Blue Lance InfoSec Blog

Former Stens employee sentenced in computer intrusion

This post updates a previous post on this case.

According to a December 22nd press release from the FBI's Indianapolis office:

Joseph H. Hogsett, United States Attorney, announced today that Walter D. Puckett, 40, of Williamstown, Kentucky, was sentenced to three years of probation by U.S. District Chief Judge Richard L. Young after his guilty plea to computer intrusion. This case was the result of a lengthy investigation by the Federal Bureau of Investigation.

Puckett admitted that he accessed the computer system of the Stens Corporation, based in Jasper, Indiana, from various places on numerous occasions without authorization. Puckett further admitted that the computer intrusions were performed for the purpose of gaining commercial advantage and personal financial benefit. Puckett was employed by a competitor of Stens when he accessed the Stens’ computer system.

According to Assistant U.S. Attorney Todd S. Shellenbarger, who prosecuted the case for the government, Judge Young also ordered Puckett to serve the first 300 days of his probation term in a work release center. Puckett was also ordered to make restitution in the amount of $72,481 to Stens.

 

Former Goldman Sachs programmer found guilty on theft of trade secrets charges

According to the New York office of the FBI, Sergey Aleynikov, a former computer programmer at Goldman Sachs was found guilty last week by a jury in Manhattan federal court.  Aleynikov had been charged with theft of trade secrets and transportation of stolen property in interstate and foreign commerce, stemming from the theft of computer code from the high frequency trading software of Goldman Sachs.

According to the press release:

From May 2007 to June 2009, ALEYNIKOV was employed at Goldman Sachs as a computer programmer responsible for developing computer programs supporting the firm's high-frequency trading on various commodities and equities markets. Goldman Sachs had obtained the high-frequency trading system in 1999, when it acquired Hull Trading Company, the previous owners of the system, for approximately $500 million. Since acquiring the system, Goldman Sachs modified and maintained the system, and took significant measures to protect the confidentiality of the system's computer programs, including firewalls to limit access to the firm's computer network, and limiting internal access to the high-frequency trading program. Goldman Sachs' high frequency trading system generates millions of dollars per year in profits for the firm. Goldman Sachs takes several measures to protect the system's source code, including requiring all Goldman employees to agree to a confidentiality agreement.

In April 2009, ALEYNIKOV resigned from Goldman Sachs and accepted a job at Teza Technologies ("Teza"), a newly-formed company in Chicago, Illinois. He was hired to develop Teza's own version of a computer platform that would allow Teza to engage in high-frequency trading. His last day of employment at Goldman Sachs was June 5, 2009.

Beginning at approximately 5:20 p.m. on June 5, 2009—his last day working at Goldman Sachs—ALEYNIKOV, from his desk at Goldman Sachs, transferred substantial portions of Goldman Sachs' proprietary computer code for its trading platform to an outside computer server in Germany. He encrypted the files and transferred them over the Internet without informing Goldman Sachs. After transferring the files, he deleted the program he used to encrypt the files and deleted his computer's "bash history," which records the most recent commands executed on his computer.

In addition, throughout his employment at Goldman Sachs, ALEYNIKOV transferred thousands of computer code files related to the firm's proprietary trading program from the firm's computers to his home computers, without the knowledge or authorization of Goldman Sachs. He did this by e-mailing the code files from his Goldman Sachs e-mail account to his personal e-mail account, and storing versions of the code files on his home computers, laptop computer, a flash drive, and other storage devices.

On July 2, 2009, ALEYNIKOV flew to Chicago, Illinois, to attend meetings at Teza's offices, bringing with him his laptop computer and another storage device, each of which contained Goldman Sachs's proprietary source code. He was arrested on July 3, 2009, as he arrived at Newark Airport following that visit.

Aleynikov faces a penalty of up to 15 years in prison and is scheduled to be sentenced on March 18, 2011.

 

Read the press release

 

Former Valspar Chemist Sentenced to 15 Months for Stealing up to $20 Million in Trade Secrets

David Yen Lee, a former technical director for Valspar, was sentenced this week to 15 months in prison for stealing an estimated $20 million in trade secrets after accepting a position with a competitor.  Lee pleaded guilty in September to charges that he used his credentials on Valspar's secure network to access and download data including chemical formulas, sales and cost data, product research and marketing data.

According to the Chicago Office of the FBI:

Lee admitted that between September 2008 and February 2009, he had negotiated employment with Nippon Paint, located in Shanghai, China. On Feb. 27, 2009, Lee accepted employment with Nippon as vice president of technology and administrator of research and development beginning on April 1, 2009, in Shanghai. Lee was scheduled to fly from Chicago to Shanghai on March 27, 2009. He did not inform Valspar that he had accepted a job at Nippon until he resigned on March 16, 2009.

At Valspar, Lee’s duties included scouting new paint technologies, coordinating with other paint laboratories, coordinating staffing and projects with Huarun Limited, a Valspar subsidiary located in China, and overseeing Valspar’s technical service group, which conducted experiments for paint coloring.

Between November 2008 and March 2009, Lee downloaded technical documents and materials belonging to Valspar, including the paint formula batch tickets. He further copied certain downloaded files to external thumb drives to store the data, knowing that he intended to use the confidential information belong to Valspar for his own benefit. The total value of the trade secret information Lee took was estimated at between $7 million and $20 million. There was no evidence that he actually disclosed any of the stolen trade secrets.

In addition, Lee has been ordered to pay $30,975 in restitution to cover the expenses of Valspar's internal investigation.

 

Read the press release

Former IT employee gets 18 month prison sentence for computer intrusion

According to a press release from the FBI's Tampa office, Patricia Marie Fowler, a former IT technician, received 18 months in prison and ordered to pay $17,243.01 in restitution.  Fowler, was employed at the Suncoast Community Health Centers (SCHC) in Ruskin, Florida, was found guilty in September of computer intrusions resulting in over $5,000 in damages to SCHC.

According to trial testimony, Fowler had been fired by SCHC on March 13, 2009, for insubordination and failing to follow the orders of her supervisors. On March 17, SCHC employees discovered that a computer intrusion had occurred and that damage had been done to the SCHC computer system. From March 17, 2009 through April 1, 2009 numerous unauthorized intrusions were made into the SCHC computer system which resulted in the deletion and movement of files from the computers of SCHC executives, changing of administrative account names and passwords, removing access to infrastructure systems, changing pay and accrued leave rates on the employee payroll system, and the compromise and lockout of the firewall used to secure the SCHC network.

In addition, Fowler will be placed on supervised release for 3 years after serving her sentence.

Read the full press release

Former employee pleads guilty to computer intrusion, deletion of files

The El Paso branch of the FBI last week announced the guilty plea of Ismael Alvarez, a former employee of Gray Wireline to charges of computer fraud for illegally accessing a company database and deleting several files.

...Alvarez admitted that on September 1, 2010, he illegally gained access to the computer system of Gray Wireline, Inc., and deleted approximately 68 files, including analysis reports on oil and natural gas wells in Odessa, Levelland, Denver City, and Andrews, Texas. As a result, Gray Wireline estimates that it had to spend approximately $16,000 to correct and remedy the damage caused by Alvarez.

Alvarez faces up to 10 years in federal prison.

Read the full press release

Ex-Ford employee pleads guilty to theft of trade secrets

According to the FBI's Detroit Office, Xiang Dong Yu, the former Ford employee charged with stealing trade secrets and fleeing to China, pleaded guilty yesterday to in federal court to two counts of theft of trade secrets.  Last October, Yu was arrested and indicted at Chicago O'Hare Airport, after arriving on a flight from China.

According to the plea agreement in this case, Yu was a product engineer for the Ford Motor Company from 1997 to 2007 and had access to Ford trade secrets, including Ford design documents. In December 2006, Yu accepted a job at the China branch of a U.S. company. On the eve of his departure from Ford and before he told Ford of his new job, Yu copied some 4,000 Ford documents onto an external hard drive, including sensitive Ford design documents. Included in those documents were system design specifications for the engine/transmission mounting subsystem, electrical distribution system, electric power supply, electrical subsystem and generic body module, among others. Ford spent millions of dollars and decades on research, development, and testing to develop and continuously improve the design specifications set forth in these documents. The majority of the design documents copied by the defendant did not relate to his work at Ford. On December 20, 2006, the defendant traveled to the location of his new employer in Shenzhen, China, taking the Ford trade secrets with him. On January 2, 2007, Yu e-mailed his Ford supervisor from China and informed him that he was leaving Ford’s employ.

As part of the plea agreement, Yu faces up to 78 months in prison and fines from 50-100 million dollars.  Yu is scheduled for sentencing on February 23, 2001.

Read the entire FBI press release

Former IT Director gets 27 months for hacking employer's website

According to the Richmond Office of the FBI, a former information technology director for Transmarx LLC, has been sentenced to 27 months in prison for illegally accessing the Transmarx website, and deleting approximately 1000 files from the site.

Darnell H. Albert-El was terminated from Transmarx in June 2008, where he had administrator access to the network, including the company web site.

In pleading guilty, Albert-El admitted that on July 25, 2008, he used a personal computer and an administrator account and password to access the computer hosting the Transmarx website. After accessing the computer, Albert-El knowingly caused the transmission of a series of commands that intentionally caused damage without authorization to the computer by deleting approximately 1,000 files related to the Transmarx website.

Albert-El pled guilty on June 29, 2010 to one count of intentionally damaging a protected computer without authorization, was also ordered to pay $6,700 in restitution to Transmarx.  He admitted that he caused the damage because of his anger over being fired.

Read the full press release

Former University of California IT employee sentenced for identity theft

According to the San Francisco Division of the FBI, Cam Giang, a former employee at the University of California San Francisco Medical Center, was sentenced yesterday to one year and one day in prison for wire fraud and the illegal use of a Social Security number in the theft of several employees' identities.

Giang, an IT staffer, obtained the birthdates and Social Security numbers of other UC employees, using the information to create accounts at a web site to complete surveys in exchange for monetary vouchers.

Giang, who was an employee of the University of California (UC) San Francisco Medical Center at the time of the offense, obtained and used the personal information (i.e., birthdates and Social Security numbers) of other UC employees to create accounts on the StayWell Health Management, Inc. (StayWell) website and complete online health surveys on behalf of these individuals without their knowledge or consent. In this way, Giang fraudulently obtained online monetary vouchers to which he was not entitled. Giang completed approximately 382 online StayWell health surveys using the personal information of other UC employees. StayWell discovered Giang’s fraudulent scheme and informed the UC and FBI.

StayWell is a company based in St. Paul, Minn., engaged in the business of providing health management solutions. Since 2009, StayWell has been conducting online health surveys for University of California employees. Survey participants are required to create an account on StayWell’s website. When a survey is completed, the participant is awarded with a $100 online voucher.Giang, who was an employee of the University of California (UC) San Francisco Medical Center at the time of the offense, obtained and used the personal information (i.e., birthdates and Social Security numbers) of other UC employees to create accounts on the StayWell Health Management, Inc. (StayWell) website and complete online health surveys on behalf of these individuals without their knowledge or consent. In this way, Giang fraudulently obtained online monetary vouchers to which he was not entitled. Giang completed approximately 382 online StayWell health surveys using the personal information of other UC employees. StayWell discovered Giang’s fraudulent scheme and informed the UC and FBI.

StayWell is a company based in St. Paul, Minn., engaged in the business of providing health management solutions. Since 2009, StayWell has been conducting online health surveys for University of California employees. Survey participants are required to create an account on StayWell’s website. When a survey is completed, the participant is awarded with a $100 online voucher.

 

Read the full FBI Press Release

Former Milwaukee County temp charged with identity theft after stealing employee data

A former temporary employee at the Milwaukee County human resources department and her boyfriend have been charged in connection with the theft of current and former employee's personal information and attempting to steal their identities.

According to the Milwaukee Journal-Sentinel, Starlita L. Sims and Christopher Lee Jackson have so far, only been charged with one count of identity theft, although additional charges may follow.

Sims, 26, was working for Adecco, a national staffing agency, when she began working as a contract employee for the county human resources department's records section in December 2009. Sims had access to personal information for all current and retired county employees.

The alleged fraud was discovered when Mary Ann Grimes began receiving calls from credit card companies about credit card applications filed in her name. Grimes had not applied for any credit cards and reported the activity to authorities.

The case has many asking why Milwaukee County would allow a temp access to any type of sensitive data.  

Read the entire article

Akamai employee arrested for attempting to deliver stolen data to a foreign country

Infosecurity USA reports that last week, the US Attorney’s Office for the District of Massachusetts announced the arrest of an employee from Akamai Technologies, who allegedly provided confidential business information to a foreign country over an 18 month period.  Representatives from the undisclosed country, thought to be Israel, promptly contacted the FBI.

Elliot Doxer, who worked in the finance department, has been charged with one count of wire fraud in connection with the investigation. 

Doxer is charged with one count of wire fraud for providing Akamai customer lists, contract details, and employee information. He also is charged with describing Akamai’s physical and computer security systems and offering to travel to the foreign country and to support special and sensitive operations in his local area, if needed.

After contact had been established, the FBI set up a "dead drop" site, which Doxer visited at least 62 times over 18 months.  Doxer faces a $250,000 fine and up to 20 years in prison if convicted.

Read the Infosecurity USA story

Read the US Attorney's Office announcement