Developer outsources his job to China, watches cat videos
Posted: Jan 17th, 2013, 5:34 am
An investigation into a quiet software developer's browsing history found he'd been secretly subcontracting his job to a Chinese firm so that he could surf Reddit and watch cat videos at work, according to a blog post by security experts at U.S. telecom firm Verizon Enterprise Solutions
"We received a request from a U.S.-based company asking for our help in understanding some anomalous activity that they were witnessing in their [virtual private network] logs," said Andrew Valentine, a forensics manager at Verizon in a post on the the company's website on Wednesday.
The company at which the man worked, which is not named on Verizon's blog, discovered in May 2012 that someone in Shenyang, China, was using an employee's log-in information to access their network – a service set up two years earlier so employees could work virtually from home on certain days.
The log-in belonged to "Bob," a mid-40s family man with a "relatively long tenure with the company," Valentine said. "Someone you wouldn’t look at twice in an elevator."
"Plainly stated, the VPN logs showed him logged in from China, yet the employee is right there, sitting at his desk, staring into his monitor," says Valentine. "Based on what information they had obtained, the company initially suspected some kind of unknown malware that was able to route traffic from a trusted internal connection to China, and then back.
Verizon investigators were called in to help and seized Bob's computer for clues, suspecting an external attack may have come from a corrupted download.
"What we found surprised us – hundreds of PDF invoices from a third party contractor/developer in [you guessed it] Shenyang, China," Valentine said.
The quiet and inoffensive employee had been outsourcing his job, for about a fifth of his six-figure salary.
According to the blog post, a typical ‘work day' for Bob looked like this:
• 9am: Arrive and surf Reddit for a couple of hours, watch cat videos
• 11.30am: Take lunch
• 1pm: eBay
• 2pm-ish: Facebook updates, LinkedIn
• 4.40pm-end of day: Update email to management
• 5pm: Go home.
Valentine writes the best part of the investigation was being able to see Bob's performance reviews while they worked alongside the company's human resources department.
"His code was clean, well written, and submitted in a timely fashion," Valentine said. "Quarter after quarter, his performance review noted him as the best developer in the building."
http://www.cbc.ca/news/yourcommunity/20 ... stead.html
"We received a request from a U.S.-based company asking for our help in understanding some anomalous activity that they were witnessing in their [virtual private network] logs," said Andrew Valentine, a forensics manager at Verizon in a post on the the company's website on Wednesday.
The company at which the man worked, which is not named on Verizon's blog, discovered in May 2012 that someone in Shenyang, China, was using an employee's log-in information to access their network – a service set up two years earlier so employees could work virtually from home on certain days.
The log-in belonged to "Bob," a mid-40s family man with a "relatively long tenure with the company," Valentine said. "Someone you wouldn’t look at twice in an elevator."
"Plainly stated, the VPN logs showed him logged in from China, yet the employee is right there, sitting at his desk, staring into his monitor," says Valentine. "Based on what information they had obtained, the company initially suspected some kind of unknown malware that was able to route traffic from a trusted internal connection to China, and then back.
Verizon investigators were called in to help and seized Bob's computer for clues, suspecting an external attack may have come from a corrupted download.
"What we found surprised us – hundreds of PDF invoices from a third party contractor/developer in [you guessed it] Shenyang, China," Valentine said.
The quiet and inoffensive employee had been outsourcing his job, for about a fifth of his six-figure salary.
According to the blog post, a typical ‘work day' for Bob looked like this:
• 9am: Arrive and surf Reddit for a couple of hours, watch cat videos
• 11.30am: Take lunch
• 1pm: eBay
• 2pm-ish: Facebook updates, LinkedIn
• 4.40pm-end of day: Update email to management
• 5pm: Go home.
Valentine writes the best part of the investigation was being able to see Bob's performance reviews while they worked alongside the company's human resources department.
"His code was clean, well written, and submitted in a timely fashion," Valentine said. "Quarter after quarter, his performance review noted him as the best developer in the building."
http://www.cbc.ca/news/yourcommunity/20 ... stead.html
His work responsibilities were being fulfilled, his performance review confirms that.