Mar 7: a federal jury in Cleveland convicted Davis Lu of writing and deploying malicious code on his former employer’s network.
Lu was employed as a software developer by power management solutions provider Eaton Corporation in Beachwood, Ohio from Nov 2007 to Oct 2019. Following a 2018 corporate realignment that reduced his responsibilities and system access, Lu began sabotaging his employer’s systems. By Aug 4, 2019, he introduced malicious code that caused system crashes and prevented user logins.
Specifically, he created “infinite loops” (in this case, code designed to exhaust Java threads by repeatedly creating new threads without proper termination and resulting in server crashes or hangs), deleted coworker profile files, and implemented a “kill switch” that would lock out all users if his credentials in the company’s active directory were disabled. The “kill switch” code — which Lu named “IsDLEnabledinAD”, abbreviating “Is Davis Lu enabled in Active Directory” — was automatically activated upon his termination on Sep 9, 2019, and impacted thousands of company users globally. Lu named other code “Hakai,” a Japanese word meaning “destruction,” and “HunShui,” a Chinese word meaning “sleep” or “lethargy.” Additionally, on the day he was directed to turn in his company laptop, Lu deleted encrypted data. His internet search history revealed he had researched methods to escalate privileges, hide processes, and rapidly delete files, indicating an intent to obstruct efforts of his co-workers to resolve the system disruptions. Lu’s employer suffered hundreds of thousands of dollars in losses as a result of Lu’s actions.
The federal jury convicted Lu of causing intentional damage to protected computers, for which he faces a maximum penalty of 10 years in prison. A sentencing date has not been set yet.
cleveland.com/court-justice/
justice.gov/opa/pr/texas-m
bleepingcomputer.com/news/security/
