It just goes to show, however smart you think you are…don’t bother trying to wreck someones data. In this case, even if the guy was pissed it was highly responsible as it involved medical records and could actually seriously effect someones life.

He was pretty careful but left a few clues behind, more than enough for the FBI to catch him (computer names, printers installed etc.).

An IT manager who sought revenge for an unfavorable job evaluation was sentenced to more than five years in federal prison after being convicted of intentionally triggering a massive data collapse on his former employer’s computer network.

Jon Paul Oson, 38, of Chula Vista, California, was sentenced to 63 months behind bars and ordered to pay more than $409,000 in restitution, according to federal prosecutors in San Diego. He was immediately taken into custody after the sentence was handed down on Monday. It is one of the stiffest penalties ever for a computer hacking offense.

It’s a pretty huge sentence for hacking – 63 months or just over 5 years! As mentioned it’s one of the stiffest sentences ever for a computer related crime.

It did cause some serious losses though with a staggered disruption of data, as he was familiar with the backup system he could disable it then wait until the cycle had finished…then once the data was gone it was gone.

On December 23, Oson logged onto servers belonging to his former employer and disabled the program that automatically backed up medical records for thousands of low-income patients. Six days later, he logged on again, and in the span of 43 minutes, methodically deleted the files containing patients’ appointment data, medical charts and other information.

The dollar cost of Oson’s rampage was pegged at $409,337.83 and accounted for expenses for technical investigations and moving to a paper-based system in the weeks following the attack. But the real toll came when doctors at North County Health Services no longer had medical records for thousands of low-income patients who sought medical care. North County Health Services contracted with Oson’s employer to store the records.

Pretty scary that one guy has this kind of power, it just shows it doesn’t pay to annoy the BOFH! Anyway what he did was wrong and he’s getting what he deserved, I mean he didn’t even get canned he just got a bad evaluation.

Any thoughts on this?

Source: The Register

It seems like war-driving may become a thing of the past, legislation is starting to happen.

It’s a good start though, you have to target the manufacturers to educate their users, not target the users as they don’t care, sometimes ease of use has to be traded a bit with security.

California legislators have passed a law which will force makers of wireless internet equipment to include guidance on keeping data secure on wireless connections. The law now awaits signature by Governor Arnold Schwarzenegger.

From 1 October 2007, manufacturers must place warning labels on all equipment capable of receiving Wi-Fi signals, according to the new state law. These can take the form of box stickers, special notification in setup software, notification during the router setup, or through automatic securing of the connection. One warning sticker must be positioned so that it must be removed by a consumer before the product can be used.

The warnings would have to contain information on how to secure files, folders, and connections. Wireless internet connections can be used by anyone with Wi-Fi capability within the range of the transmitter unless they are secured.

Makes sense really right? The current law in a way can be seen to cover unauthorised wireless use.

The legislation acknowledges disagreement in the US as to whether it is legal for someone to use another person’s unprotected Wi-Fi connection. “While Section 502 of the Penal Code prohibits the unauthorized access to computers, computer systems, and computer data, authorized use is determined by the specific circumstances of the access,” it states. “There are also federal laws, including the Computer Fraud and Abuse Act [...]that prohibit the intentional access to a computer without authorisation.”

In UK such warnings are not required but the position of using someone elses wi-fi connection is much clearer.

“The Communications Act includes an offence of dishonestly obtaining an electronic communications service ‘with intent to avoid payment of a charge applicable to the provision of that service’,” said Robertson. “We’ve already seen a conviction in the UK for using someone else’s Wi-Fi connection without authority.”

In July 2005, Gregory Straszkiewicz became the first person to be convicted under this provision. He was fined £500 at London’s Islewoth Crown Court. The Act provides for a maximum sentence of five years in prison and a fine.

So, is this the end of war driving?

Source: The Register