News

10/10/2017
04:40 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Former Employee of Transcontinental Railroad Company Found Guilty of Damaging Ex-Employers Computer Network

Canadian Pacific Railway former employee convicted for causing intentional damage to Canadian Pacific's computer network.

Acting Assistant Attorney General Kenneth A. Blanco of the Justice Department’s Criminal Division and Acting U.S. Attorney Gregory G. Brooker of the District of Minnesota announced the conviction of a former employee of Canadian Pacific Railway for causing intentional damage to Canadian Pacific’s computer network.

Christopher Victor Grupe, 46, of Minneapolis, Minnesota, was charged on April 11, with one count of intentional damage to a protected computer and on Oct. 6, following a five-day trial, was found guilty by a federal jury in Minneapolis, Minnesota. A sentencing date has not been set.

As proven at trial, from September 2013 until December 2015, Grupe was employed as an IT professional by Canadian Pacific Railway (CPR), a transcontinental railroad company headquartered in Alberta, Canada, with U.S. headquarters in Minneapolis, Minnesota. On Dec. 15, 2015, following a 12-day suspension, Grupe was notified by CPR management that he was going to be fired due to insubordination. However, at his request, Grupe was instead allowed to resign, effective that same day. In his resignation letter, Grupe indicated that he would return all company property, including his laptop, remote access device, and access badges, to the CPR office.

As proven at trial, on Dec. 17, 2015, before returning his laptop and remote access device, Grupe used both to gain access to the CPR network’s core “switches” – high-powered computers through which critical data in the CPR network flowed. Once inside, Grupe strategically deleted files, removed administrative-level accounts, and changed passwords on the remaining administrative-level accounts, thereby locking CPR out of these network switches. Grupe then attempted to conceal his activity by wiping the laptop’s hard drive before returning it to CPR.

On Jan. 6, 2016, while trying to address a networking problem, the CPR network staff discovered that they were unable to access the main network switches. After CPR IT staff was able to regain access to the switches through a risky, but successful, rebooting procedure, they discovered evidence in logging data stored in the memory of the switches connecting the damage to Grupe. CPR hired an outside computer security company to identify the source and scope of the intrusion as well as conduct an incident analysis, which also connected the damage to Grupe.  In total, CPR experienced a financial loss of approximately $30,000 as a result of Grupe’s conduct.

This case is the result of an investigation conducted by the FBI Minneapolis field office, with assistance from the Cybercrime Laboratory of the Criminal Division’s Computer Crime and Intellectual Property Section.

Trial  Attorney Aaron R. Cooper of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Timothy C. Rank of the District of Minnesota are prosecuting the case.

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why CISOs Need a Security Reality Check
Joel Fulton, Chief Information Security Officer for Splunk,  6/13/2018
Cisco Talos Summit: Network Defenders Not Serious Enough About Attacks
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2018
Four Faces of Fraud: Identity, 'Fake' Identity, Ransomware & Digital
David Shefter, Chief Technology Officer at Ziften Technologies,  6/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8030
PUBLISHED: 2018-06-20
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 a...
CVE-2018-1117
PUBLISHED: 2018-06-20
ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this cou...
CVE-2018-11701
PUBLISHED: 2018-06-20
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x005cb509, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.
CVE-2018-11702
PUBLISHED: 2018-06-20
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578cb3, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.
CVE-2018-11703
PUBLISHED: 2018-06-20
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00402d6a, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.