A community for discussing events around the World
Rule 1: posts have the following requirements:
Rule 2: Do not copy the entire article into your post. The key points in 1-2 paragraphs is allowed (even encouraged!), but large segments of articles posted in the body will result in the post being removed. If you have to stop and think "Is this fair use?", it probably isn't. Archive links, especially the ones created on link submission, are absolutely allowed but those that avoid paywalls are not.
Rule 3: Opinions articles, or Articles based on misinformation/propaganda may be removed. Sources that have a Low or Very Low factual reporting rating or MBFC Credibility Rating may be removed.
Rule 4: Posts or comments that are homophobic, transphobic, racist, sexist, anti-religious, or ableist will be removed. “Ironic” prejudice is just prejudiced.
Posts and comments must abide by the lemmy.world terms of service UPDATED AS OF 10/19
Rule 5: Keep it civil. It's OK to say the subject of an article is behaving like a (pejorative, pejorative). It's NOT OK to say another USER is (pejorative). Strong language is fine, just not directed at other members. Engage in good-faith and with respect! This includes accusing another user of being a bot or paid actor. Trolling is uncivil and is grounds for removal and/or a community ban.
Similarly, if you see posts along these lines, do not engage. Report them, block them, and live a happier life than they do. We see too many slapfights that boil down to "Mom! He's bugging me!" and "I'm not touching you!" Going forward, slapfights will result in removed comments and temp bans to cool off.
Rule 6: Memes, spam, other low effort posting, reposts, misinformation, advocating violence, off-topic, trolling, offensive, regarding the moderators or meta in content may be removed at any time.
Rule 7: We didn't USED to need a rule about how many posts one could make in a day, then someone posted NINETEEN articles in a single day. Not comments, FULL ARTICLES. If you're posting more than say, 10 or so, consider going outside and touching grass. We reserve the right to limit over-posting so a single user does not dominate the front page.
We ask that the users report any comment or post that violate the rules, to use critical thinking when reading, posting or commenting. Users that post off-topic spam, advocate violence, have multiple comments or posts removed, weaponize reports or violate the code of conduct will be banned.
All posts and comments will be reviewed on a case-by-case basis. This means that some content that violates the rules may be allowed, while other content that does not violate the rules may be removed. The moderators retain the right to remove any content and ban users.
News [email protected]
Politics [email protected]
World Politics [email protected]
For Firefox users, there is media bias / propaganda / fact check plugin.
https://addons.mozilla.org/en-US/firefox/addon/media-bias-fact-check/
He didn't hack anything. He used a password that wasn't changed.
Which was also used repeatedly over the course of 3-4 months to gain access via a non-corporate laptop without the IT doing anything about it.
Yeah that seems pretty negligent on their part.
I've been in IT for a few years and I've changed companies a few times. I just checked my login creds for various systems of 3 previous employers and like half of them still work. Unfortunately it's a lot more common than any IT department would like to admit
It’s only hacking if it’s in a CVE.
Anything else is just sparkling unauthorized access.
That's just not true.
Technically he was not authorized to use the computer system due to his termination which the law looks at and calls hacking.
No, the law specifically called this "unauthorized access to computer material". It's right there in the article.
He also didn't delete servers
That might be slightly illegal.
That person might be slightly doomed.
Companies need to remember to change the login password BEFORE firing people with login passwords.
One man IT shop maybe? Usually stuff like that goes through IT, because who in their right mind would give HR modify access to active directory?
Read the article.
As a former user of "the other site", I find this suggestion highly offensive /s
Generally a firing is decided the previous day or at least an hour before it happens. Discussions are made prior to the actual meeting where the firing occurs. IT is on standby. They either deactivate the AD account and related auth methods when the employee walks in the office to have the discussion. This is a well oiled machine, so that all parties know their parts. The meeting/discussion is solely a formality and by two minutes into it, theres no longer any access granted. Security shows up at the meeting to escort the employee out and collect their badge or keys. Maybe they let the employee walk by their desk to collect their stuff, maybe the employer ships it to them later, depends on the circumstances and office layout.
At my last job I was informed that I'd be terminated, then had to work normally for another month (the termination period), where I still had full domain admin access to all our own and our customers' systems.
On my last day I myself had to write down a list of all the logins I had and give that to my boss, because no one else knew what accesses I even had.
During the last hour I wiped my own company PC and gave back all hardware I was given. Again, there wasn't any record of what I was given over the years so they took my word for it. This included unencrypted USB drives with sensitive medical data on them.
In well-run orgs, yes. Most places are not well-run.
I mean kind of depends. I got a soft layoff so worked 6 months more and got 3 months pay for the transfer to India.
I think best practices for highly secure environments is at the time of notice you lock the account and give that person 2 weeks off.
Most normal company’s it’s cool work till your last day, do your exit interview and we lock your account on Friday afternoon or Monday
Also you never want to change someone’s password on termination. What if their login is running some business critical tasks? Not best practices but I can tell you it happens a lot especially for reporting. If you lock the account you can always just reenable it and work to fix the issue
Last year, I tried my admin creds at my old job and it still worked. I was afraid of retaliation so I sent them a message from a throwaway email about changing their passwords.
NCS is a company that offers information communication and technology services.
Wait…
he used his laptop to gain unauthorised access to the system using the administrator login credentials.
Okay, what the guy did was immature and shitty, but holy hell this company is incompetent. How did their own internal IT not lock him out of anything even remotely sensitive the moment he was fired?
Probably HR (or the NCS equivalent) never told the right people. I am not saying this is actually what happened, but a lot of IT bemoan the fact they are never told some rando employee was fired because HR neglects to inform them. Sometimes it takes months to discover, and even with a 90 day password/login lockout, some halfway decent admin could get around this by secretly building a back door, and using the messed up communication and politics between departments to hide this. Even in the 1990s, I saw people put in "time bombs" in their code that "if such and such is not updated in 6 months, run destructo-script A."
But imagine someone like Kandula Nagaraju here. Worked in QA, probably did a great jobs with some skills, but had the personality of swallowing broken glass. He was terminated in October 2022 due to "poor work performance," which could mean anything. "Not a team player." Or maybe he really was an idiot: I mean, a smart person would have a conniption, but get employed elsewhere and then slam his former company at parties. "Those NCS folks didn't know what they had with me!" But this guy was probably someone with some anger management issues, probably a jerk, and possibly stupid. He might have had revenge fantasies, and set up a small virtual server posing as a backup code mirror. But outside the audits, it allowed ssh from the outside, and hid it through a knockd daemon. Or maybe only launched ssh at certain hours before shutting it down again. Silently working away in a sea of virtual servers with little to no updated documentation. He gets in, has internal access, and runs a script with admin credentials because they don't rotate their AWS keys/secrets quickly enough. Or didn't even know he was let go.
After Kandula's contract was terminated and he arrived back in India, he used his laptop to gain unauthorised access to the system using the administrator login credentials. He did so on six occasions between Jan 6 and Jan 17, 2023.
That's embarrassing to the company. Not only did he get in, but SIX TIMES after he was let go. he probably knew what order to run the delete commands (like, say, an aws "terminate-instances" cli command from a primary node), and did so one by one, probably during hours with the least amount of supervision, where the first few alerts would take hours to get someone in the monitoring chain to wake an admin. Given his last day was in November, and he got back in January, the admins probably thought their 90 access credential rotation was "good enough," but he got in on his 80th day or whatever.
I know this because I have had to do triage when a former contractor did this to a company I worked for. But instead of wiping out instances, he opened a new set of cloud accounts from the master account, put them in an unmonitored region (in this case, Asia), and spun up thousands of instances to run bitcoin mining. Only because AWS notified us of "unusual traffic" were we made aware at all, and this guy knew his shit and covered his tracks very well. He did it at a speed that could have only been automated. Thankfully, AWS did not charge us the seven figure amount that this activity amassed in just three days.
I've had people above me fired in a startup and I was asked by the board of the company to lock their accounts and seize their professional laptops while they were in a meeting informing them they were fired.
The idiots had tried to stage a "coup" against the CEO which failed spectacularly.
in my org it's a single process to deprovision someone of access to all tools including home devices.
If its the NCS (National Computer Systems) that was bought by Pearson a few years ago, then what they sell is the hardware/software that reads all the "fill in the circle with a #2 lead pencil" forms.
I'm going to take a guess this is the guy that removed access from fired people under hr request, for $999.999
Company deserved it if they didn’t have backups and didn’t change the admin passwords
Question. Where does this "value" come from? Loss of business? Downtime? Labor loss due to people unable to work? Pull a number out of a hat?
These servers had no production data on them. Ideally with a proper DR solution you just restore and presa charges.
I would guess man hours.
Because it's going to take time to put those servers back in production. Depending what they did it might have causing outage to external facing customers, which will have a higher impact than internal facing. But with that amount of money, it actually seems fairly low to me so I'm guessing they weren't public facing servers.
So it was probably the time that it takes to recreate all those servers get everything back up and running, and delayed work caused by the outage.
That's just my guess though
As an armchair economist, lots of things. Loss of money from workers standing around unable to do their jobs because of the technical issues, the cost of doing a restore from backup (technician time, extra help, direct costs of accessing the data), etc. Opportunity costs from having to send business away, or otherwise unreasonably delay taking/delivering orders that have either been given to competitors or cancelled because of the issues.
Even the dang electricity costs of keeping the lights on while waiting for a fix...
Large companies calculate this value as a "burn rate", which is to say, how much is it directly or indirectly costing to have everyone here, ready to work, and unable to do so because of an issue that affects everyone. Usually measured in dollars per hour. So if their burn rate is 100k/hr, and it takes 10 hours to fix the problem, it's ~$1M in losses.
They may be able to recoup some of those losses by adding an extra shift or granting overtime to catch up, but for the most part, a large percent of that money is simply gone.
That's pretty god. Our fired employee just logged into the wifi from outside and changed the status on every helpdesk ticket to "Paul is a nob".
They will think twice before fire someone else. Well done