Fired employee deleted servers, causing it to lose S$918,000

Re:Fired employee deleted servers, causing it to lose S$918,000 by tmtvl on Wednesday June 12, 2024 @04:11PM (#40662509)

Remember: sometimes a simple 'rm' may not be good enough, that's why the gods of GNU gave us 'shred': https://linux.die.net/man/1/shred

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by craftkiller on Wednesday June 12, 2024 @05:00PM (#40663064)

Well, the file was found on his laptop and laptops are pretty much exclusively using SSDs. On SSDs a simple `rm` is enough. On an SSD:

    1. You run rm
    2. Your filesystem uses trim to mark the pages as invalid
    3. The drive's garbage collector finds blocks containing invalid pages and consolidates valid pages into new blocks and marks the old blocks as invalid.
    4. Then the drive resets the block to empty and marks it as available.

This improves write performance because SSDs can only write to empty pages (they cannot overwrite pages that have already been written, instead they'd have to first reset the page and then write a new page) so by proactively resetting pages, they have pages ready to be immediately written.

But this also means that the blocks containing your deleted file will be proactively reset/emptied which means it will uncharge the cells which is equivalent to all the bits being `1`, thereby destroying the file.

Source: https://kcall.co.uk/ssd/index.html

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by tmtvl on Wednesday June 12, 2024 @05:34PM (#40663400)

Cool, I learned something interesting today, thanks!

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by jihadjihad on Wednesday June 12, 2024 @04:06PM (#40662454)

> incrementing evidence

It just keeps piling up!

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by Rinzler89 on Wednesday June 12, 2024 @03:34PM (#40662052)

I assume he had to give up the decryption credentials when he handed the laptop for the investigation. Not complying with the investigation can make it worse for you in some places.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by Rygian on Wednesday June 12, 2024 @04:11PM (#40662510)

That's why you have two decryption keys. One for the real stuff, one that decrypts to a decoy.

https://veracrypt.eu/en/VeraCrypt%20Hidden%20Operating%20Sys...

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by akira2501 on Wednesday June 12, 2024 @04:13PM (#40662543)

Yep. All very good advice on how to better conceal your crimes.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by averageRoyalty on Wednesday June 12, 2024 @05:43PM (#40663526)

Or hide anything you wish to from those who want to use the wrench method. You're allowed to have things to hide without being a criminal.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by nanomonkey on Wednesday June 12, 2024 @04:11PM (#40662514)

Plausibly deniable encryption exists for a this very reason.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by patrulek on Wednesday June 12, 2024 @03:38PM (#40662110)

Cant you just forget decryption credentials during the investigation?

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by ceejayoz on Wednesday June 12, 2024 @03:43PM (#40662167)

Sure. They may not believe you, though.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by meepmorp on Wednesday June 12, 2024 @11:46PM (#40665743)

I'd rather have the 14 years of my life than $2.5 million I can't even use. People are weird.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by eddd-ddde on Wednesday June 12, 2024 @04:12PM (#40662521)

There are double encryption systems. You give your "password" and they access a volume, where another encrypted volume isn't even apparent.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by Rinzler89 on Wednesday June 12, 2024 @03:48PM (#40662234)

You can, but depending on the justice system in your area, you might not want to.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by constantcrying on Wednesday June 12, 2024 @03:37PM (#40662098)

>full disk encryption is a thing.

Just actually get rid of the evidence. Throw your laptop into a shredder and buy a new one. At least get a new hard drive.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by kstrauser on Wednesday June 12, 2024 @03:49PM (#40662247)

Intent: thinking through this from a problem-solving perspective. Don't do this crap, kids, lest ye end up in prison or worse.

Or at least do a full wipe (including backups) and reinstall. "Here's my FDE key, but I erased everything after I left that place and I don't have their stuff anymore."

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by clvx on Wednesday June 12, 2024 @03:56PM (#40662335)

Use a throwaway disk or device, get rid of that and leave the official one alone.

I discourage this behavior but there could be many cases when this could be useful.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by ceejayoz on Wednesday June 12, 2024 @03:40PM (#40662124)

I can't speak for Singapore's specifics, but outright destroying evidence is often its own crime.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by freeone3000 on Wednesday June 12, 2024 @03:48PM (#40662233)

Good luck proving it!

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by ceejayoz on Wednesday June 12, 2024 @04:12PM (#40662532)

In a country where possession of chewing gum is illegal and 14 grams of heroin geets you a death sentence, I'm not sure I'd want to test the practical limitations of the burden of proof on that sort of thing.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by exe34 on Wednesday June 12, 2024 @04:26PM (#40662704)

probably easiest to buy a second hand laptop, do the thing and then low level format the disk with a hammer.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by constantcrying on Wednesday June 12, 2024 @04:29PM (#40662734)

But you already committed the crime, surely that alone will be much worse than a completely unprovable charge of destruction of evidence.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by ceejayoz on Wednesday June 12, 2024 @04:59PM (#40663056)

Some legal systems permit inference of guilt ("spoliation inference") based on attempts to destroy evidence; you might wind up with just extra convictions this way.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by Spooky23 on Wednesday June 12, 2024 @03:47PM (#40662213)

For this individual, it's a little late to close the barn door.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by proneb1rd on Wednesday June 12, 2024 @04:14PM (#40662557)

With SSD drive it’s enough to simply wipe the drive clean.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by technick on Wednesday June 12, 2024 @04:11PM (#40662501)

I assume Kandula was a microsoft user and it's widely suspected there's a backdoor for law enforcement.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by averageRoyalty on Wednesday June 12, 2024 @05:46PM (#40663547)

On built in disk encryption? I'd be surprised if security researchers hadn't found that target. Got a source? Who credible suspects this?

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by technick on Wednesday June 12, 2024 @08:00PM (#40664491)

NSA and FBI both approached previous bitlocker devs to insert backdoors in the early days. It's no secret Microsoft cooperates with federal government branches to ensure the government keeps using their products. Further because bitlocker is closed source, there hasn't been any outside research done on the code.

https://boingboing.net/2013/09/11/how-the-feds-asked-microso...

Some good comments here:

https://old.reddit.com/r/sysadmin/comments/26vm25/why_is_the...

There's more resources on google and I remember attending a talk at either blackhat or defcon on why you shouldn't be using bitlocker.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by dookahku on Wednesday June 12, 2024 @03:35PM (#40662066)

i dunno what privacy/civil laws are like there, but couldn't the police or courts compel Kandula to surrender the password?

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by ceejayoz on Wednesday June 12, 2024 @03:42PM (#40662153)

I suspect so.

https://en.wikipedia.org/wiki/Caning_in_Singapore

https://en.wikipedia.org/wiki/Human_rights_in_Singapore#Priv...

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by StarterPro on Wednesday June 12, 2024 @04:03PM (#40662434)

Run a VM on a portable linux distro, delete the VM, easy days.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by technick on Wednesday June 12, 2024 @04:13PM (#40662536)

Easier to run tails or other live distros that don't store anything on disk and then run memtest afterwards.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by averageRoyalty on Wednesday June 12, 2024 @05:46PM (#40663558)

He was googling for "how to delete VMs script" to do the initial attack, I think you overestimate his opsec capability.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by ocodo on Thursday June 13, 2024 @01:50AM (#40666334)

He had an opsec capability? I assumed he'd never heard of opsec.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by aswanson on Wednesday June 12, 2024 @03:34PM (#40662060)

Probably thought he was safe in his country. You can be tech literate and international criminal law illiterate.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by mvdtnz on Wednesday June 12, 2024 @03:42PM (#40662154)

He moved back to Singapore, where he committed the crime.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by jamesrr39 on Wednesday June 12, 2024 @04:10PM (#40662497)

Not just moved back there, but used the company Wi-Fi network!

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by aswanson on Wednesday June 12, 2024 @04:59PM (#40663048)

My bad. Should have rtfa. Guess he's just an idiot.

[ Parent | on HN ]

Re:Fired employee deleted servers, causing it to lose S$918,000 by paulpauper on Wednesday June 12, 2024 @05:45PM (#40663542)

lol 34 people replied to this. I think this ranks in the top 10 of my most replied to posts ever. But no change in votes.

[ Parent | on HN ]