This is page 2 of:
Gucci Admin Gets Fired, Then Gets Even. Really Even
Access to Gucci’s VPN is through connecting a USB-sized token. Yin created the fictional employee and then, when he was fired, he took the token with him. (Given that it wasn’t in his name, Gucci had no reason to ask for it back. For that matter, they likely didn’t even know it existed.)
In June, Yin “E-mailed members of Gucci’s IT department using the fictional identity and tricked them into activating his VPN token,” according to a “statement of facts” filed with the court.
“In the months that followed, using the VPN token, YIN exploited his familiarity with Gucci’s network configuration and administrator-level passwords to gain nearly unfettered access to Gucci’s network. As a result, Gucci lost access to documents and E-mail for nearly 24 hours, while other documents and E-mails were deleted permanently,” the New York City filing said. “This intrusion cost Gucci more than $200,000 in diminished productivity, restoration and remediation measures, and other expenses.”
The big one, though, happened on Nov. 12, 2010, when, in a two-hour attack, Yin supposedly deleted those virtual servers, the SAN and a disk with the corporate mailboxes in an E-mail server.
“As a result, Gucci staff was unable to access any documents, files or other materials saved anywhere on its network. Additionally, Yin’s destruction of data from the E-mail server cut off the E-mail access not only of corporate staff but also of store managers across the country and the E-Commerce sales team, resulting in thousands of dollars in lost sales,” the court filing said. “Gucci’s IT staff was unable to restore system operations until the end of the business day, and the lingering effects of the intrusion continued to impose costs on the company in the weeks and months that followed.”
The Jersey City, N.J., resident was hit with a 50-count indictment, being charged with computer tampering, identity theft, computer trespass, falsifying business records, criminal possession of computer-related material, unlawful duplication of computer-related material and unauthorized use of a computer.
No matter how you slice the maximum number of prison years that each of these charges could bring, Yin is facing some serious punishment if he gets convicted of much of this. His IT bosses, on the other hand, might look longingly toward Rikers Island as they find themselves having to explain to an infinite number of angry bosses how they let this happen.
-Marc
April 7th, 2011 at 7:06 am
I was not expecting an obscure M*A*S*H reference but it was welcome. Captain Tuttle was indeed a great man, albeit one who never said much…
April 7th, 2011 at 8:50 am
Security policies and actual practices must have been seriously flawed to allow this. It also appears that the higher level IT managers did not take their responsibilities seriously or they lacked technical competence. Security is part of their job. Gucci(and other companies) might address this example of poor management by tieing management bonuses (and salaries) to flawless performance. I am surprised that Yi (presumably) did not just transfer some hefty cash balances to a few off-shore banks and take an extended vacation abroad.
April 7th, 2011 at 10:31 am
Editor’s Note: That was a last-minute change. We did some searching and found that it was not that obscure at all. A Bing/Google/Yahoo/Wilkipedia search for Capt. Tuttle instantly found the right one so we thought if anyone was curious, the pop culture reference was easily discoverable. It’s an interesting process. Given that our audience is fairly global–one out of five readers is outside the U.S.–and the age range is all over the map, we have concluded that a healthy portion of readers won’t recognize most such references. So we either forgo them or we make sure that the meaning of the sentence is clear even if the reference is unknown.
April 8th, 2011 at 10:45 am
This Gucci story reminded me of something that happened early in my career. When I was building another technology company back in the 80’s, we came across a business that hired a developer to write a set of accounting packages for them. One module was a simple payroll application. He wrote a routine in there that verified his Social Security number on every payroll run. The nefarious “extra” routine he wrote was that if his SS# was not found (ie. he was terminated), the entire software package and related files self destructed. He was ultimately terminated and the software melted down.
April 11th, 2011 at 3:12 pm
This is a interesting story and I totally agree with Dr. P that the security management at Gucci is serously flawed and the information security governance and risk management at Gucci have not been defined to follow the industry best practices.
For the article itself, I found it is bizarre that the author specifically pointed out that Yin is a “naturalized US Citizen from Taiwan”. This kind of words provides a hint of “profiling” and should not be used.
April 11th, 2011 at 3:34 pm
LOL – another commenter’s reference to “One module was a simple payroll application” brought back memories of horror from my early days as a programmer. Payroll is never “simple!” You’re dealing with employee money, employer money, government regulations, federal & state tax reporting, and many times, union money — not simple! Sorry for the side-track but when I read this my eye started to involuntarily twitch.
April 11th, 2011 at 3:51 pm
Editor’s Note: The story did not intend to profile with the use of that description. That was from the District Attorney’s office and it was solely intended to indicate that the defendant had ties to Asia, which was offered as an explanation for why he was supposedly selling these products in Asia.
April 15th, 2011 at 2:28 pm
I find it annoying that people who have no intimate knowledge of the situation make broad sweeping comments about other’s being incompetent or flawed. It certainly seems like this shouldn’t have happened and that people should have paid more attention. However, in this world of companies expecting employees to do more for less, work crazy hours, and work what should be multiple people’s jobs, who can claim they would never make a mistake? Noone, that’s who. And if you do, well that shows a level of incompenetence and stupidity in and of itself.