Forensics Expert Attempts To Link UBS Attack And Defendant - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Forensics Expert Attempts To Link UBS Attack And Defendant

In the ongoing UBS computer sabotage trial, the government's forensics expert testified that he connected defendant Roger Duronio's username and home computer directly to the logic bomb that took down the company network.

Newark, N.J. - The government's forensics expert in the ongoing UBS computer sabotage trial testified Thursday that he not only found the malicious code that took down about 2,000 of UBS PaineWebber's servers four years ago, but he also "directly linked" it back to the defendant's home computer.

Keith Jones, director of computer forensics and incident response at Mandiant, an information security company, testified that he found the trigger mechanism for the logic bomb installed on machines across the company's national network, and that he connected defendant Roger Duronio's username and home computer directly to its creation, modification, distribution, and execution.

Keith Jones

Keith Jones
Duronio, a former systems administrator for UBS, is facing four federal criminal charges in connection with the March 4, 2002 attack that took the company's brokers offline for a day to three weeks. The attack cost the company $3.1 million in cleanup alone.

Jones explained to the jury how he began hunting for the trigger code and how it worked. Answering questions from Assistant U.S. Attorney Mauro Wolfe, Jones said the government brought him in to work on the case a little more than a year after the incident, and that he immediately started searching for files and pieces of code associated with the logic bomb.

"I started with a clean slate," said Jones, who has 10 years of computer forensics experience. "A lot of times a company doesn't know what's going on. They're in a 'let's get things back up and running' mode. I came in to find out what was happening in the system."

Early on in his testimony, Jones testified about conclusions that he reached after his three-year investigation into the UBS incident. As the government flashed accompanying slides on a screen for the jury, the witness said he found the 25 lines of the bomb's timer on two of Duronio's home computers, which the U.S. Secret Service had seized from his house. He also said the hard-copy printout of the trigger that set off the logic bomb, which federal agents found on Duronio's bedroom dresser, was an exact match for what was in the computers.

Next, Jones said the code caused the massive file deletion that took down the network. The forensic exam, he added, also revealed that the timer for the logic bomb, which Jones dubbed "the Duronio Trigger," was distributed and intentionally installed on the company's main host server, as well as on servers in approximately 370 branch offices.

Finally, Jones, who has written his own open-source forensics tools, said he concluded that Duronio's username and home computers were "directly linked" to the building of the logic bomb and to its presence on UBS's nationwide Unix-based network.

Jones had to explain to a jury of technical laymen the basics of computer code and forensics, source code, binary code, and compilers.

Jones has 10 years of experience as a forensics examiner and has worked on Unix since he was 16. He holds three college degrees, including a bachelors in computer engineering and a masters in electrical engineering. A former systems administrator himself, he also has written three books, including Real Digital Forensics and The Anti-Hacker Toolkit.

The defense maintains that the government focused its investigation on the wrong man. Duronio's attorney has said UBS erred when hiring @Stake, the first forensics team on the case, because the firm employed well-known hackers. And Duronio's team also criticized the Secret Service and how agents handled evidence and other interviews.

Recovery Costs

Earlier in the day, the prosecution put Nancy Bagli, an assistant vice president with UBS, on the stand.

Bagli, who has been with UBS since 1997, worked in the company's Contract and Sourcing department at the time of the 2002 attack. She testified that she worked with group managers to figure out what they needed for hardware and services to recover from the attack. She also kept track of what UBS spent on the cleanup.

UBS spent $898,780 on hardware, including IBM and Sun Microsystems servers; $260,473 on investigative services; and $1,987,036 on technical consultants, who were mainly from IBM and went out to help bring the branch offices back up. The company bought refurbished equipment if it could get it faster than new, Bagli said.

That adds up to a total of $3,146,289 spent on recovery costs alone. UBS has never reported the price of down business time.

The trial is nearing the end of its third week. Jones is the prosecution's last witness and will take the stand again Friday morning. The defense will present its own slate of witnesses starting next week.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
InformationWeek Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the InformationWeek site in the coming months.

How CIO Roles Will Change: The Future of Work
Jessica Davis, Senior Editor, Enterprise Apps,  7/1/2021
A Strategy to Aid Underserved Communities and Fill Tech Jobs
Joao-Pierre S. Ruth, Senior Writer,  7/9/2021
10 Ways AI and ML Are Evolving
Lisa Morgan, Freelance Writer,  6/28/2021
White Papers
Register for InformationWeek Newsletters
2021 State of ITOps and SecOps Report
2021 State of ITOps and SecOps Report
This new report from InformationWeek explores what we've learned over the past year, critical trends around ITOps and SecOps, and where leaders are focusing their time and efforts to support a growing digital economy. Download it today!
Current Issue
Flash Poll