Ex-UBS Systems Admin Sentenced To 97 Months In Jail
Roger Duronio was found guilty of computer sabotage and securities fraud for writing, planting, and disseminating malicious code that took down up to 2,000 servers.The former systems administrator convicted this past summer of launching an attack on UBS PaineWebber four years ago was sentenced to 97 months in jail in U.S. District Court in Newark, N.J., on Wednesday.
Roger Duronio, 63, of Bogota, N.J., stood quietly and didn't react as Judge Joseph Greenaway Jr. handed down the sentence. "This is a sophisticated crime," said the judge. "This wasn't an instance when an individual argues that 'I had a bad day and I made a mistake.' Its undoubtedly that Mr. Duronio, having felt wronged, came up with an elaborate, sophisticated scheme to take down a company." Judge Greeaway added that he was struck by Duronio's attempt to not only disrupt the company but to derive financial benefit from it.
More Insights
Webcasts
- Creating an Agile, Flexible Cloud Computing Model
- Enhance Business Performance with Process Oriented Data Stewardship
White Papers
- IDC white paper: Delivering an Integrated Infrastructure for the Cloud
- Nemertes Research PilotHouse Awards: Servers for Virtualization
Reports
- IT Pro Impact: VDI in the Cloud
- Strategy: Choosing the Right Vulnerability Scanner for Your Organization
Duronio was found guilty of computer sabotage and securities fraud for writing, planting, and disseminating malicious code -- a so-called logic bomb -- that took down up to 2,000 servers in both UBS PaineWebber's central data center in Weehawken, N.J., and in branch offices around the country. The attack left the financial giant's traders unable to make trades, the lifeblood of the company, for a day in some offices and for several weeks in others.
Executives at UBS, which was renamed UBS Wealth Management USA in 2003, never reported the cost of lost business, but did say the attack cost the company more than $3.1 million to get the system back up and running.
"If it doesn't send a message, people aren't listening," said Assistant U.S. Attorney V. Grady O'Malley, a prosecutor on the case. "If giving the maximum for this crime doesn't send a message to people with the ability to commit a crime and to the people who employ them, they're not paying attention. The potential for the impact of an insider is uncalculable."
In his first statement in open court, Duronio called himself a simple man who lead a simple, productive life. "In the Judeo-Christian way of looking at things the just thing to do would be to be merciful. I hope to have the opportunity to keep making contributions." UBS was hit on March 4, 2002, at 9:30 in the morning, just as the stock market opened for the day. Elvira Maria Rodriguez, an IT manager in charge of maintaining the stability of the servers in the branch offices, testified during the trial that she was working when the servers began to go down. She told the court that she heard her computer beep, saw the words "cannot find" on the screen, and then her system froze. Then she glanced at her phone, which generally might have two or three lights flashing, and saw that 60 calls had come in at once.
That happened when 17,000 brokers suddenly discovered they were unable to make trades.
Rodriguez also testified that UBS is still suffering damage four years after the attack. Some of the information on the approximately 2,000 Unix-based servers in the home office and the 370 branch offices that were hit by the malicious code was never fully restored.
"I don't believe we were ever back to that point," said Rodriguez during the trial. "We were always having issues with these large-scale servers [after the attack]. We never had the luxury to focus on completely going over all the servers. We just didn't have the time."
Duronio worked at UBS as a systems administrator until he quit a few weeks before the attack. Witnesses testified that he quit because he was angry he didn't receive as large an annual bonus as he expected. The government argued that Duronio wasn't just looking to cause trouble for UBS, he also was looking to cash in. Duronio built and planted the time bomb ahead of time and then bought stock options -- using money that he got cashing out his and his wife's $20,000 IRA -- that would only pay out if the company's stock took a dive within 11 days. By laying out a short expiration date -- 11 days instead of maybe a year or two -- the gain from any payout would be much greater.
Prosecutors argued that Duronio planned on making sure that that's exactly what would happen by crippling the company's network.
During the investigation, U.S. Secret Service agents found copies of the malicious code on two of Duronio's home computers and on a printout sitting on his bedroom dresser.
Keith Jones, the government's expert witness and a 10-year forensics professional, spent more than three years analyzing backup tapes, logs, and source code from UBS's network. Jones testified during the trial that he not only found the malicious code, but he also linked it directly back to Duronio's home computer.
The defense argued that the UBS network was riddled with security holes that would have allowed any number of people to masquerade as Duronio and move around the network unnoticed. They also argued that the evidence available -- in the form of backup tapes for the damaged servers -- was incomplete, leaving holes in the picture of what happened in the months before the security incident. The jury deliberated for 20 hours before delivering the verdict, which included an acquittal on two charges of mail fraud.
Duronio was ordered to make restitution, but it is unlikely that UBS will ever get the $3.1 million they paid out in cleanup costs. Duronio also was banned from working as a systems administrator, network administrator, or computer consultant. He will report to the prison system in about 45 days.
Related Reading
| To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy. |
Subscribe to RSSResource Links
Related Webcasts
- Videoconferencing: Business & the Big Picture
- Securing the Cloud: Extend the Benefits of Traditional IT Environments to Cloud
- Thriving in a Multi-Platform World: Integrating Mobile Device Management into Your Overall Security Strategy
- The Business Value of Data Quality – Getting the Most out of Your Investments in Data Warehousing and Data Analytics
- Collaborative DevOps: Bridging the gap between development and operations with automation
This Week's Issue
Free Print Subscription
SubscribeCurrent Healthcare Issue
- InformationWeek Healthcare CIO 25: Our second annual honor roll of the health IT leaders driving healthcare's transformation.
- EHR Unreadiness: Only a small percentage of physicians planning to apply for Meaningful Use funds have e-health record systems capable of achieving most of the requirements. .
- And much more!
- Read the Current Issue
Related Whitepapers
- Hardware vs. software deduplication: finding what's right for you
- In-Memory Analytics for Big Data
- Forrester Research study How Blade Servers Impact Datacenter Management and Agility
- ESG whitepaper: Defining Tier One Storage in the Modern Data Center
- Evaluator Group: HP's Converged Storage A Vision for Emerging Customer Requirements












