Security consultant hijacked 250,000 machines - Security Bytes
Home > IT Blogs > Security Bytes > Security consultant hijacked 250,000 machines
« KnujOn takes the spam fight to the enemy
Another sign Visa was on to TJX’s security troubles »
» VIEW ALL POSTS Nov 12 2007   8:39AM GMT

Security consultant hijacked 250,000 machines



Posted by: Bill Brenner
Information Security Threats, Data Breaches and Identity Theft, Laws, Investigations and Ethics

A security consultant based in L.A. has pleaded guilty to leading a double life as a bot herder, infecting 250,000 computers and stealing thousands of identities in the process.

John Schiefer pleaded guilty to four counts of fraud and wiretap charges that could saddle him with a $1.75 million fine and 60 years in prison, according to the Los Angeles U.S. Attorney’s office.

Prosecutors accused Schiefer and some unidentified co-conspirators of installing malware that acted as a wiretap on hijacked machines, intercepting messages to Paypal and other Web sites.

According to Reuters, he collected user names and passwords and used them to break into bank accounts.

What’s chilling about all this is that Schiefer worked by day as an information security consultant people trusted to help them secure their systems. The lesson here is that sometimes you can’t even trust the good guys.

AddThis Social Bookmark Button     Comment     RSS Feed     Email a friend

Comment on this Post


You must be logged-in to post a comment. Log-in/Register

Roger's Security Blog : Be Careful Whom You Trust  |   Nov 13 2007   3:50PM GMT

[...] When I talk to customers I sometimes ask them, whether they do background checks on whom they hire as employees or contractors. If it comes to security, the whole theme gets pretty sensitive. Imaging that you hire an employee to deal with your security architecture and he turns out to be a criminal. Or you give a project to work on your security to an external consultant and all of a sudden he is arrested for spreading malware. Fantasies? Not really! This just happened: Security consultant hijacked 250,000 machines Would a background check have helped here? Probably not but we really have to think about whom we trust and how we hire people. I still cannot understand that there are companies hiring convicted hackers (even though everybody deserves a second chance – I agree). I blogged on that already once and the comments have been not in line with my view (Hackers getting Jobs in the Industry) Any views from your side? Roger Filed under: Security, Cybercrime, Processes [...]


 
Visit Information Security Home |   Information Security News  |  Information Security White Papers  |  Information Security Videos  |  Information Security Resources