Cloud engineer wreaks havoc on bank network after getting fired
- Reference: 1702410193
- News link: https://www.theregister.co.uk/2023/12/12/cloud_engineer_bank_prison/
- Source link:
Miklos Daniel Brody, 38, of San Francisco, pleaded guilty in April to two charges of violating the Computer Fraud and Abuse Act after obtaining information from and intentionally damaging a protected computer, and one charge of making false statements to a government agency.
In addition to spending two years behind bars, the judge ordered Brody to pay $529,266.37 in restitution and serve three years of supervised release after he's out of jail.
[1]
Brody worked as a cloud engineer for First Republic Bank until March 11, 2020, when he was fired for violating company policy. Earlier that month, the bank's infosec team received a notification that Brody had used one of his company-issued computers for non-work purposes, allegedly plugging multiple flash drives into the laptop, and downloading files, some of which contained pornography.
[2]
[3]
This prompted a meeting with the bank's VP of human resources, and during that conversation Brody allegedly claimed friends gave him the USB drives that he thought contained the movie "The Matrix," and all he did was unwittingly plug them into his computer.
The following day, March 11, 2020 Brody sent a rambling email to the VP, according to court documents
[4]PDF
. Here's a snippet, as written:"I'm not certain if it still matters, but I wanted to emphasize that I didn't store any inappropriate content on FRB media/devices, ever. I don't have anything to hide about previously visited websites or emails either, or any files on both FRB laptops. My sole intent was to watch a movie and then fall back asleep, and maybe view& copy previous FRB event pics to my USB – which I never did – I stopped myself from doing. I still have those on my shared FRB drive to this very day. The problem started when I couldn't find the movie what I was looking for, I wasn't even aware that those USBs could contain inappropriate content. They weren't even my USBs, they were my friends', but I'm taking full responsibility for them. The mistake I made during being sick is I started to organize the content, separating the bad stuff from the good stuff (that's why you see mostly "move" commands in the infosec report), so that I don't need to use the tainted USB ever. I did the organizing on Sunday and Monday when I was sick, I wish I didn't, but me being sick clouded my judgement at the time, and it didn't occur to me that that could be a violation too – even without moving actual content on FRB device."
Those excuses did not work, and later that day, Brody was fired during another meeting with bank executives and escorted off the premises. His bosses had asked him to bring his company-issued MacBook to the meeting, but he did not, so they told him to return it via mail.
But instead of doing that, Brody allegedly went home and that evening wreaked havoc on First Republic Bank's network in retaliation for getting canned, according to court documents. after more than two hours before his credentials were revoked.
[5]
"Once Brody accessed the FRB computer system through the VPN connection, he connected to FRB's protected Jumpboxhost server "Jumpbox." This enabled him to access the code repositories in the "Devbox" and "Github," the complaint alleges.
He allegedly deployed malware and left code-related "taunts" for his former co-workers, deleted code repositories and computer logs, "broke" Ansible Tower, locked users out of one of the bank's Amazon services, damaged "multiple areas" of the IT environment, and emailed himself proprietary bank code that he had worked on and was valued at more than $5,000.
While Brody logged in with his own ID and multi-factor password, he also impersonated a coworker, "senior cloud engineer A.A," who had received a promotion that, it's claimed, Brody "coveted." A.A confirmed that they had not accessed the system at that time.
[6]
According to the bank's estimates, the total damage exceeded $220,000.
[7]Rogue ex-Motorola techie admits cyberattack on former employer, passport fraud
[8]'Serial cybercriminal and scammer' jailed for 8 years, told to pay back $1.2M
[9]Interpol moves against human traffickers who enslave people to scam you online
[10]BlackCat ransomware crims threaten to directly extort victim's customers
After discovering the digital break-in, the bank's HD department called Body and demanded he surrender his computer. Brody didn't, and in an email to the bank said:
"You guys and frankly FRB left me in a financial hardship situation in the middle of the corona virus outbreak with this sudden termination and no severance package. In my opinion this is especially harsh and cruel given my ~2 years of service and hard work with good faith and excellent performance."
Over the next days and weeks, Brody allegedly came up with several more excuses as to why he couldn't return the bank-issued device, including filing a false police report with the San Francisco Police Department claiming the laptop had been stolen from his car while he was working out at the gym.
Brody then doubled down on that false allegation in statements he made to US Secret Service agents. He later admitted making false statements about the company-issued laptop in his guilty plea.
At his sentencing hearing, the judge determined the total cost to the bank's systems was least $220,621.22. It would have so much easier, and cheaper, to simply lock down the account as they left the building, but it seems some folks still haven't got that message. ®
Get our [11]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZXjmGbqyarm8@WmTbeWDRwAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZXjmGbqyarm8@WmTbeWDRwAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZXjmGbqyarm8@WmTbeWDRwAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://regmedia.co.uk/2023/12/12/complaint_miklos_daniel_brody.pdf
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZXjmGbqyarm8@WmTbeWDRwAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZXjmGbqyarm8@WmTbeWDRwAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/11/30/rogue_exmotorola_tech_pleads_guilty/
[8] https://www.theregister.com/2023/11/28/serial_cybercriminal_and_scammer_sentenced/
[9] https://www.theregister.com/2023/12/12/interpol_cyberscam_trafficker_action/
[10] https://www.theregister.com/2023/12/05/alphvblackcat_shakes_up_tactics_again/
[11] https://whitepapers.theregister.com/
Re: Amazing!
Totally agree with the sentiment, but would add that common sense also appears not to be taught in business executive school: if you're going to fire someone with elevated network privileges, you make damn sure you disable their access when you escort them from the building. Especially if they have already demonstrated a degree of ratbaggery.
Still, as one trainer in my first aid course commented years ago: "common sense isn't actually that common".
Re: Amazing!
Never mind when you escorts them from the building, their account wants to be disabled the second you make that decision, before/as you call them into the room
Re: Amazing!
Yes, expect ex-employee to use credentials that haven't been revoked. But revoking those is not enough. He also had the credentials of co-worker "A.A.". I'm sure that's contrary to bank policy, but it's a common way to "just get things done".
Also expect ex-employee to use a laptop that hasn't been returned. Prepare for that, and have a way to disable the laptop's access to the network.
If that preparation hasn't been done, it's _The Art of War_ : "The basis of all warfare is deception."
Don't tell the employee to come to work for an important meeting. Tell the employee they are on probation and need to work in the office until further notice. (If they have Covid, tell them they will get a private location as an accomodation.) If they show up without the laptop, ask them how they expect to work without it, and tell them to go get it. *Then* call them to the important meeting.
Re: Amazing!
This. But then again, this is First Republic Bank... One of those weird banks that went pop in the space of a week or two earlier this year (or was it 2022?) and had to be gobbled up by JPMorgan to stay 'afloat'. I bet the JPMorgan folks weren't impressed...
Re: Amazing!
No no, you have that all wrong!
It says: "allegedly plugging multiple flash drives into the laptop, and downloading files, some of which contained pornography. "
Downloading FROM the laptop to his USB stick! They came with porn pre-loaded, prolly for those boring meetings!
This man needs some help
This is an extreme reaction to say the least.
Obviously it's a security oversight, but this as reported is complete madness.
By nature of the role, I have elevated access across customers, and various accounts. It's such a violation of trust and professional ethics.
I can't imagine the chain of events which led to such self-immolation.
Some people are so stupid
Why would he use a work laptop for that sort of thing? Obviously he could afford a personal laptop/PC, and he could peruse all the porn he could ever want without any issues had he been willing to part with the $400 or so a laptop would have cost!
Credentials after leaving
I don't even know how many time's I've left a place and still had my access available to me. Even remote access, to customer networks with admin level access. I've even contacted previous employers and asked them to revoke my access to avoid the possibility of any unpleasantness.
I suppose there's a few differences here:
I'm not a dickwit (open to debate)
I don't want to get caught and go to prison.
Thing is ANYONE who has ever accessed anything at greater than a user level would know that there's at least a log of a successful login happening. Do stuff like this you get what you deserve.
"Brody worked as a cloud engineer for First Republic Bank"
And he'll have the rest of his life to reminisce fondly about that while flipping burgers.
No pity. You get fired, you go. You don't touch your former employers' network or anything else. You want revenge ? Tell everyone you know that you unfairly dismissed - whether it is true or not.
Now, the only thing everyone knows is that he watches porn on the job and abuses his knowledge to wreak havoc when being caught.
He'll never work in a bank again, that's for sure, and there's a good change he'll never be in an IT position ever again.
And he doesn't deserve to be. Not for a long time.
Amazing!
I am astounded that an IT professional, who is presumably reasonably well paid and would claim to have far superior computing knowledge and skills than the average 'Luser", is sufficiently stupid as to view porn on the company laptop.
Surely he could have afforded to buy himself a cheap personal chrome book or laptop for this purpose and avoided the entire mess he's now in? He's basically destroyed his career in order to save $200~$300, or there abouts. Do they not teach common sense at IT school?