Developer convicted for “kill switch” code activated upon his termination

I worked for a company once that installed a remote-activation killswitch in their drivers, as a secret weapon to force the customer to stay current on their maintenance contract.

The CEO was a fuckup however, and the code killed their system even without being activated - resulting in a bunch of angry phonecalls and some of the most egregious lying I've ever heard.

god, he was a piece of shit

Sounds like lawsuit territory

This kill switch, the DOJ said, appeared to have been created by Lu because it was named "IsDLEnabledinAD," which is an apparent abbreviation of "Is Davis Lu enabled in Active Directory."

Lu named these codes using the Japanese word for destruction, "Hakai," and the Chinese word for lethargy, "HunShui,"

Lu]’s "disappointed" in the jury's verdict and plans to appeal

No, this guy is cooked, there’s even evidence of him looking up how to hide processes and quickly delete files, absolutely no way an appeal would work out for him, I don’t think an “I got hacked” argument is going to work.

It would only work if he owned the code and the company stopped paying. There's lots of precedent for that.
- Still probably not. The code also deleted files, deleted accounts, and created infinite loops which took down large chunks of the network and infrastructure.
  You could take your code, but you can't take down the company.
It's actually kind of worrisome that they have to guess it was his code based on the function/method name. Do these people not use version control? I guess not, they sure as hell don't do code reviews if this guy managed to get this code into production
- I assumed that the code was running on a machine that Lu controlled.
  Most companies I have worked at had code reviews, but it was on the honor system. I am supposed to get reviews for all the code I push to main, but there is nothing stopping me from checking in code that was not reviewed (or getting code reviewed and making a change before pushing it). My coworkers trust me to follow the process and allow me to break the rules in an emergency.

Lol everyone probably fantasizes about such thing sometimes, but even if you weren't caught, it's not worth it to personally be bitter like that.

Just got laid off and could had done the same. Except I don't have to. Internal systems are so bad and undocumented and I was like only IT specialist there who could use linux, and so many things related to core businesses were just basically behind me.

The kill switch has made it self. Funny how I would have written more documentation if I ever was given the time.

Same for my last job. My bosses and managers harassed and insulted me. They said I was useless and stupid.
I quit with 3 months of "notice" (standard in France to help you find a new job). They didn’t care during those 3 months. In the last week they panicked because they could not find a replacement that did everything I fixed every day.
I also interviewed my replacement, a junior out of school with big diplomas. When I asked if he knew Linux, he said "not really." I thought "they are fucked with this guy." They wanted to hire him because he was the son of some guy. I said to my boss that he would be a perfect fit for the company.
Unknowingly I was the kill switch. I sent them one last email with all the information they needed and told them to go fuck themselves in a polite way.
- malicious compliance, I like it
but even if you weren't caught, it's not worth it to personally be bitter like that.
Really depends on what you do for a living... Non-profit? Sure. Weapons manufacturer? Fucking have at it.
- But don't be stupid about it. Stash a date somewhere that you manually update every so often (so that it'll stop being updated if you're fired) and then add a bunch of random waits whose durations scale with the time since that date. If you're worried that the code will be found, comment it with some bullshit about avoiding race conditions.
  ...and now I can't use that idea, since this comment would be used in court. If I did it to a weapons manufacturer, they'd probably get the death penalty somehow.
- Fair but I wouldn't ever work for weapons manufacturing. Also sabotage in that context would have heavy punishment, and at worst could cause collateral damage.
I didn't plant anything and I could still brick the production backends of a former employer because some poor ass decisions were made when choosing technologies and then when I pointed it out that it's pretty bad the technology was stuck with so literally all it takes is sending 2-3 requests so all pods die.
But why do it.
- Similar cases with my old company. In my case people who would had suffered the most direct consequences would had been my colleagues who I respect.
  But I could totally cause trouble without any backdoor access.

I’m disappointed they found so much in his search history. Do these people not have phones? In this day and age with everyone carrying a smartphone, there’s no excuse for using work computers for personal activities

Did it say they went through his work search history? Everything you search on Google with your IP or through your account is recorded, in case law enforcement knocks. Don’t think using a phone protects you. Use a trusted VPN in a separate browser if you want to search for things and not have them show up in court.
- I think that what happens on a work computer, a work network, belongs to the company and they are free to check it at will.
  However my phone, and what happens on the network it’s attached to are between me and my provider, and usually needs a warrant for someone to look through.
In this day and age with everyone carrying a smartphone, there’s no excuse for using work computers for personal activities
There are plenty of reasons, mostly amounting to "Nobody tends to give a fuck" and "I'm not running out to buy a second high end laptop just to casually browse the web from my couch on the weekend".
What you've got is a very poorly enforced, very draconianly executed set of deliberately vague and inarticulate rules that vary from company to company. And none of that really has anything to do with the "kill switch" thing. In the same way you might say "Well but obviously nobody should smoke weed in a state that criminalizes it! That's just stupid!" when you've got the police tearing apart a particular person's house for a completely unrelated issue, based on an officer's exclamation of "I smell weed!" at the front porch.
Just accept you live in a police state and stop buying into excuses made to surveil and punish.
- I’m not running out to buy a second high end laptop just to casually browse the web
  Even the cheapest laptop or tablet will cover that need
  But when you’re at work, planning criminal activities, the least you can do is save your searches for “how to be a criminal mastermind” on your personal phone
don't underestimate how lazy and stupid even the smartest person can be.
- I feel targeted :-)

Why do kill switches when you can just hog all the work of maintaining some critical part of the infrastructure and make it's functioning and maintenance so opaque and impenetrable that the employer can't replace or fire you without their shit catching fire soon after. It doesn't have to be malicious or illegal.

https://youtu.be/0jK0ytvjv-E

His efforts to sabotage their network began that year, and by the next year, he had planted different forms of malicious code, creating "infinite loops" that deleted coworker profile files, preventing legitimate logins and causing system crashes

I wish this guy was were actually politically motivated, but he seems to have been just really petty minded person.

Why do kill switches when you can just hog all the work of maintaining some critical part of the infrastructure and make it's functioning and maintenance so opaque and impenetrable that the employer can't replace or fire you without their shit catching fire soon after.
This is literally my firm's core business practice. We've been at it for so long that at this point we have to be included in competing bids because we are the only ones in the world that can do certain specific things.
That's what my old company used to do. You did this? Do a KT to some underpaid remote employee and when they leave it's again your responsibility to maintain it, alongside the new bugs and spaghetti they introduced.
We once told a SP50 customer that we would not provide a business critical service because an employee went on sabatical for a month and she had the only working version on her cookery computer. At that point the customer was so integrated with us that it would take them years to replace us.

So when company do it it's fine but when we do it to companies it's not?

Naturally. Advantage, privilege and money should only be in the hands of those who run large companies or better.
If that made you angry, bear in mind that's what most top level company executives think. Well, actually they don't think it, they know it unconsciously as the true order of the universe they inhabit and they get really uncomfortable should it even look vaguely like someone might be trying a competing philosophy to their own.
To be fair though, most people get really uncomfortable when something might undermine even part of the philosophy they live by.
Literally the same day as HP *activating a "kill switch" code for their printers.
- what happened?

Every person that has worked in a sysadmin type role, has joked about doing something like this. Very few actually carry through with it. So, in a way, I kinda like this guy for actually doing it, even if he didn’t cover his tracks very well.

For the last time, I didn't leave a kill switch -- I just refused to document anything!

You are truly a madman
Edit: or a madlady
- M'lady

Look at me, I am the killswitch now.
I work on a small team and recently realized my boss is falling victim to survivorship bias. Another colleague and I handle our work, which is mission critical to the org, competently and fairly opaquely, only raising issues as they arise. However some other members of our team have less critical but more visible work that they tend to bungle. The department invests hiring dollars, training efforts, and materials purchases in service of remediating those issues. But my colleague and I are both burned out, eyeing the door, and fully aware there’s no one who understands what we do or is capable of doing it within our organization - aside from each other, but our respective scope of work is non-overlapping and there’s truly not wiggle room to cross train or support each other’s work. I’ve said all I know to say to leadership about this issue but they seem willfully ignorant.
When one of us goes, I think the other will follow quickly. Hiring takes almost 2 months at my work, so the gap/lack of knowledge transfer will make for a huge shit show.
- You burning out is a process failure. Work normal hours and let shit fail 🤷‍♂️. Say the reduction in hours is "health related" so they can't pry.

I'd argue that he gave them extra code, a bonus if you will.

We've all considered it

Oh yeah, but the thing that usually offsets the intrusive thoughts is a lot of courts treat this as the crime of "hurting rich people" which comes with like 30 years in pound you in the ass penitentiary.
- Oh. Personally for me it's code reviews that prevent me from doing it, but pound you in the ass penitentiary is a good motivation too

Initially makes me wonder how the employer could be so dumb as to give one employee so much access. But then I remember a former employer of mine did the same and worse.

Colleague was known for writing his comments in such a way that only he could read them, including mixing in German (US based company doing all business in English). He was also the admin of our CAD system and would use it as leverage to get his way on things, including not giving even default user access to engineers he didn't like. We migrated systems and everyone was thinking, "this is it, the chance to root this guy out of the admin position" and... they gave him admin access again. Not even our IT department had the access he had. I left before the guy retired / was fired, this post is making me wonder if he left peacefully or left bricking the CAD system out.

My previous work didn't revoked my access to their CMS. I was so upset when they laid me off after telling them my wife is pregnant.
But I ain't that stupid.
- Aren't you no longer binded by profesional silence? Just log in into their DB, export it and try to get a seller
Initially makes me wonder how the employer could be so dumb as to give one employee so much access.
The amount of access he had doesn't surprise me. He'd been there for 11 years already likely working on many things as he interacted with systems in the course of his legitimate work. While its possible to set up access and permissions in an organization utilizing the "least privilege principle", its expensive, difficult to maintain, and adds lots of slowdowns in velocity to business operations. Its worth it to prevent this exact case from the article, but lots of companies don't have the patience or can't afford it.

Talk about incentivizing us to make even more impactful kill switches!

A 55-year-old software developer

... and...

Lu had worked at Eaton Corp. for about 11 years when he apparently became disgruntled by a corporate "realignment" in 2018 that "reduced his responsibilities," the DOJ said.

So he was 48 at the time he started this. Was he planning on retiring from all work at 48? I can't imagine any other employer would want to touch him with a 10ft (3.048 meters) pole after he actively sabotaged his prior employer's codebase causing global outages.

I'm sure DOGE is actively considering hiring him.

He fucked up. But it's also kinda funny.

Tbh, what shocks me the most about this is how sloppy this appears to have been executed.

and unlike dennis nedry, he didn't have to get killed by a dinosaur to do it.

I developed a spreadsheet for a company I worked for a few jobs ago. When I left I used a picture of Dennis to lock everyone out of the spreadsheet but only for one day, months after I left. Stupid idea, but felt good.
Edit: this was it:

guy really tagged his name on the kill function, which was running on his own system. smh my head

That’s hilarious.

Dude should have just added comments indicating that the code was part of some security test but was unfinished and extremely dangerous.

Change a few file names, add a comment how it will never run under normal circumstances, and you've got plausible deniability.

And now imagine doing this or sort of this destruction in a smaller company that has one to three mediocre admins at highest. One can kill this company and they would never get it why the computers got weird.

I actually think I want to give this guy a pat on the back

Part of me sympathizes with the guy, but this was reckless

Koala tea internal code review practices

Honestly, if I had done something like this and they twigged to it, I’d consider just fucking off and joining the French foreign legion.

Sometimes I wonder what my old employer would do if I didnt fix their problems, let alone a killswitch. They clearly didnt know how to hire anyone to fix their problems