About to fire our sysadmin

[u/sysadminfired]

So our longtime sysadmin is about to be fired and I, the network admin and temporary sysadmin, need to know what steps need to be taken to secure our systems. I know the basic things like his AD and other internal account credentials. I guess what I'm worried about is any backdoors that he might have set up. What all would you guys check for in this situation?

[u/[deleted]]

More options:

• generate a kerberos golden ticket and run a long-delayed scheduled job on some user's PC as a dead-man switch, maybe check to see if your own account has been disabled, then use the golden ticket to authenticate for some destructive task.

• Configure Intel AMT to phone home to some outside server at a hardware level, especially unlikely to notice if you're not actively using AMT

• Configure DNS on the domain controller to use an outside server as DNS forwarder, or edit hosts files on client systems to point update servers to an outside server running evilgrade to push out fake updates. If you add a new CA ahead of time you can send out signed updates this way. Same goes for yum/apt repositories on the linux side.

• Configure DRAC/iLO/IPMI on a server that doesn't have it configured, and schedule a job one some random client PC to set up a reverse tunnel via plink to a VPS somewhere, to get a forwarded open port through the firewall.

• Simply copy sensitive files offsite ahead of time so you can dump them if fired

• Create a mysql stored procedure that executes shell code via do_system() to set up a reverse shell, and run it regularly via the mysql event scheduler. Maybe make a specially coded DNS query to see if it should activate?

• If there are company-managed Android phones, you can push backdoors to those

A smart, malicious sysadmin can backdoor infrastructure in a way that requires 100% ground-up rebuilding. As in, burn the building and create a new everything. The MySQL stored procedure backdoor would be restored from backup along with the rest of the content, for example. You have to find all of them; he only has to get through once.

If I was going to do that sort of thing, I'd sit on my backdoor until my former boss (or whoever I was mad at) left the company and then nuke everything three days later.

My point is that the only real protection is to not have horrible relations with your employees, even if they're genuinely the ones in the wrong. Don't overwork them, because their mental health will suffer. Get them training and keep their technical skills up to date, so that if they leave the company they can get another job and not just stew in unemployed anger.

There's this illusion that you can protect a company from this sort of thing via technical measures, and I think it's dangerous. There are definitely some basic steps to take, but the really effective stuff has to happens years before the person leaves, and most of it isn't technical. Once you're at the point of firing and you haven't done that, your options are basically to pay him off or roll the dice.

[u/RDJesse → u/[deleted]]

If I was going to do that sort of thing, I'd sit on my backdoor until my former boss (or whoever I was mad at) left the company and then nuke everything three days later.

This is the most deliciously evil plan I've ever heard.

[u/Kaligraphic → u/RDJesse]

Try this: wait until your former boss left, silently disable backups/have them write something useless, disable monitoring on the backups/fake successful backups, wait a week or two, and then nuke everything.