Feeds

Fannie Mae logic-bomb saboteur convicted

Looking at wrong end of possible porridge ten-stretch

High performance access to file storage

A computer contractor has been convicted of planting a logic bomb on the servers of Fannie Mae, the financially troubled US housing and mortgage giant.

Rajendrasinh Babubhai Makwana, 36, responded to the termination of his two-year-long spell as a software development contractor at Fannie Mae in October 2008 by planting a malicious script designed to wipe all the data from its network on 31 January 2009. Anyone attempting to access data on the system after the logic bomb went off would have received the message "Server Graveyard".

Fortunately, Fannie Mae sysadmins found the malware days after Makwana left work at the Urbana, Maryland technology centre and weeks before the logic bomb was due to explode. Subsequent forensic analysis of computer logs traced the attempted attack back to Makwana's workplace laptop, which yielded more evidence. Because of his job developing software for Unix boxes, Makwana reportedly had access to the full range of Fannie Mae's 5,000 servers.

Even though Fannie Mae undoubtedly had back-up, the attempted attack would have been enormously disruptive and extremely costly - even if it was only partially successful deleting securities and mortgage data. Company representatives testified that it might take as long as a week to fully restore systems using off-site backups if the failed attack had been entirely successful in its malicious aims.

Makwana, who was convicted of computer sabotage and hacking offences punishable by a maximum of 10 years imprisonment by a jury, faces a sentencing hearing on 8 December.

An FBI statement on the case can be found here. Commentary on the practical implications of the attempted attack, and the lessons that might be drawn about the risk from disaffected workers, can be found in a blog post by Sophos here.

Fannie Mae (The Federal National Mortgage Association) and the smaller Freddie Mac (The Federal Home Loan Mortgage Corporation) either control or guarantee almost half of all home loans in the US. Shares in Fannie Mae plummeted as a result of the US sub-prime housing crisis but its operations continued thanks to access to low-interest loans and supportive statements from the federal government that its business was vital to the US housing market. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.