When Jurassic Park meets City Hall

[unixronin]

Remember the annoying, slimy hacker in Jurassic Park?  Seems the City of San Francisco has a very similar problem.

Prosecutors say Childs, who works in the Department of Technology at a base salary of just over $126,000, tampered with the city's new FiberWAN (Wide Area Network), where records such as officials' e-mails, city payroll files, confidential law enforcement documents and jail inmates' bookings are stored.

Childs created a password that granted him exclusive access to the system, authorities said. He initially gave pass codes to police, but they didn't work. When pressed, Childs refused to divulge the real code even when threatened with arrest, they said.

Unfortunately, it's probably too much to hope for that this one will get eaten by spitting dinosaurs (or any other kind, for that matter).

Comments

[n5red.livejournal.com]

They have access to the hardware, but they can't reset the passwords. Yeah, right. Maybe that's why he was making $150K/year as a government employee.

[unixronin.livejournal.com]

I wondered about that part myself. Probably part of the same reason he got away with it in the first place.

[robbat2.livejournal.com]

It's certainly possible to build a system that does lockouts on the common attacks (think encrypted disk w/ boot password for decrypt). Furthermore, some network hardware only has a full-scale reset switch, no other way around the password system - either you reset and lose the config, or you find the password. This is useful for protecting the gear against a lot of attacks where you want the data in the device (think IPSec PSKs and SSL keys). The only attacks to recover the data in that case come down to desoldering the flash/nvram and hoping you don't wipe it accidently with ESD in the process.

The other articles note that the system is still operational, they just don't have admin access to it anymore - and downtime to hack it would probably be expensive than most hackers. I'd do it for $500/hr.

[glitch25.livejournal.com]

further reading of the article talked about spending millions of dollars to restore the administrators access.

Little do they know that all it would really take is a hacker, a case of hot pockets, and several seasons of Xena, and they'd have them all fixed up.

[blackcoat.livejournal.com]

Well...130.

And, for a senior admin, that's not a whole hell of a lot around here.

[n5red.livejournal.com]

Plus some serious bonuses.

[blackcoat.livejournal.com]

actually, from what I know, that's why (esp local to Bay Area) gov make such good salaries. No real bonus structure. No stock options. Good(ish) benefits.

In order to be competitive, they HAVE to lay down big bucks.

[unixronin.livejournal.com]

He evidently didn't think so.

'Course, one of my reasons for leaving one former employer was, shall we say, compensation not in accordance with responsibilities of the position. (Further, deponent saith not.)

[randwolf.livejournal.com]

Lovely. Oh, just lovely. Want to bet he's been selling information to criminals on the side, too?

[unixronin.livejournal.com]

I believe the article did mention that speculation, and that he may even have been selling access to the systems.