12 ms·

Twin brothers wipe 96 government databases minutes after being fired

• chrisra 5mo ago
  I have no problem with my credentials being revoked everywhere before I know about a layoff. I don't really care how I learn about it, just please don't make me come in to the office.
  • xingped 5mo ago
    [flagged]
  • ccimmergreen 5mo ago
    So this was why the FBI Director Kash Patel was in a panic when he couldn't log in one day. Revoking credentials before firing someone makes a lot of sense in security.
    • metalman 5mo ago
      no, becaus the simple and pragmatic solution for ANYONE who is subject to arbitrary termination, is to litter everything they build with caltrops and dead man triggers and then hint that they will go into "consulting" when fired. I know of one case where this was totaly unintentional, and a machinest at a local pulp and paper plant had self delegated to write the software that controlled tension on the giant machines in the mill, but as it was his only real forey into sofware, nobody else could operate it, and they fired him after a manegment reshuffle, and then after the next scheduled shut down, nothing worked right, greasy dusty ancient screen with a blinking cursor was what they had, plugged into the important bits of a half sqare mile plant. still funny to think about!
      • therobots927 5mo ago
        That is some top notch wrongthink… HN does NOT find it funny!
      • cj 5mo ago
        Or if you don't want to booby trap your code, buy one of those tiny devices that make a cricket noise randomly every 5-15 minutes, and hide it somewhere in the restroom. https://annoyingpcb.com/ https://annoyingpcb.com/
        • zimpenfish 5mo ago
          These are too obvious - 5-15 minutes gives your victim way too many opportunities to narrow down the location. What you really need is one that chirps once every (multiple of) 20-28 hours (with weighting towards 23-25 to keep it roughly around the time you set it going and an infrequent skipping of a day.) Also with different volumes and, ideally, different chirps. Occasionally a double chirp just for extra insanity causing. (A Michael Jackson "hee heee" would be another good option.)
          • HeyLaughingBoy 5mo ago
            Next time I'm bored and need a project, I'm building that ;-)
    • deepsquirrelnet 5mo ago
      Professionally, he spells his name thusly: FBI Director Ka$h Patel, so you know he’s serious.
      • tty456 5mo ago
        Written in bourbon
    • lostlogin 5mo ago
      > So this was why the FBI Director Kash Patel was in a panic when he couldn't log in one day Ever tried to login with two factor and justify a maxed out company card while high as a kite and drunk? It’s stressful.
  • nine_k 5mo ago
    > just please don't make me come in to the office. But how do you pick up the stuff from your desk? I once lost a nice pair of headphones this way.
    • jagged-chisel 5mo ago
      Meh. Don't leave anything at work. Forgo the convenience and carry your things on your commute. Use a bag. If there's "too much stuff", that's a sign to pare back what you "need" at work.
      • cromka 5mo ago
        I had my gym stuff in a gym locker. The reason I was able to commit to a gym routine was being able to get off my desk, get down the elevator, enter the gym and change in gym clothes in literally 5 minutes. I would never be willing to commute with all that gear. And I never got that gear back. Still a net positive in my experience.
        • eks391 5mo ago
          Same, almost. When I was a student, I rented a locker near the showers so I could start my day at the school gym, shower, and go to my first class. My workplaces have not had gyms, but I bought equipment for my home that maintains the streamline. I haven't been perfect at my routine because my work schedule isn't consistent which is annoying, but I do still get some exercise in at least twice per week with it. I doubt I'd be getting at least that otherwise.
      • whatshisface 5mo ago
        I know this is not a good year on the job market, but if you are traveling to work with a "go bag" and not leaving coffee mugs on your desk to prepare for being laid off maybe it is time to carry that go bag to some other buildings...
        • jdev-hn 5mo ago
          [dead]
• cyanydeez 5mo ago
  so, apparently, the passwords were stored in cleartext.
  • whynotmaybe 5mo ago
    Remind me of a forum a long time ago that sent me my password in clear when I used the "forgot password" link. When I advised them that it was a bad idea to store password in clear, they answered that they keep it in clear so that they can send it when someone forget. Defeated by such argument, I deleted my account.
    • SoftTalker 5mo ago
      Gnu Mailman still does this, and sends a monthly reminder email of your password.
    • scorpioxy 5mo ago
      I've got a better one. I once had the same argument mentioned to me by my manager at the time when I pointed out that passwords were being stored in clear text. That it needs to be this way so that it is read/sent when the users forget their passwords(which happened a lot). I tried to explain that typically a "reset password" flow is used for that but that fell on deaf ears. That system contained healthcare data. Something bad did end up happening due to that lax security and there were oh so many meetings about it.
      • bluefirebrand 5mo ago
        > Something bad did end up happening due to that lax security and there were oh so many meetings about it. This is the sort of thing that makes me want to check out of the whole circus. Here I am, telling you ahead of time, and you ignored me So how there's a circus that we could have avoided and not only do I get zero recognition for identifying the threat ahead of time, the people who ignored me keep their jobs and turn it into a zoo where everyone is scrambling in endless meetings And I've seen it play out a few times. After a point, why bother...
• kaikai 5mo ago
  How on earth did someone previously convicted of what sounds like hacking get job access to so many prod government databases? Wild that it took them so long to get caught.
  • AlexB138 5mo ago
    I had the same questions. Apparently discovery of the prior conviction is what lead to them being fired: > When the company discovered Sohaib Akhter’s felony conviction, it terminated both brothers’ employment during an online remote meeting on Feb. 18, 2025 from https://www.justice.gov/opa/pr/federal-jury-convicts-virgina-man-charges-relating-deletion-us-government-databases https://www.justice.gov/opa/pr/federal-jury-convicts-virgina... which is a better source on this. That prompts the question of why background checks are so lax that they were hired before this was discovered.
    • charonn0 5mo ago
      The company involved here is apparently based in Washington, DC, which has a "Ban the Box" ordinance that limits employment background checks for most kinds of jobs. And apparently DC's version of the law is particularly strict.
      • giantg2 5mo ago
        Shouldn't this force companies that need to pass a SOC2 out of the district? Doesn't SOC2 require background investigation of personnel with access to sensitive systems?
      • calgarymicro 5mo ago
        The prevents them from asking before extending an offer, but it seems they could (and should) have checked after.[0] > However, an employer may ask about criminal conviction(s) after extending a conditional offer of employment (the employer can never ask about arrests or criminal acusations that aren't pending). An employer who properly asks about a criminal conviction can only withdraw the offer or take adverse action against the applicant for a legitimate business reason that is reasonable under the six factors* listed in the Act. One of the six factors is "Fitness or ability of the person to perform one or more job duties or responsibilities given the offense"[1], which they probably could have invoked after asking (though they never checked or didn't check thoroughly enough, so I guess it's moot). [0]https://ohr.dc.gov/page/returning-citizens-and-employment https://ohr.dc.gov/page/returning-citizens-and-employment [1]https://ohr.dc.gov/sites/default/files/dc/sites/ohr/publication/attachments/EmployerFAQ_FINAL_120814.pdf https://ohr.dc.gov/sites/default/files/dc/sites/ohr/publicat...
• waterTanuki 5mo ago
  > On Feb. 1, 2025, Muneeb Akhter asked Sohaib Akhter for the plaintext password of an individual who submitted a complaint to the Equal Employment Opportunity Commission’s Public Portal, which was maintained by the Akhters’ employer. Sohaib Akhter conducted a database query on the EEOC database and then provided the password to Muneeb Akhter. That password was subsequently used to access that individual’s email account without authorization. It should be a federal crime with prison time to make a DB for a federal agency and not hash and salt passwords or other auth credentials.
  • mijoharas 5mo ago
    This is what I want to know. Are there any consequences for this contractor? At least fraud or negligence or something?
    • deleted 5mo ago
      [deleted]
  • wildzzz 5mo ago
    It's probably some sort of crusty old application written before salt and hash was SOP. No agency is going to spend money on hardening something non-critical unless there's an incident or there's free money to do so. And that application was likely written by some contractor who's no longer around or has the source code available so any fixes would require an entire redo. And while you're redoing the whole thing, let's add in a bunch of features and scope creep to balloon the cost and schedule. Oops, the new contractor writing the app is overrun so let's bail and go back to the old version.
• chatmasta 5mo ago
  > At 4:58 pm, he wiped out a Department of Homeland Security database using the command “DROP DATABASE dhsproddb.” This article is hilarious. The two bickering brothers remind me of the guys in the Oceans movies played by Casey Affleck and Scott Caan. It’s amazing they got this close to sensitive data.
  • bandrami 5mo ago
    As somebody who's spent most of my career in Fairfax County I find nothing about this story even remotely surprising.
  • bmitc 5mo ago
    Those two in the movies were always a highlight for me, especially when the one joins the other in the Mexican factory riot.
    • noboostforyou 5mo ago
      One of my favorite lines "Peligroso es mi nombre medio" (which of course is not grammatically correct in Spanish) and then his short inspirational speech invoking general Zapata were great.
  • johnbarron 5mo ago
    I think its them on video: https://youtu.be/Rx19zOzQeis https://youtu.be/Rx19zOzQeis
  • game_the0ry 5mo ago
    > At 4:59 pm, he asked an AI tool, “How do i clear system logs from SQL servers after deleting databases?” He later asked, “How do you clear all event and application logs from Microsoft windows server 2012?” So many red flags, I can't even.
    • lostlogin 5mo ago
      Ready access to AI tools sure makes vandalism easy.
• iJohnDoe 5mo ago
  It’s crazy that people are desperate for jobs and these clowns get hired.
  • alphawhisky 5mo ago
    Well, who else would you hire for the circus?
    • hunterpayne 5mo ago
      Perhaps don't hire people who act as foreign adversaries for government work? Is that really such an absurd proposition?
      • ChrisMarshallNY 5mo ago
        I don't think they were spies. They have ethnic names, but it sounds like they are just good ol' red-blooded Yankee crooks.
        • GorbachevyChase 5mo ago
          I can understand wanting to be perceived as being on “the right team” but that comment is so silly that it undermines credibility. To put it otherwise, could you imagine a scenario where I had a labor, arbitrage opportunity that involved a higher paying job in Shanghai, China and that I had lived there for a few years to do that. Let’s also say that I was found guilty of some similar crime. Would you call me a good old fashioned red-blooded Chinese crook? It’s OK to acknowledge that economic migrants are a thing, and that they likely have only transactional interest in where they live, such as a Bengali construction worker in Dubai, for example. That’s just part and parcel of labor mobility. For better or worse, shareholders, or middleman representing shareholders, have decided this sort of thing is a really good idea in the US, and now around half the population falls in that bucket. It’s a free country, and freedom means being free to choose short term interests. That also means you’re free to support such policies because they are good for Blue-team redistricting so we can provide free healthcare to all 8 billion people in the world somehow. But please, nobody becomes a Yankee by the mere fact of standing on the ground. If you want that pejorative title, then you need to earn it.
• nostrademons 5mo ago
  > Muneeb Akhter asked Sohaib Akhter for the plaintext password of an individual who submitted a complaint to the Equal Employment Opportunity Commission’s Public Portal, which was maintained by the Akhters’ employer. Sohaib Akhter conducted a database query on the EEOC database and then provided the password to Muneeb Akhter. WTF?
• libpcap 5mo ago
  Nice handwritings, though.
• game_the0ry 5mo ago
  No back ups? Skill issue.
  • Tangurena2 5mo ago
    Not many people test their backups. I've encountered some situations where the backups didn't work. And one previous employer who was so lazy that he didn't rotate the backup tapes so that the one tape cartridge was used so long that the oxide layer was rubbed off of the tape - so it was no longer brown but was transparent instead (imagine adhesive tape with no adhesive).
  • zeroonetwothree 5mo ago
    The article says that they did have backups
• scottlamb 5mo ago
  > [Opexus] said that “the individuals responsible for hiring the twins are no longer employed by Opexus.” Getting close to the classic Monty Python line: "Those responsible for sacking the people who have just been sacked, have been sacked." Jokes aside, stuff like this sucks because I suspect many employers will take from it the most extreme, dehumanizing lessons, e.g.: (a) make firings [edit: including lay-offs] as abrupt as possible including terminating all access immediately, (b) never give second chances to anyone with any sort of criminal record (even say decades old marijuana posession or something). I'd prefer a more balanced version: limit unilateral access to sensitive systems in general (not just of recently-fired employees), when someone is fired immediately shut off particularly sensitive credentials if they do exist (but not their general-purpose login/email account), avoid hiring people convicted of wire fraud as sysadmins, hash your @!#$ing passwords, etc.
  • tempaccount5050 5mo ago
    When you are talking about access like they had "make firings as abrupt as possible including terminating all access immediately" not doing this is incompetence. This is absolutely a standard and has to be for these kinds of positions. I've never worked anywhere where it wasn't for the majority of IT staff. You meet with HR, someone clears your desk, and security walks you out.
    • scottlamb 5mo ago
      > When you are talking about access like they had "make firings as abrupt as possible including terminating all access immediately" not doing this is incompetence. You're proving my point—employers take the most extreme lesson and it's considered expected practice. They absolutely should have immediately terminated the credentials that granted unilateral access to sensitive databases. (Ideally those would never exist in the first place—there are two-person schemes. A pair of bad actors...well apparently happens according to this article...but is far more unusual.) But employers regularly (but shouldn't) terminate all access including credentials that allow last email to colleagues exchanging personal contact info or something.
• capibara13 5mo ago
  A true professional always makes sure to leave their workspace completely spotless before going home
  • lostlogin 5mo ago
    So no guns and ammo?
• soVeryTired 5mo ago
  > On March 12, 2025, a search warrant was executed at Sohaib’s home in Alexandria. Agents grabbed plenty of tech gear but also turned up seven firearms and 370 rounds of .30 caliber ammunition. Given his former crimes, Sohaib should have had none of this. For god's sake, don't commit crimes while you're committing crimes.
  • paulpauper 5mo ago
    Only commit one crime at a time
    • vvpan 5mo ago
      Serially.
      • financetechbro 5mo ago
        Waterfall style
    • thelastgallon 5mo ago
      There should be a law against committing multiple crimes at the same time.
  • tclancy 5mo ago
    I was kind of hoping he sprinted out his back door which happened to be on a state line and then mailed his guns back to his house, just to try to cover everything.
  • colechristensen 5mo ago
    There is a strong bias towards stupid criminals getting caught.
  • pretzel5297 5mo ago
    > Given his former crimes, Sohaib should have had none of this. Nobody should have a personal armory.
• giantg2 5mo ago
  How did they get access to 5k passwords? Are they being sent/stored in cleartext? This is the most baffling part of the article for me. The second part I'm unclear about is how you could pass SOC2 when you aren't terminating account access simultaneously with the employment termination.
  • inetknght 5mo ago
    From the article, it sounds like the passwords are indeed stored in cleartext: > On Feb. 1, 2025, Muneeb Akhter asked Sohaib Akhter for the plaintext password of an individual who submitted a complaint to the Equal Employment Opportunity Commission’s Public Portal, which was maintained by the Akhters’ employer. Sohaib Akhter conducted a database query on the EEOC database and then provided the password to Muneeb Akhter. That password was subsequently used to access that individual’s email account without authorization.
    • giantg2 5mo ago
      It still blows my mind. Shouldn't the government audit their contracting companies for egregious issues like this? Seems extremely reckless not to.
      • at-fates-hands 5mo ago
        I'm pretty shocked as well. I thought every company stopped doing this like 20 years ago? Even for a legacy system that is a long time to continue storing credentials like that.
        • jeremyjh 5mo ago
          20 years is rookie numbers in these systems. I guarantee it’s been at least 40 years since a single fuck was given.
        • __turbobrew__ 5mo ago
          My wife works in IT at a mid sized city. They still store credentials in source control.
• paulsutter 5mo ago
  Deleting data like that is a crime investigated by the FBI. In a very sad story, a brilliant former coworker made a mistake of deleting data after leaving employment and ended up in prison. Brilliant guy, momentary mistake. Overzealous employer.
• dzonga 5mo ago
  prosecute the company too. storing passwords in plaintext should be persecuted & having unlimited access to customer databases.
• ck2 5mo ago
  imagine the delete-fest the current whitehouse is going to do in a few years all with pardons waiting so they can't be convicted they might not even wait a few years
  • Tangurena2 5mo ago
    "Legal Eagle" has a new video about this. The administration's viewpoint is that the Presidential Records Act is unconstitutional, plus the President owns every document, so he can't be forced to return anything because it belongs to him.
  • chinathrow 5mo ago
    They might not leave, at all.
• deleted 5mo ago
  [deleted]
• ge96 5mo ago
  Some good handwriting
• dionian 5mo ago
  The penmanship of the guy is extremely neat, like, uncannily so
• htx80nerd 5mo ago
  [flagged]
  • chasing 5mo ago
    [flagged]
    • htx80nerd 5mo ago
      [dead]
      • ImPostingOnHN 5mo ago
        if they did terrible things, why are you ignoring that and focusing exclusively on their ancestry?
        • jyscao 5mo ago
          If positive correlations exist between people who do bad things, and their ethnic backgrounds, then it's a pattern worth looking into.
          • deleted 5mo ago
            [deleted]
          • ImPostingOnHN 5mo ago
            if you personally believe there is a positive correlation between having an ethnic background (mexican or middle eastern or whatever) and doing bad things, I can't control your beliefs still pretty gross of you though
            • cubefox 5mo ago
              Beliefs can't be "gross", they can only be true or false, justified or unjustified. There is no such thing as a morally wrong belief. That would be the confusion between fact and value.
• taffydavid 5mo ago
  > While this was going on, the brothers held a running conversation. (The government is not clear about whether this took place over text, instant message, or in person.) Explain to me how we can have a transcript of a conversation without knowing whether it was in person or not. I'm baffled by this sentence.
  • killingtime74 5mo ago
    Probably confession
• kittikitti 5mo ago
  This is very surprising that they would pass a background check. I've been denied an offer because of a low credit score multiple times.
• nrmitchi 5mo ago
  This whole story is just line after line of utter incompetence. The "after they were fired" sounds catchy, but isn't even the biggest failure. This organization shouldn't be permitted anywhere near government, or any non-public, data/information.
• PowerElectronix 5mo ago
  He may be a bad person but he has a very pretty handwriting.
  • disqard 5mo ago
    Your comment made me go read TFA, and yes, that is rather pretty handwriting.
• deleted 5mo ago
  [deleted]
• JumpCrisscross 5mo ago
  > Muneeb and Sohaib Akhter, now both 34, had been in trouble before. Back in 2015, the brothers pled guilty in Virginia to a scheme involving wire fraud and computers. Muneeb was sentenced to three years in prison, while Sohaib got two. After their stints in jail, the brothers worked their way back into the tech world. In 2023, Muneeb got a job with a Washington, DC, firm that sold software and services to 45 federal clients; Sohaib got a job at the same company a year later. What in the actual fuck. I'm all for giving people second chances. But maybe some ringfencing?
  • JuniperMesos 5mo ago
    No, this is exactly what giving people second chances looks like. It means taking a risk that they're the sort of person who is likely to commit a crime and who will commit a crime again after being given the second chance. The only way to prevent this is to have a blanket policy against giving second chances to people convicted of crimes, which harms people who genuinely intend to reform and not commit crimes again, and who you cannot systematically distinguish from chronic criminals.
    • notahacker 5mo ago
      There are literally thousands of occupations a former computer based wire fraudster can be given a second chance in that aren't here's a computer full of sensitive government files, with CRUD privileges. Like... I think ex drugs dealer deserve a chance of legitimate employment, but perhaps doling out prescription drugs is best left to someone that doesn't need a "second chance" to demonstrate they're unusually trustworthy and unlikely to be tempted by the possible side incomes.
  • notahacker 5mo ago
    The fraud conviction seems totally inappropriate for a government contractor and yet... somehow totally appropriate for someone appointed to work directly for the upper echelons of federal government. Hell, everyone else hacking government officials emails and tax returns and randomly deleting stuff for the lolz in February 2025 was being paid by DOGE.
  • 5mo ago
• jongjong 5mo ago
  This makes sense but also an employee who is dishonest is also a security risk; fired or not. It's ridiculous that companies don't seem to care about ethics. They never seem to select candidates based on proven ethics. They don't even ask any such questions. For example, I've been in at least 2 situations where I had the ability to inflict major damage to companies which had treated me very poorly and I could have legally gotten away completely whilst doing variants of 'the wrong thing' and profiting but I didn't do it because I have principles. Unfortunately it seems that few people do nowadays. Leaders are fooling themselves if they think they can completely factor out ethics and make it all about aligning incentives. Incentive alignment creates its own problems as this alignment requires constant maintenance and it's both expensive and detrimental in the long run. These people will tend to sabotage every aspect of their responsibilities which isn't directly measured... In order to gain leverage. It's not clever. It's crooked. Should not be rewarded. My experience as a software developer is that managers alway have lots of blind spots and the wrong people will take advantage of all of them, even when it negatively impacts the company.
• zuzululu 5mo ago
  I'm just amused how these people were even hired to begin with ? They don't seem to be Americans? How were they even allowed to work on sensitive systems? Why was this even allowed? So many questions. At 4:58 pm, he wiped out a Department of Homeland Security database using the command “DROP DATABASE dhsproddb.” At 4:59 pm, he asked an AI tool, “How do i clear system logs from SQL servers after deleting databases?” He later asked, “How do you clear all event and application logs from Microsoft windows server 2012?” In the space of a single hour, Muneeb deleted around 96 databases with US government information.
  • jasonwatkinspdx 5mo ago
    I would imagine they lied about having a felony conviction on their job applications, and that for whatever banal reason any background check service they used didn't flag it, or the contractor was so grossly incompetent they didn't even check.
  • tradertef 5mo ago
    >> They don't seem to be Americans? How did you conclude that? Just their names?
    • nomilk 5mo ago
      [flagged]
      • netsharc 5mo ago
        If their names were Eric and Donald Jr., surely they wouldn't have been doing petty crimes like these two...
      • jszymborski 5mo ago
        These are not remotely indicators that someone is an American citizen.
        • nomilk 5mo ago
• Beestie 5mo ago
  I don’t know where to start with this other than to point out that there is no way in hell these two clowns had the security clearance necessary to access a prod DB at DHS. I can only assume they stole creds from another employee who had that level of clearance. Also, tax records are not stored in a DHS domain . I think this story has been sanitized to mask some details which is ok I guess but I ain’t buying the back story.
  • panflute 5mo ago
    I think prod db at DHS is an implication in the article while it is more likely that their employer hosted a minor SaaS which required DBs for various government department customers.
• glass1122 5mo ago
  [dead]
• nomilk 5mo ago
  > “Delete their filesystem as well?” he said. > “Smart idea,” said Muneeb. Seems obvious they weren't destroying databases just out of malice (i.e. retribution for being fired), but in order to cover up something/s..
• starkeeper 5mo ago
  Dude gets A++ on penmanship, seriously someone should make a font.
• nullorempty 5mo ago
  About 25 years ago we had layoff at a company I worked for. One of the DBA's got fired along with others. Back in the day they didn't revoke access and you had your work computer available until the end of the day. Most, who were fired, just packed and went on their way. The fired DBA however, stayed behind and finished backing up the databases he was assigned to backup. Once the job was done, he packed and left. True story!
  • skrebbel 5mo ago
    That seems… normal? I know several stories of people who got fired (or contracts not prolonged) who finished their task at hand, did some handover to colleagues, and then left.
    • danielxt 5mo ago
      I think that was his point
• loeg 5mo ago
  Dumb and dumber. Criminals just can't stop doing crimes (the password stuff, the gun stuff, etc, etc).
• xbar 5mo ago
  Hire ethical people.
• whatever1 5mo ago
  Oh no, the workers have power!
  • mordae 5mo ago
    My first thought. I was browsing comments to see if everyone from the US did their mandatory bootlicking and yes, they did. Of course they did. People are weird. Their government is strongarming half the world at the moment and they do not pause and go "wait, does this mean that if we unionize we can threaten to wipe all the databases unless?"
• michaelteter 5mo ago
  Asked for the plaintext password, and then his brother made a “ database query on the EEOC database and then provided the password”. I wonder how many government dbs store passwords in plaintext… Also, these guys sound like sociopaths. I bet some of their peers felt constant discomfort and threat just being near them.
• stogot 5mo ago
  These are the cases why I understand HR kicks people out immediately during a layoff. But then the employee cries inhumanity and desires that they have access for weeks, when they no longer need to. It’s a risk that’s proven unwise. Blame the layoff, not the access revocation
• eviks 5mo ago
  > it does follow from the simple fact that a fired employee with access to company systems is a security risk. No, employees that can wipe 96 databases are a security risk, even when they're employed. But of course it's easier to go the inhumane route of cutting everything off at employment end rather than fix it properly
• unixhero 5mo ago
  The handwriting was very solid.
• DeathArrow 5mo ago
  <In the US, fired and laid-off workers often have their digital credentials deactivated before they learn about the loss of their jobs; indeed, the inability to log in to a corporate system may be the first an employee knows of the situation. They still can install traps that detonates if they are fired. A simple cron job is enough to break havok.
• deleted 5mo ago
  [deleted]
• mianos 5mo ago
  I wonder if their stellar academic record is due to the same shenanigans? Given that they were caught manipulating logs and deleting evidence to cover their tracks in 2025, that they did the same to their academic records is technically plausible. In 2011, university systems like George Mason’s were significantly more vulnerable to the exact type of SQL injection and credential theft they were using in their early criminal years.
• p0w3n3d 5mo ago
  In my company there were layoffs recently. People had access to production database due to support requests, as we're a young company, so no least-privilege rules were applied yet. Nobody did anything bad. People knew what was going to happen, but no retaliation happened. First, I guess, to not have any problem with law, to pursue the next job without burdens. Things are traceable. Second, why? Why should I destroy my colleagues' work?
  • prmoustache 5mo ago
    Most criminals probably know they will get caught for their crimes and that there may be external or indirect casualties for their crime. Yet it doesn't stop them. Even in places and for crimes with death sentence. This is no different. If one day you can answer why and how to solve that I am pretty sure we would all be happy to know!
• throwaway27448 5mo ago
  Look the us government (and I'm sure many others) is so inept at basic software construction I can only view this as a good thing. I presume thousands previous penetrations were simply not so trivially detected.
• skrebbel 5mo ago
  Sidenote I love that the DHS prod DB is called “dhsproddb”.
• anaidenov 5mo ago
  Claude: drops production zone with the database and backups Meatbags: hold my beer...
• prmph 5mo ago
  Hmmmm: > After their stints in jail, the brothers worked their way back into the tech world. In 2023, Muneeb got a job with a Washington, DC, firm that sold software and services to 45 federal clients; Sohaib got a job at the same company a year later. How were they able to to easily work their way back into somewhat sensitive job, considering how much US companies make a big deal out of employing people with a criminal past? > The plaintext password of an individual who submitted a complaint to the Equal Employment Opportunity Commission’s Public Portal, which was maintained by the Akhters’ employer...Sohaib Akhter conducted a database query on the EEOC database and then provided the password to Muneeb Akhter. Why were the passwords being kept in plain text??
• pkphilip 5mo ago
  What a stupid move! way to make things worse for yourself! Some people have such low impulse control it is just unbelievable the sort of damage they can do to themselves and others.
• egorfine 5mo ago
  I was always curious how come firing a person is a risk in the US culture. Outside of the US it's almost never done like that and a person fired is expected to be cooperative and probably even continue working for another two weeks. And not only expected - this is what actually happens.
  • Loughla 5mo ago
    The fuck would I keep working for if I get fired? Give me my severance if it exists and let me go home that day to start looking for another job. Don't waste my time for 2 weeks to make sure your business doesn't experience any hiccups. If I'm so important that you cannot run without my knowledge, maybe you shouldn't fire me? That being said, burning everything down on your way out the door is absolutely not standard behavior in the US. Assholes are assholes though, no matter where they're from.
    • egorfine 5mo ago
      > burning everything down on your way out the door is absolutely not standard behavior in the US. Then why is the termination of employment always abrupt with absurd security measures in place including escorting people out of the building?
      • Loughla 5mo ago
        Why do you use anti malware on your computer or take vaccinations? Because safety, that's why.
• benj111 5mo ago
  "On Feb. 1, 2025, Muneeb Akhter asked Sohaib Akhter for the plaintext password of an individual" Why the hell were passwords being stored as plain text? I know approximately nothing about security, but even I face palmed at this.
• gabrieledarrigo 5mo ago
  I'll admit that I found the entire story quite hilarious...maybe a plot for next Guy Ritchie movie?
• alistairSH 5mo ago
  So many things wrong in that article. The first thing that struck me was the theft of another user's password. So, their employers (or the system they manage) keeps plain-text passwords in the database AND doesn't have any MFA in place? What the actual fuck? These seems like real assholes, but that whole company needs to be burned to the ground.
• jeffrallen 5mo ago
  > DROP DATABASE dhsproddb Lol. Heroes. (But only because of the DHS in the DB name. DHS is a vast hive of villainy.)
• raks619 5mo ago
  [dead]
• fuzzfactor 5mo ago
  Imagine how bad it would have been if they were triplets :)
• bunzee 5mo ago
  [dead]