Intel sues former staffer for allegedly stealing Xeon cloud secrets in USB drives and exploiting info at Microsoft Intel has accused a former staffer of not only leaving the manufacturer with a trove of confidential documents but also trying to use the information they contained to help Microsoft. In a lawsuit [PDF] filed on Friday in a federal district court in Oregon, Intel said Dr Varun Gupta spent a decade at Chipzilla before departing …
Someone is leaving after 10 years who has access to "a trove of confidential documents" and you still allow totality free access to them on their last day of employment. At best they should have been on gardening leave with the very least they should have done is restrict their access to files towards the end of their notice.
Intel may have "some impressive forensic capabilities" but it fails very much on document control.
“fails very much on document control” that does seem to be the case. But I find it hard to believe Intel would not have put him on gardening leave for the period of his notice and locking him out of their systems the moment he told them he was going to leave.
If that is the case and the files were taken after he told Intel he was going to leave it looks like he did not originally plan to take the files when he left. If he were planning to take the files surely, he would have done that before announcing he was leaving when he knew he still had access to them. Not condoning the theft but looks like a crime of opportunity.
I can attest that Intel does indeed wall the garden much tighter after you give notice. I worked in the Oregon development fab 11 yrs ago before moving on. At least in the fab, most employees who gave notice would be escorted to the door and have their cube packed up & shipped to them, especially if they were going to work for any company deemed a competitor. I wasn't going to any such company so I was allowed to linger and tie things up for the couple weeks. However, my email was restricted to outgoing only and the fab badge was collected. It was like sort of like being a ghost.
>At least in the fab, most employees who gave notice would be escorted to the door and have their cube packed up & shipped to them
A bit pointless, if you knew you were going to leave you would already have copied anything before telling HR.
A bit like someone retiring after 40years and on their last day you have security march them out in case they are going to steal office supplies.
"Gupta moved 3,900 internal documents from his company laptop to two external USB-based drives "
And how exactly was that possible ?
As a consultant, I have access to the servers of a number of customers. Not one of them allows USB ports to work without administrative approval. I might be able to charge my mobile with a cable, but the computer is not going to allow the PC to access the phone.
How is it that someone who is leaving has access to a computer that lets him connect whatever he wants to a USB port and transfer files to it ?
Serious security fail.
1. Attach networked device to a spare ethernet port(Raspberry Pi or alternative)
2. Zip documents
3. encrypt e,g openssl enc -aes-256-cbc -in files.zip -out files-enc.zip
4. sftp and send the files, or run a web server on your remote device and send via https
(Sorry i do spend a lot of time thinking about this every time IT tell me that I cannot use USB ports to transfer data to my embedded controllers)
Any decent corporate Windows config wouldn't allow that to happen either, and even if it did it would be present in the logging that two ethernet ports had been active on the PC at once which would put you in IMMEDIATE suspicion even if they didn't know exactly what that second device was.
Any decent corporate Windows config wouldn't allow that to happen either
Really? There are many reasons that a 2nd ethernet port may be needed.
Even if they were not allowed, laptops have this habit of being taken home where they have to be connected to 3rd party networks, 3rd party wifi links. Unless the company policy is to ban all ethernet and wifi links there is a limit to what can be controlled. Anyone with a bit of technical nounce and determination can get around such barriers, and in a way which makes detection nigh impossible.
So why bother? well the USB ban was bought in more to avoid accidental loss of data on unencrypted data, however the move to network stores has made a lot of that moot. Secondly it keeps controls the low-level company espionage down, both by active policing, adding the big-brother fear factor and distinguishing between accidental and malicious information stealing . But largely I suspect its there because it makes the CEO feel good, and any weaknesses are just glossed over
People doing this wouldn't share the documents/photos with others, they'd share the information they'd gleaned from them. They don't tell their boss "here's a copy of some Intel confidential material to help us in our decision" they say "well in my experience I think Intel would do x, so I recommend y" and when it turns out they're right their bosses are happy because they got inside info while maintaining plausible deniability - so if found out they can feign horror at the criminal act and wash their hands of the guy!
Even if it doesn't say "Intel confidential" or "Top Secret property of US government" you can't know if they've done something to modify a few pixels that encode information like your username or email address so you'd be stupid for sharing the document - whether a photo, printout or a copy that had (supposedly) such watermarks removed. If it is really sensitive you can't know if they haven't changed a few details in your copy that are different in someone else's copy that will bite you later, like how mapmakers would place fictitious islands or bogus details of shoreline to catch those who would copy their maps.
Impressive forensic capabilities, no shit Sherlock bloody impressive. Not only could they tell what make of USB drives were connected but also which files were downloaded to which drives.
With those forensic capabilities and the highly confidential information they knew the soon to be ex-employee had access to hence the confidentiality agreement. I would have thought they would have checked to see what he had downloaded before he signed and left. I am not saying Intel security was lax maybe it would be deemed out of order to do that kind of forensic check, an invasion of privacy.
I suspect Intel has gigabytes of logs of people connecting external drives and downloading stuff, and if they investigated them all (even from departing employees) they'd need a lot more staffing for their security team. If they didn't have people who need to do this as part of their workflow (if only because they find it helps them work more efficiently) they would simply ban USB storage connection or only allow whitelisted storage devices owned by Intel and suitably encrypted so they wouldn't work when connected to non-Intel owned PCs.
They were clearly alerted to this by the guy using Intel proprietary knowledge and doing the digging after the fact to find out what information he had accessed. In a way that's smart - if you catch the guy when he's walking out the door you can't prosecute because he hasn't attempted to misuse the info. If you wait until he does, you can send him away for a few years for theft of trade secrets and set a MUCH better example when word of jail time gets around to other Intel employees versus "hey did you hear when Bob was walking out they stopped him and he had copied some data onto an external drive earlier that day so they made him erase it before he could leave?"
Not really...
A client uses Panda Adaptive Defense 360 (ie. a mainstream security offering aimed as small businesses). Within the device security section you can configure much of this behaviour.
Although AD360's device security is a little basic, so block the connection of modems and it will report every time someone plugs their phone in to charge...
"If nothing else, this tells us that Microsoft and Intel both have some impressive forensic capabilities."
Most enterprise Endpoint security suites* can log and control USB devices based on vendor ID's, serial numbers, etc - and log all files copied. (It might also be natively possible in Windows...)
Some customers only approve encrypted drives, only approving drives from a specific manufacturer, only approving drives with known and approved (by IT) serials, or combinations of the above to absolutely block unapproved devices and prevent breaches. (Same with Cloud Storage.)
More of an abuse of trust, than a technical failure...
*Anon as I work for such a vendor.
The lesson learned is to view documents slowly, over time, and capture their contents using a video capture device between monitor and laptop, while accessing everything remotely from home. Then you can use that knowledge bit by bit without leaving a trail behind. Correctly configured capture devices won't affect presented EDIDs and such but might break HDCP, which is so buggy anyway that it can't be used as forensic evidence anyway...
The capture device would be connected to an entirely separate computer to do the dumping, leaving no events to give away the changes. The funniest part about this approach is that the more invasive the auditing is, the more overconfident the company will be that nothing has leaked when you leave.
See no evil, hear no evil.
I'm thinking that all that has to happen is to capture the MAC address of any device mounted on the network - the OUI prefix gives you the manufacturer, and it could probably be narrowed down to a specific device instance with the assistance of the OEM. See, e.g., Wireshark OUI Lookup Tool
USB devices also have prefixes and codes similar to MAC addresses. It allows the OS to figure out what device has been connected, what type it is, who the manufacturer is (for the driver), which model etc.
So, if they (Intel) went through the Windows registry to discover portable drives with specific prefixes identifying manufacturers and models, they would've been able to provide that information to Microsoft, who would've been able to spelunk through the registry of both the system on-site at Microsoft and any other device issued to the staffer to see if devices with that prefix/identifier/serial number had ever connected.
So, whilst not MAC address, there is still an address of some sort involved :-)
By this time Intel had asked Microsoft for help. The Windows giant, we're told, discovered the first drive had been used within its walls, including on Gupta’s Microsoft-issued PC.
Is anyone else surprised that MS didn't block USB drives? I'm assuming there's someone in the company who knows how to do it...
"If the reason for the alleged data theft is to benefit the new employer (MS) then why are they co-operating with the Intel investigation, or am I missing something obvious?"
For starters, the goal could have been to benefit Microsoft, but could also be to benefit the employee as in "That guy always gets the good prices from Intel. Let's give him a raise". Someone stealing information might want to avoid telling the new employer that he's going to use illegal means to benefit them; they might be pleased and go along with the crime, but they might turn him in. Much safer just to help them without telling them what you're doing, bag the rewards, and have the ability to do the same with someone else in case they don't give you as much reward as you want. I think it's more likely that Microsoft was surprised to here this happened rather than expect the corruption to go to the top.
Meanwhile, whether that's the case or Microsoft wanted to commit the crime, it's dangerous not to go along with the investigation. Stealing data is illegal. If they can claim that Microsoft did it, Intel gets a ton of money and Microsoft gets investigated by law enforcement. Microsoft isn't going to let that happen. Also, if this ever happens in reverse, Intel will help Microsoft investigate too. No reason to throw that away.
Because MS (and its executive suite) doesn't want to be prosecuted / fined as a party to a crime?
It is a little hypocritical, as they presumably hired the guy in the first place partly because he knows something incidental about Intel. On the other hand, it's not in their interest to be a blatantly criminal enterprise.
Hardly........
"impressive" forensics.......
GLPI & the fusion-inventory engine tracks all drives + serial numbers plugged into computers....
It even pulls manufacturers data..
As does "bit defender" cloud.... these are hardly "expensive" products....
once you have this info, it's just a simple action of cross-referencing what files were downloaded to the machine during that time.
you have gone from tens of thousands of employees to a single employee.... in two steps.
I worry when a top level rag is impressed by even the most rudimentary low level Software products...., what's next?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
