How A Trigger Set Off A Logic Bomb At UBS PaineWebber - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News
6/27/2006
09:25 AM
News
50%
50%

# How A Trigger Set Off A Logic Bomb At UBS PaineWebber

A forensics investigator testifying at the computer sabotage trial of a former systems administrator for UBS PaineWebber detailed how each line of code in the trigger helped set off a devastating logic bomb.

A forensics investigator testifying at the computer sabotage trial of a former systems administrator for UBS PaineWebber last week gave the jury an inside look at the trigger to the logic bomb that wreaked havoc on the UBS trading network in 2002.

Keith Jones, director of computer forensics and incident response at Mandiant, drilled into key elements of the logic flow underlying the trigger. The defendant, Roger Duronio, was a three-year employee of UBS who quit weeks before the bomb went off. The prosecution contends he was disgruntled and set off the logic bomb to seek revenge for a short bonus that year.

"wait_tst.c.txt" is the original name of the source code.

The line that says "time_t Clock;" was setting up storage space on the server on which the trigger was planted.

The line "while(TRUE) {" keeps the trigger running and prompts a logic flow of questions (when this is true, do this, etc.)

The line "if(tm->tm_mon ==2 || tm->tm_mon==3|| tm->tm_mon==4)" means if the month is March, April or May, go to the next step. If not,

The line "if(tm->tm_wday==1) {" means if the day is Monday go to the next step, if not sleep for one day.

The line "if (tm->tm_hour =>9) {" means if it's 9 a.m. or later, go to next step, if not, sleep for one hour

The line "if(tm->tm_min >=30) {" means if minute is 30 (i.e., 9:30), go to next step, if not, sleep for 60 seconds

The line "system("/usr/sbin/mrm -r / &");" is the line that calls the payload of the logic bomb that actually caused the destruction.

Jones, the government's star witness in the trial, laid out the logic flow of the code during court last Thursday and Friday.

In additional testimony, Jones said the trigger was found on Duronio's two home computers, on a hard-copy printout on a dresser in his home and on UBS systems. The government found the payload or malicious code, this trigger, the program's persistence mechanism and a distribution mechanism on a central UBS server in Weehawken, N.J., as well as on the branch servers. The trigger detailed above was found to be installed on each of the company's servers twice.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
More Insights
2020 State of DevOps Report
Download this report today to learn more about the key tools and technologies being utilized, and how organizations deal with the cultural and process changes that DevOps brings. The report also examines the barriers organizations face, as well as the rewards from DevOps including faster application delivery, higher quality products, and quicker recovery from errors in production.
10 Top Cloud Computing Startups
Cynthia Harvey, Freelance Journalist, InformationWeek,  8/3/2020
Adding Fuel to the MSP vs. In-house IT Debate
Andrew Froehlich, President & Lead Network Architect, West Gate Networks,  8/6/2020
How Enterprises Can Adopt Video Game Cloud Strategy
Joao-Pierre S. Ruth, Senior Writer,  7/28/2020
Video
Current Issue
Enterprise Automation: Do More with Less
In this IT Trend Report, we highlight the benefits of automation and the various tools as enterprises navigate turbulent times, try to do more with less, keep their operations running, and stay on track with digital modernizations.
White Papers
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll