ganeshran Posted January 16, 2013 Posted January 16, 2013 :hysterical::hysterical::hysterical: http://www.theregister.co.uk/2013/01/16/developer_oursources_job_china/?utm_source=dlvr.it&utm_medium=twitter A security audit of a US critical infrastructure company last year revealed that its star developer had outsourced his own job to a Chinese subcontractor and was spending all his work time playing around on the internet. The firm's telecommunications supplier Verizon was called in after the company set up a basic VPN system with two-factor authentication so staff could work at home. The VPN traffic logs showed a regular series of logins to the company's main server from Shenyang, China, using the credentials of the firm's top programmer, "Bob". "The company's IT personnel were sure that the issue had to do with some kind of zero day malware that was able to initiate VPN connections from Bob's desktop workstation via external proxy and then route that VPN traffic to China, only to be routed back to their concentrator," said Verizon. "Yes, it is a bit of a convoluted theory, and like most convoluted theories, an incorrect one." After getting permission to study Bob's computer habits, Verizon investigators found that he had hired a software consultancy in Shenyang to do his programming work for him, and had FedExed them his two-factor authentication token so they could log into his account. He was paying them a fifth of his six-figure salary to do the work and spent the rest of his time on other activities. The analysis of his workstation found hundreds of PDF invoices from the Chinese contractors and determined that Bob's typical work day consisted of: 9:00 a.m. Arrive and surf Reddit for a couple of hours. Watch cat videos 11:30 a.m. Take lunch 1:00 p.m. Ebay time 2:00-ish p.m Facebook updates, LinkedIn 4:30 p.m. End-of-day update e-mail to management 5:00 p.m. Go home The scheme worked very well for Bob. In his performance assessments by the firm's human resources department, he was the firm's top coder for many quarters and was considered expert in C, C++, Perl, Java, Ruby, PHP, and Python. Further investigation found that the enterprising Bob had actually taken jobs with other firms and had outsourced that work too, netting him hundreds of thousands of dollars in profit as well as lots of time to hang around on internet messaging boards and checking out the latest Detective Mittens video. Bob is no longer employed by the firm.
DomainK Posted January 16, 2013 Posted January 16, 2013 Someone can open an outsourcing company for salaried people - pay half your salary and get your work done from India while you spend your time on FB.
Raghav_12 Posted January 16, 2013 Posted January 16, 2013 Company should learn and start doing outsourcing by themselves.
urbestfriend Posted January 16, 2013 Posted January 16, 2013 I don't outsource yet I follow the same schedule like 'bob'.
velu Posted January 16, 2013 Posted January 16, 2013 US employee 'outsourced job to China' A security check on a US company has reportedly revealed one of its staff was outsourcing his work to China. The software developer, in his 40s, is thought to have spent his workdays surfing the web, watching cat videos on YouTube and browsing Reddit and eBay. He reportedly paid just a fifth of his six-figure salary to a company based in Shenyang to do his job. Operator Verizon says the scam came to light after the US firm asked it for an audit, suspecting a security breach. According to Andrew Valentine, of Verizon, the infrastructure company requested the operator's risk team last year to investigate some anomalous activity on its virtual private network (VPN) logs. "This organisation had been slowly moving toward a more telecommuting oriented workforce, and they had therefore started to allow their developers to work from home on certain days. In order to accomplish this, they'd set up a fairly standard VPN concentrator approximately two years prior to our receiving their call," he was quoted as saying on an internet security website. The company had discovered the existence of an open and active VPN connection from Shenyang to the employee's workstation that went back months, Mr Valentine said. And it had then called on Verizon to look into what it had suspected had been malware used to route confidential information from the company to China. "Central to the investigation was the employee himself, the person whose credentials had been used to initiate and maintain a VPN connection from China," said Mr Valentine. Further investigation of the employee's computer had revealed hundreds of PDF documents of invoices from the Shenyang contractor, he added. The employee, an "inoffensive and quiet" but talented man versed in several programming languages, "spent less than one fifth of his six-figure salary for a Chinese firm to do his job for him", Mr Valentine said. "Authentication was no problem. He physically FedExed his RSA [security] token to China so that the third-party contractor could log-in under his credentials during the workday. It would appear that he was working an average nine-to-five work day," he added. "Evidence even suggested he had the same scam going across multiple companies in the area. All told, it looked like he earned several hundred thousand dollars a year, and only had to pay the Chinese consulting firm about $50,000 (Ž£31,270) annually." The employee no longer worked at the firm, Mr Valentine said. :hatsoff: SRC
yoda Posted January 16, 2013 Posted January 16, 2013 I don't outsource yet I follow the same schedule like 'bob'. :giggle:
coffee_rules Posted January 16, 2013 Posted January 16, 2013 The FedEx of RSA is the best part! He could have setup a tunnel with the contractor and used a software version of the RSA on this machine for the contractor to use to login to the server from his m/c or use the same proxy his m/c us using.. If he thought of the while thing he could have closed this loop as well.
Crookbond Posted January 16, 2013 Posted January 16, 2013 He could have setup a tunnel with the contractor and used a software version of the RSA on this machine for the contractor to use to login to the server from his m/c or use the same proxy his m/c us using.. If he thought of the while thing he could have closed this loop as well. Yes - and that would have been detected as well. It is not easy to setup secure tunneling in corporate organizations. Most secure IT systems wouldn't allow you to.
Trichromatic Posted January 16, 2013 Posted January 16, 2013 Noobish idea, just set up a computer at home and allow direct access to that computer?
Clarke Posted January 16, 2013 Posted January 16, 2013 This 'critical' infra company has ghatiya security guidelines. You don't allow access from every damn external host to your servers just because you got 2 factor authentication.
ganeshran Posted January 16, 2013 Author Posted January 16, 2013 This 'critical' infra company has ghatiya security guidelines. You don't allow access from every damn external host to your servers just because you got 2 factor authentication. A lot of people work from home and travel as well so blocking access based on IP is out of the question for most companies. That was the reason two factor authentication and VPN were introduced in the first place - to facilitate secure access from any network
Clarke Posted January 16, 2013 Posted January 16, 2013 A lot of people work from home and travel as well so blocking access based on IP is out of the question for most companies. That was the reason two factor authentication and VPN were introduced in the first place - to facilitate secure access from any network Its recommended to use company assets (i.e. laptop) for professional purposes which are scanned regularly for threats. Allowing access to any host in the world is a dangerous proposition as observed here. Even in the case of actual offshoring, one should limit access to the offsite vendor's IPs.
The Outsider Posted January 16, 2013 Posted January 16, 2013 A lot of people work from home and travel as well so blocking access based on IP is out of the question for most companies. That was the reason two factor authentication and VPN were introduced in the first place - to facilitate secure access from any network VPNs can be configured to allow connections only from specific countries. My companies' VPN does not work outside the US except with special authorization for the account. True, one can still use proxies, but as a first shield this simple configuration is used in a lot of organizations.
Malcolm Merlyn Posted January 16, 2013 Posted January 16, 2013 IT people here:facepalm: Discussing how to breach and increase security.No doubt we are an IT powerhouse.
Recommended Posts