As part of a court exhibit, prosecutors in San Francisco revealed 150 usernames and passwords. However, officials say the network is secure.
UPDATED:
San Francisco prosecutors accidentally leaked user names and passwords
to the city's network, but officials say the network is safe. The
District Attorney's office revealed 150 user names and passwords when
they entered them as evidence in the case against Terry Childs, the
network admin who locked the city out of its own network for nine days
in July.
The tale of the rogue network admin at the
city and county of San Francisco continues to roll on with the IT world
watching incredulously.
In the latest update to the 15-day-long caper, prosecutors from
District Attorney Kamala Harris' office submitted personal-access
passwords and user names in an exhibit for court reference last week as
evidence in their case against Terry Childs, the network architect and
administrator who held the city's WLAN hostage for nine days in a professional disagreement with his manager.
A listing of about 150 user names and passwords of city officials for
access into the system was submitted as evidence as part of the public
record of the trial. After the passwords were discovered by the press
earlier today, they were "redacted" from the record, DA spokeswoman
Erica Derryck explained to me.
ADVERTISEMENT
"The codes were always going to be used as evidence against Mr.
Childs, and these [active] passwords have been changed as part of the
process of undoing a situation that began with Mr. Childs' alleged
criminal conduct," Derryck told me.
It was not determined as to whether the usernames and passwords
were active at the time they were first introduced as evidence to the
court on July 23. The changeover to new passwords happened at
approximately the same time.
Derryck said that a court date to set a preliminary hearing date for
Childs will be held in late September -- most probably either Sept. 23
or 24.
The prosecutors claim that Childs' possession of these passwords proves
he had too much power and posed an internal threat to the network, and
thus, the city. Prosecutors also claimed that Childs could use the
passwords to impersonate legitimate users and obtain illegal access to
parts of the system where he was not authorized.
Childs, 43, was arrested on July 13 on four felony charges of tampering
with the city's FiberWAN network. He changed several high-security
passwords and refused to hand them over to department managers after
claiming that his managers couldn't be trusted to run the system
themselves. He also claimed they had been negligent about allowing
viruses and malware into the system.
The nine-day standoff was broken July 23 after Childs divulged the network login codes to Mayor Gavin Newsom
during a jailhouse meeting. Despite a hearing with a judge Thursday in
an effort to lower his bond, Childs remains in jail in lieu of $5
million bail.
Childs, who resides in Pittsburg, Calif., is the chief designer of the
system's FiberWAN, which contains about 60 percent of the city's
sensitive human resources, payroll and other personal data.
Data from San Francisco's servers always have been able to be accessed;
entry into the network switches and routers -- which control the flow
and direction of data input/output -- is what was locked down by Childs.
The system ran on virtual autopilot for about 10 days while Department
of Technology head Ron Vinson and others tried to regain access during
the standoff. Vinson has yet to address the press about this ongoing
issue.