Insider Attempted to Destroy Pharmacy Databases

You don’t hear too much about logic bombs anymore. But one Medco systems administrator tried to launch a logic bomb and was busted by other sysadmins on the network. A logic bomb is a piece of code written to perform a damaging routine at a specific time or when the right condition is triggered. Usually logic bombs delete critical data or worse, encrypts data with a key known only to the attacker.

From the AP here:

NEWARK, N.J. – A Medco computer administrator upset over the possibility of losing his job planted an electronic “bomb” in the systems of one of the nation’s largest prescription drug management companies, prosecutors said Tuesday.

Even after surviving a round of layoffs, Yung-Hsun Lin, 50, kept the code in the system and tinkered with it in an attempt to set it off, prosecutors said. The bug eventually was discovered and neutralized by the company.

Among the targeted databases was one that tracked patient-specific drug interaction conflicts, prosecutors said. Before dispensing medication, pharmacists routinely examine that information to determine whether conflicts exist among a patient’s prescribed medicines.

In addition to the drug-interaction information, other data on the targeted servers included patients’ clinical analysis, rebate applications, billing and managed-care processing.

Authorities said that on Oct. 3, 2003, Lin created the bomb designed to delete virtually all data from the 70 targeted servers by modifying existing computer code and adding new code. It allegedly was set to detonate automatically on April 23, 2004 ? his birthday.

Due to a programming error, it didn’t go off. Even after surviving a round of layoffs, prosecutors said, Lin modified the bomb’s code to have it detonate on his next birthday. But the company found and disabled it before it could cause any damage.

The New York Times has another little bit of info on the attacker here:

Mr. Lin, who was born in Taiwan and came to the United States in 1987, used a Chinese translator during a brief court hearing Tuesday at which his bail was set at $500,000. He will formally enter a plea at arraignment, scheduled for Jan. 3. He could face 10 years in prison if he is convicted.

So the pharmacy company decided to grant access to critical backend databases to a non-English speaking foreign national? That was a risky move. They need to do more checking around to see if other crimes, such as intellectual property was stolen too.