PDA

View Full Version : can someone pls answer this..about networking


hanadeka80
08-24-2008, 07:11 PM
San Francisco IT hack story looks a bit too much like Chinatown


Posted by: Zach Church
CIO, Midmarket CIO, Security, Media

What the hell is going on in San Francisco? It’s like a freaking detective novel out there all of a sudden.

One of the city’s top IT guys has been accused of locking other administrators out of the city’s new fiber wide area network (WAN).

Now he won’t give up the new password. He’s been arrested and in court. He is being held on a whopping $5 million bail and his lawyer says the accused – one Terry Childs – “loves kittens.”

Meanwhile, outside the halls of justice city officials run damage control. No, they say, no data has been compromised. But yes, they are not able to access the network. The mayor’s office and an IT official chime in that everyone is safe, nothing to see here. Mayor Gavin Newsom told the San Francisco Chronicle that Childs “got a bit maniacal.”

And all of a sudden Deep Throat appears, an anonymous city official telling the Chronicle that Childs is one hell of a bad seed. His bosses have wanted him out for ages now, the source breathes from an underground parking garage. His performance (a cigarette is dropped to the ground and screwed into the asphalt by a dress shoe-clad foot) was undoubtedly poor.

But is this the mother of all cover-ups? Childs’ lawyer, tireless public defender Mark Jacobs, thinks it might be.

“There’s someone out there that’s really scared of something, and I don’t know what it is,” Jacobs told a local TV station.

Childs was arrested Sunday. He was in court Monday but sans lawyer, pushing his arraignment to Tuesday. In comes Jacobs, fresh enough to the case to convince Superior Court Judge Paul Alvarado to postpone the whole thing until Thursday. That will give Jacobs time to chat with Childs and posit some arguments for why Childs should be set free while awaiting trial.

But it wasn’t enough to stop the $5 million bail. Prosecutors are arguing that Childs poses a major threat to public safety. Why?

Because he, and apparently only he, can access the city’s brand-spanking-new WAN network. It is the holding ground of emails, law enforcement records and payroll documents, as well as God knows what else, according to the Chronicle.

Childs, prosecutors say, has been having his way with the network for a few weeks now. His superiors caught on but not in time to find they had been shut out. Now the city has hired Cisco Systems to break back in.

The running story, as reported this morning by the Chronicle is that Childs was key in setting up the new WAN network. But, bizarrely, he began taking photographs of the IT department’s female head of security while she worked on a password audit for the system, authorities told the paper. Terrified, the woman locked herself in her office.

So Childs was arrested. Prosecutors say Childs wouldn’t give police the password, then gave them fake passwords. It doesn’t take much to imagine a slick, angry San Francisco detective (Nash Bridges?) banging his hands on an interrogation table and screaming “Give us the password!”

But no, Childs holds firm. Why?

According to DA Kamala Harris, possibly for no good reason at all.

“Motive is not necessarily an element of a crime,” Harris told reporters. Which is technically true, but it’s a little like saying music doesn’t require instruments. In all reasonable cases, we expect to hear some noise. And who the hell listens to a capella anyway?

But give Harris some leeway. She probably hasn’t gotten a complete grip on this mess yet. And who’s to say everything the city tells her is true? Apparently her and the mayor aren’t on the best of terms right now.

Here’s what we know about Terry Childs, 43, of Pittsburg, Calif.:

Childs’ official job title was network administrator in the City and County of San Francisco’s Department of Technology. His base pay, the Chronicle reports, is $126,735. Another $22,534 was tacked on last year because Childs is on call for emergency situations.

He was also arrested in Kansas in 1982 for aggravated robbery and aggravated burglary, according to the report. He received probation or parole until 1987 and disclosed the arrest to his bosses when hired in San Francisco five years ago.

He is now charged with four felony counts of network computer tampering and faces up to seven years in jail if convicted.

Childs is accused of locking a major American city out of its own network, which could make him a criminal. But it makes his bosses look like they should be the ones finding new jobs.

Oh, and he loves kittens.


1. What do you think will be the worst case scenario in this situation?
2. If you are one of the stakeholders, how will you handle the
situation?
3. What measure can you suggest to prevent similar situations in the
future?


thanks for the replies!!!:thumbsup:

borntoslow
08-25-2008, 01:08 PM
Im not sure what to make of that. Where di you hear this story? I would be surprised if this is the truth, certainly there has been a pinch of storytelling going on here.

There is no way that a network administrator would have full - and limited only to him -access to a nework of this size and also have the ability to lock out the whole system.

Im confused. Can you link a few news story sites about this. very amusing if true.

To answer question 3 though without any further info. Sack your IT department and hire people (at least one) who know how to break passwords.

hanadeka80
08-27-2008, 05:32 PM
Well here's the link where i get it:

http://itknowledgeexchange.techtarget.com/cio/san-francisco-it-hack-story-looks-%20a-bit-too-%20much-like-%20chinatown/

for the no.2 question..I agree to one of those comments given below the article. I’ll hire a team to crack the password. Its better doing nothing and wasting there time negotiating with Childs, over and over again and giving the wrong password. But still negotiations with the suspect will continue. Then I’ll run an employee check-up, making sure that my employees will not repeat what just happened. Not only what just happened but be an example to all that no man can ever succeed with a bad intention to others. And also reminding their jobs are suppose to be managing, keeping and securing data that’s what a network admin is.

and no.3:
To prevent this to happening in the future, I propose that password will consist of numbers and also letters. Also minimum of three persons knowing the passwords and I mean like the first three value of the password belongs to him, the other three is to him and the last is to him. I also suggest that phrases, birthdates or even familiar words are not to be treated as passwords. Look what happen to the article they let a person get away with the password. Terry Childs and only he know to crack all other important documents. What a mess..

GeoNOregon
09-08-2008, 10:52 PM
"There is no way that a network administrator would have full - and limited only to him -access to a network of this size and also have the ability to lock out the whole system."

Not necessarily. It depends on the tech-savviness of those in control of the IT program. A city council person or such could not have a clue. Maybe even a city mgr. It all depends on the previous IT Admins. IT admins DO have a reputation for being control freaks.

I read about this somewhere else - I think he's just a nut job.

If there was info he was trying to protect, he'd have the ability as the grand poobah of IT to be able to copy anything to an off-site location and wouldn't have to lock people out to 'protect' it.

borntoslow
09-09-2008, 10:08 AM
It is very rare for a network of this magnitude to have one sole administrator, also with the fact that that this is run by a beurocratic goverment department it is extremely unlikley. This is not a private network in a internet cafe.

i do agree though with Geo - he sounds like a nutter, he may well have been able to encypt all the data etc etc before he went but again, this would be a very easy task to take decrypt.

The hardest part of "hacking" any network is trying to get through a) unnoticed b) circumventing any protection on that network.

Taking the fact that neither of these are an issue in this case i cant see this taking more than a day to break. We are talking about the goverment here not some kid sitting in a basement with a desktop PC.

As for the taking the data offsite to protect it??? Its a network he has closed down not a database? If this was an issue though, all major companys/goverments back up there data on a regular basis to prevent this from happening. So unless he had access to a fleet of lorrys to take all the hard copies away...i find this hard to digest as well