Blue Lance InfoSec Blog

Former Goldman Sachs programmer arrested for stealing source code

A former programmer for Goldman Sachs was arrested July 3rd on charges of theft of trade secrets.  According to the complaint, Sergey Aleynikov copied portions of the source code for the bank's high speed trading software, transferring approximately 32 MB of code to a server in Germany.

After notifying his employer of his intent to resign, Aleynikov copied, encrypted and uploaded the data on four separate occasions.  His final upload occurred at 5:24 PM on the last day of his employment with Goldman Sachs.  Aleynikov started with his new employer, Chicago-based Teza Technologies LLC on July 2; and has since been suspended.

According to a Bloomberg article:

At a court appearance July 4 in Manhattan, Assistant U.S. Attorney Joseph Facciponti told a federal judge that Aleynikov’s alleged theft -- the largest breach ever at the bank -- poses a risk to U.S. markets. Aleynikov transferred the code, worth millions of dollars, to a computer server in Germany, and others may have had access to it, Facciponti said, adding that New York-based Goldman Sachs may be harmed if the software is disseminated.

“The bank has raised the possibility that there is a danger that somebody who knew how to use this program could use it to manipulate markets in unfair ways,” Facciponti said, according to a recording of the hearing made public yesterday. “The copy in Germany is still out there, and we at this time do not know who else has access to it.”

Hospital Night Guard Charged With Hacking Servers (to the Beat of His Own Drum)

Jesse William McGraw was arrested Friday on charges of felony computer intrusion.  McGraw, also known as GhostExodus, among other online aliases, worked as a night guard at the Carrell Clinic in Dallas, Texas.  YouTube videos allegedly show McGraw wearing a hoodie over his security guard uniform and slinking around the hospital to the tune of the Mission Impossible theme song while installing malicious botnet software on various servers around the clinic, including its HVAC server.

Federal authorities say he planned to use the botnet to launch a massive distributed denial of service (DDOS) attack on Independence Day.  His last day of work at the clinic was scheduled to be July 3^rd.  McGraw had been an employee of Dallas security company United Protection Services.

The attack, particularly on the HVAC server, could have caused the air conditioning to stop working for the entire hospital, possibly harming inpatients sensitive to the intense Texas summer heat, and also potentially compromising the integrity of temperature-sensitive medications stored at the onsite pharmacy.

A member of McGraw’s hacker group, called the Electronik Tribulation Army, boasted to security researcher Wesley McGrew of their hacking abilities, showing McGrew screen shots of some of the clinic’s hacked machines.  McGrew showed his findings to the authorities, leading to McGraw’s arrest.  McGrew, a graduate student at Mississippi State University, says:

“He's a security guard at the hospital, but he's pretending to infiltrate a corporate office and he's running around with a hoodie on over his security guard uniform and installing botnet software on a hospital computer all to the Mission Impossible music.  [You] can't make this stuff up."