Risk

4/28/2010
01:58 PM
50%
50%

Ex-IT Admin Convicted In San Francisco

The felony conviction could put former San Francisco network engineer Terry Childs in prison for up to five years for withholding passwords to the city's computer network.

A former San Francisco network engineer who refused to hand over computer passwords to the city network after he locked administrators out of it was convicted of a felony Tuesday.

A jury in the San Francisco Superior Court convicted Terry Childs, 45, of felony computer tampering, a crime for which he could face a two-to-five-year prison penalty, according to numerous public reports.

Childs has been in jail since 2008 after the city brought criminal charges against him for withholding passwords to San Francisco's main computer network.

System administrators were unable to access the network, even though city operations continued more or less as usual. After a tense 12-day standoff, Childs finally handed over the passwords to San Francisco Mayor Gavin Newsom from his jail cell.

Supporters characterized the case as a workplace dispute gone wrong, while prosecutors painted Childs as a super-user gone rogue who maliciously aimed to wreak havoc on the city networks. A super user is a colloquial term for network administrators that have the highest security clearing to access to even a company's most secure networks.

In a public interview last year, Childs defended his actions and said they were in line with standard network security practices.

The jury in the case deliberated for three days before handing down the guilty verdict.

One database security expert said the case and Childs' conviction is a wake-up call for companies and organizations that don't properly monitor the activity of super users.

"The issue is that if you are trusted with that type of power, there have to be checks and balances in place -- the concept of 'trust but verify,'" said Phil Neray, vice president of security strategy at Guardium, an IBM Company. Guardium specializes in database security.

He said in this case, Childs was able to change passwords and lock other administrators out of the network before they even knew he was doing it. This would not have happened if the city was monitoring the activity of its system administrators, Neray said.

"They would have created an alert and the security team would have gone in and asked, 'Why did you do this?'" he said.

State, local and the federal governments especially don't have this type of monitoring in place because of budgetary limitations, Neray added.

The federal government is slow to adopt the latest security technologies as well, which also makes them more susceptible to this type of activity, he added.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Malware Incidents Hit 100% of Businesses
Dawn Kawamoto, Associate Editor, Dark Reading,  11/17/2017
3 Ways to Retain Security Operations Staff
Oliver Rochford, Vice President of Security Evangelism at DFLabs,  11/20/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.