[ISN] PaineWebber Systems Admin Faces Trial For Computer Sabotage

[InfoSec News]

http://www.informationweek.com/security/showArticle.jhtml?articleID=188700855

By Sharon Gaudin 
InformationWeek 
Jun 1, 2006 

A former systems administrator for financial giant UBS PaineWebber
goes on trial Tuesday for allegedly sabotaging two-thirds of the
company's computer network in what prosecutors say was a vengeful
attempt to profit from a crashing stock price.

Roger Duronio, 63, of Bogota, N.J., is facing federal charges in front
of a U.S. District Court in Newark, in connection to the creation and
planting of malicious code on more than 1,000 computers in the
company's central office, as well as in approximately 370 branch
offices. When the malicious code, or "logic bomb," was triggered on
March 4, 2002, it began deleting files and data, taking down many
PaineWebber computers across the United States and hindering trading
for days in some branch offices and for several weeks in others,
according to Assistant U.S. Attorney Mauro Wolfe, lead prosecutor on
the case.

The attack, according to the indictment, cost UBS PaineWebber, which
was renamed UBS Wealth Management USA in 2003, $3 million just to
assess and repair the damage. The company didn't submit a list of
losses to the government based on business downtime or lost trading
opportunities.

Chris Adams, Duronio's defense attorney and a partner at Walder Hayden
& Brogan in Roseland, N.J., says the government has the wrong man.  
Duronio has pleaded not guilty to all charges. He has been free on
bail awaiting trial for the past four years. Adams says he's not
working in an IT position at this time.

According to Wolfe, Duronio is facing four counts--one count of
computer intrusion, one count of mail fraud, and two counts of
securities fraud. The government contends that Duronio tried to profit
from the attack by manipulating the stock price of the global
investment banking and securities firm with the attack on its network.

The government contends that in the months leading up to the planting
of the logic bomb and the subsequent attack, Duronio, using the U.S.  
postal system, bought more than $21,000 worth of 'put option'
contracts for PaineWebber's parent company, UBS, A.G.'s stock. A put
option is a type of stock that actually increases in value when the
stock price drops. According to Wolfe, Duronio was betting the attack
would cripple the company's network, and its stock would fall in the
aftermath, allowing him to cash in.

Because of this part of his alleged plan, Duronio is being charged
with mail and securities fraud.

''Computers across the country pretty much all went down at once,''
says Wolfe. ''System administrators started to receive phone calls
that morning that certain computers weren't working. Within minutes,
it escalated from one phone call to 10, 60, 70... over 100 phone
calls.  At or about 10 o'clock they realized it wasn't an isolated
issue but all the computers across the network. It was just too much
of a coincidence for that to happen... This [network] was designed so
everything would not crash at once. The same network designed to not
suffer that problem was suffering that exact problem.''

And Wolfe says the man who was responsible for keeping that exact
system up and running for three years was the one who ultimately took
it down.

''The defendant was motivated by the fact that he was a disgruntled
employee who was not happy with his salary,'' says Wolfe. ''He wanted
an annual salary of $175,000 guaranteed. And I think for the year 2001
he was paid about $13,000 less than that.''


Insider Attacks

Attacks by corporate insiders, even by IT professionals, is not an
uncommon problem, according to last year's CSI/FBI Computer Crime
Survey. With only slight variation from year to year, inside jobs
occur as frequently as the highly publicized outside hacker attacks.  
Insider abuse, according to the survey, cost U.S. companies $6,856,450
last year.

''Insider attacks are definitely more dangerous,'' says Eric Maiwald,
a senior analyst for Burton Group, a research and consulting firm
based in Midvale, Utah. ''The average outside person generally doesn't
have access to your systems. Their first job in attacking you is to
get access, whereas the insider starts out with access. They're
starting one step ahead of the game. You have some general expectation
that they're not trying to cause you harm.''

John O'Leary, director of education at the San Francisco-based
Computer Security Institute, says companies have more to fear from
insiders in general because they know where the weak points in the
network are, and where the critical information is stored. But he adds
that executives have far more to fear from IT workers, because they
not only know how to get to the information but have the tools and the
access rights to do it easily.

''It's easy [to do] because we give our techs a lot of trust, but it's
difficult because we generally put compensating controls in place,''
says O'Leary. ''Other [people] need to edit what these guys are doing.  
Someone needs to see what changes he made. If he could make changes
without somebody noticing, then something is wrong.''

Maiwald, though, says it's exceedingly difficult for companies to put
in enough processes and controls to completely shut down someone with
system administrator-level authority and access.

''It's only the trusted individuals who can betray you at that level,"  
says Maiwald. ''If someone is digging ditches for you, they don't have
a lot of power. But your system administrator has a lot of power
because it's part of the job. If you put too many controls on them,
they can't do their jobs... There are controls that can be put in
place to do such things but they require a company to be very
watchful, along with additional staff, [and] specific procedures. And
it's just not very easy to do that.''


The Duronio Case

In this case, the government alleges that Duronio was a trusted
employee - one with great access and authority -- who used that
against PaineWebber. The charge of computer intrusion is based on the
government's allegations that Duronio built the code for the logic
bomb, installed it on Unix machines in PaineWebber's central office in
Weehawkin, N.J., and then pushed it out to about 1,000 computers
across the company's national network. Wolfe says the malicious code
was planted ''from coast to coast."

The logic bomb, which was made up of only 50 to 70 lines of code, was
built to delete every file on the system, according to the
prosecution. Duronio, who quit his job at PaineWebber a few weeks
before the bomb went off, also allegedly planted the code on the
system's backup servers so that when IT workers tried to restore
operations using backup tapes, those files were deleted as well. The
bomb was designed to go off every Monday at 9:30 a.m. - just as the
stock market opened - in March, April and May of 2002.

Trading, the lifeblood of the company, was interrupted because of the
crippled network. PaineWebber reported to the government that trading
was hindered for a few days in larger locations, and for as long as a
few weeks in some branch offices. According to the prosecution, 350
IBM support personnel were brought in to aid with the nationwide
recovery effort.

''Could they trade? Yes. Could they trade the way they normally
traded? No,'' says Wolfe. ''Normally... the broker would sit at his
desk and go online and trade for you... If the client didn't know what
the balance of their account was, they couldn't trade for them.''

The government also contends that Duronio planted the code piecemeal
during the previous November and December from a remote location.  
Wolfe says records show that Duronio's password and user account
information were used to gain remote access to the areas where the
malicious code was built inside the PaineWebber network. The U.S.  
Secret Service, which is frequently called in to conduct criminal
investigations and specifically cyber crime, executed a warrant on
March 21, 2002, and allegedly found hard copy of the logic bomb's
source code on the defendant's bedroom dresser. They also allegedly
found the source code on two of his four home computers.

''The defendant used the information of the impending logic bomb
attack,'' says Wolfe. ''He purchased securities. He bet against the
company that the company stock would drop... He engaged in an artifice
or scheme to fraud investors.''

Computer sabotage is a federal offense if it affects a computer used
in interstate commerce and causes more than $5,000 worth of damage to
the company over a 12-month span. Duronio faces a maximim sentence of
30 years, fines of up to $1 million and restitution for the $3.2
million PaineWebber spent on recovery.