Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

San Francisco Computer System Hijacker Has Criminal Record

The computer engineer remains in jail, refusing to divulge the password he created to lock up the city government's computer system.

A San Francisco computer engineer arrested for allegedly locking out system administrators from the city's network has a criminal record for aggravated robbery in another state.

In addition, Terry Childs, 43, of Pittsburg, Calif., is still being paid his six-figure salary while he sits in jail, refusing to divulge the password he created to hijack the computer system that stores 60% of all city government data, including e-mails, law enforcement records, and payroll documents, the San Francisco Chronicle reported Wednesday.

Childs was arraigned Tuesday in San Francisco Superior Court on four felony counts of computer tampering. He was being held Wednesday in lieu of $5 million bail.

Childs, who works for the city's technology department, is accused of locking out other system administrators after they started asking questions about a run-in he had with the department's head of security. The suspect has refused to divulge the password that would unlock the system, which remains operational.

"There's nothing to be alarmed about, save the inability to get into the system and tweak the system," San Francisco Mayor Gavin Newsom told the newspaper. "Nothing dramatic has changed in terms of our ability to govern the city."

That, however, could change if there were a major crash of the inaccessible FiberWAN (wide area network) that Childs helped build. The city has brought in experts from Cisco Systems to help break into the system. If that's unsuccessful, then the city may have to rebuild it at an uncertain cost. The process would take up to eight weeks, Newsom said.

In the meantime, Childs remains mum and is being paid his $127,735-a-year salary while sitting in jail. Ron Vinson, chief administrative officer for the technology department, said that's standard procedure until there's a hearing to determine whether Childs should be placed on unpaid leave. That hearing could take place as early as Thursday.

The Chronicle also reported on Wednesday that Childs has a 25-year-old felony criminal record in Kansas, where he was convicted of aggravated robbery and aggravated burglary stemming from charges filed in 1982. Childs was on probation or parole until 1987, according to records uncovered by the newspaper. Childs had disclosed the felony conviction when he applied for the San Francisco job five years ago.

Childs had been highly regarded in the technology department until he became a "rogue employee that got a bit maniacal," Newsom said.

"He was very good at what he did, and sometimes that goes to people's heads," the mayor said. "And we think that's what this is about."

Childs' problems with the department got serious June 20 when he started taking photographs of the agency's new head of security after she began an audit of who had password access to the system, the newspaper said. Childs' frightening behavior prompted the woman to lock herself in an office

His supervisors' concerns grew when they discovered he had given himself exclusive access to the system and had developed a way to spy on his bosses' e-mails related to his conduct. Childs was ordered to leave work July 9 for alleged insubordination.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Tor Weaponized to Steal Bitcoin
Dark Reading Staff 10/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18218
PUBLISHED: 2019-10-21
cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write).
CVE-2019-18217
PUBLISHED: 2019-10-21
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.
CVE-2019-16862
PUBLISHED: 2019-10-21
Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter.
CVE-2019-17409
PUBLISHED: 2019-10-21
Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter.
CVE-2019-10715
PUBLISHED: 2019-10-21
There is Stored XSS in Verodin Director before 3.5.4.0 via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages.