was done with a computer is of little point here, other than the specific law to target.
- tamimio 3y agoI think the big chunk of the penalty is because he lied to the secret service agents rather than the company damage, that being said, why would the secret service investigate a private sector company incident? At most, it should be the FBI afaik
- Aurornis 3y agoLying to federal agents to cover up a crime is definitely a big part of the penalty. He got caught and kept digging himself into more crimes. I’m also surprised the secret service was involved. I wonder if they suspected foreign involvement or considered it a matter of national security because it was an attack on banking infrastructure?
- acdha 3y agoThe USSS started as the Treasury Department’s anti-counterfeiting enforcement agency and only later expanded into protecting lawmakers. They still have a mission to protect the financial systems of the United States and I’d imagine anything involving bank IT integrity involves a call for them.
- dragonwriter 3y ago> why would the secret service investigate a private sector company incident? At most, it should be the FBI afaik The Secret Service started out as an anti-counterfeiting service, expanded into VIP protection, general national financial system security, and for a while general cybercrime, though the latter (outside of where it touched on the other Secret Sevice functions) fell away. “We also protect the integrity of our currency and investigate crimes against the U.S. financial system committed by criminals around the world and in cyberspace.” https://www.secretservice.gov/about/overview https://www.secretservice.gov/about/overview
- Projectiboga 3y agoThe Secret Service also does anything with hacking the telecom system, wired and wireless and it looks like they also do some of the internet and infrastructure stuff.
- 3y ago
- rdtsc 3y ago> Inserted 'taunts' in the code, including references to "grok" Did he get extra time for grok references? It’s just an odd thing they added to the list.
- DeathArrow 3y agoI guess it wasn't gay porn, otherwise he'd sue them for discrimination and they'd have to pay a lot of money.
- JCharante 3y agoWhy did he do it? I hate having access to things, it's just liability for you. I kept all my company passwords in my company password manager that was linked to my employee email so that if I lost my email access I would lose all passwords to anything company related. Whenever someone texts me a password I delete it after using it.
- JenniferBazan 3y ago[dead]