News
News
6/27/2006
09:25 AM
Connect Directly
RSS
E-Mail
50%
50%

How A Trigger Set Off A Logic Bomb At UBS PaineWebber

A forensics investigator testifying at the computer sabotage trial of a former systems administrator for UBS PaineWebber detailed how each line of code in the trigger helped set off a devastating logic bomb.

A forensics investigator testifying at the computer sabotage trial of a former systems administrator for UBS PaineWebber last week gave the jury an inside look at the trigger to the logic bomb that wreaked havoc on the UBS trading network in 2002.

Keith Jones, director of computer forensics and incident response at Mandiant, drilled into key elements of the logic flow underlying the trigger. The defendant, Roger Duronio, was a three-year employee of UBS who quit weeks before the bomb went off. The prosecution contends he was disgruntled and set off the logic bomb to seek revenge for a short bonus that year.

"wait_tst.c.txt" is the original name of the source code.

The line that says "time_t Clock;" was setting up storage space on the server on which the trigger was planted.

The line "while(TRUE) {" keeps the trigger running and prompts a logic flow of questions (when this is true, do this, etc.)

The line "if(tm->tm_mon ==2 || tm->tm_mon==3|| tm->tm_mon==4)" means if the month is March, April or May, go to the next step. If not,

The line "if(tm->tm_wday==1) {" means if the day is Monday go to the next step, if not sleep for one day.

The line "if (tm->tm_hour =>9) {" means if it's 9 a.m. or later, go to next step, if not, sleep for one hour

The line "if(tm->tm_min >=30) {" means if minute is 30 (i.e., 9:30), go to next step, if not, sleep for 60 seconds

The line "system("/usr/sbin/mrm -r / &");" is the line that calls the payload of the logic bomb that actually caused the destruction.

Jones, the government's star witness in the trial, laid out the logic flow of the code during court last Thursday and Friday.

In additional testimony, Jones said the trigger was found on Duronio's two home computers, on a hard-copy printout on a dresser in his home and on UBS systems. The government found the payload or malicious code, this trigger, the program's persistence mechanism and a distribution mechanism on a central UBS server in Weehawken, N.J., as well as on the branch servers. The trigger detailed above was found to be installed on each of the company's servers twice.

Comment  | 
Print  | 
More Insights
The Business of Going Digital
The Business of Going Digital
Digital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek - September 2, 2014
Avoiding audits and vendor fines isn't enough. Take control of licensing to exact deeper software discounts and match purchasing to actual employee needs.
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
In in-depth look at InformationWeek's top stories for the preceding week.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.