IT Worker Indicted For Setting Malware Bomb At Fannie Mae

A former IT contractor at Fannie Mae, angry at being terminated in October, has been thwarted in his attempt to crash all 4,000 servers at the mortgage services institution and wipe out all of their data.

According to a report from the U.S. Department of Justice, a federal grand jury in Maryland has indicted Rajendrasinh Babubhai Makwana, a contractor working at Fannie Mae's Urbana, Md., facility, for transmitting a malicious script to the company's servers. The malicious code, which was set to execute on Jan. 31, was designed to propagate throughout the Fannie Mae network and destroy all of the company's data, the DoJ says.

According to court documents, Makwana -- who was employed by OmniTech, a third-party contractor that handles server administration for Fannie Mae -- was censured by management on Oct. 10 after unintentionally distributing a server script without authorization. The documents suggest the mistake was so egregious that Makwana probably knew he would be fired, although his administrative rights were not revoked until hours after his official termination on Oct. 24.

Apparently, Makwana had been busy before he was kicked off the system. On Oct. 29, five days after Makwana had left the company, a senior Unix engineer found a malicious script buried in a legitimate script that validates the storage area network connections among the company's 4,000 servers every morning at 9 a.m. A page break had been inserted between the malicious script and the legitimate script, making it less obvious.

The malicious script was set to execute multiple tasks, all of them bad. First, it would wipe out all of the passwords on the servers, effectively locking administrators out. Then it would build a list of all servers that contained Fannie Mae data and wipe out all of the data, replacing it with zeros. This would also destroy the backup software on the servers, making the restoration of data more difficult because new operating systems would have to be installed on all servers before any restoration could begin, the court documents say.

The script would also remove all "High Availability" software from any critical server, the complaint continues. Then it would power off all servers, disabling the ability to remotely turn on a server. After the second run-through, the script would remove all of the files on the current host and try to zero out the root file system.

"Had this malicious script executed, [Fannie Mae] engineers expect it would have caused millions of dollars of damage and reduced, if not shut down, operations at [Fannie Mae] for at least one week," the complaint says. "If this script were executed, the total damage would include cleaning out and restoring all 4,000 [Fannie Mae] servers, restoring and securing the automation of mortgages, and restoring all data that was erased."

Makwana faces a maximum sentence of 10 years in prison. He had his initial appearance in federal district court on Jan. 6, following the filing of the complaint. Arraignment is scheduled for Jan. 30, 2009.

Industry experts warn that such exploits may become more common as the economy forces companies to lay off an increasing number of employees. Enterprises should be careful to terminate all data and administrative access rights for the affected employees before they have the opportunity to act in retribution, the experts warn.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message