You've gotta give this guy 10 out of 10 for initiative
By Jaikumar Vijayan - January 17, 2013 - Computerworld
Showing what can happen when companies don't periodically review network logs, a software developer working for a large U.S. critical infrastructure company hired a Chinese firm to do his job so he could spend time surfing Reddit and watching cat videos.
Details of the 2012 incident, investigated by Verizon's security services group, was recounted this week in a blog http://securityblog.verizonbusiness.com/2013/01/14/case-study-pro-active-log-review-might-be-a-good-idea/
post by Verizon security researcher Andrew Valentine.
Last May, the unidentified company's IT security department started monitoring logs generated at their VPN concentrator and discovered an open and active VPN connection originating from Shenyang, China.
"This discovery greatly unnerved security personnel," Valentine wrote. "They're a U.S. critical infrastructure company, and it was an unauthorized VPN connection from China. The implications were severe and could not be overstated
The company had created a two-factor authentication
process for VPN connections.
The developer, said to be in his mid-40s, was a long-time employee, a family man, inoffensive and quiet.
"Someone you wouldn't look at twice in an elevator,
" Valentine noted in his blog.
From, there, investigators quickly pieced together what happened.
"As it turns out, Bob had simply outsourced his own job to a Chinese consulting firm. Bob spent less that one fifth of his six-figure salary for a Chinese firm to do his job for him
," Valentine said.
He had FedExd his RSA token to the Chinese firm
so that the company could log in and work using his credentials. Meanwhile "Bob" was typically in his office at the company from 9 a.m. to 4:30 p.m. watching cat videos, reading stories on Reddit and spending time on eBay, Facebook and LinkedIn, the blog post said.At 4:30 p.m. most days, he would send an end of day update to his managers.
"Evidence even suggested he had the same scam going across multiple companies in the area. All told, it looked like he earned several hundred thousand dollars a year, and only had to pay the Chinese consulting firm about fifty grand annually,
" the blog post said.Bob's superior's had rated his work as excellent quarter after quarter. Computerworld full storysecurityblog