美国一程序员将工作外包给中国程序员 自己每天上网冲浪

美国电信运营商Verizon的安全审计发现，美国某公司的一位顶尖程序员将自己的工作外包给中国沈阳的一家软件公司。
Verizon为该公司的雇员提供了VPN允许他们在家里工作。内部的审计发现，公司明星程序员Bob的VPN登陆日志显示他固定的从中国沈阳访问公司主服务器。调查排除了恶意程序或黑客入侵的可能性。Verizon的进一步分析发现，Bob雇用了沈阳的一家软件咨询公司去做他的日常编程工作，通过FedExed提供了他的双步认证令牌，将薪水的五分之一支付给外包公司，自己则去上网冲浪，比如在Reddit上逛几小时，然后去吃饭，再上ebay血拼，更新Facebook 和LinkedIn，最后给经理发送每日工作邮件，上床睡觉。他的计划一直行之有效，在公司人力资源眼里他是最高效的程序员之一，被认为是C, C++、Perl、Java、Ruby, PHP和Python方面的专家。目前Bob已被解雇。

———

Security audit finds dev OUTSOURCED his JOB to China

Cunning scheme netted him ‘best in company’ awards

By Iain Thomson in San Francisco • Get more from this author

Posted in Security, 16th January 2013 01:29 GMT

A security audit of a US critical infrastructure company last year revealed that its star developer had outsourced his own job to a Chinese subcontractor and was spending all his work time playing around on the internet.

The firm’s telecommunications supplier Verizon was called in after the company set up a basic VPN system with two-factor authentication so staff could work at home. The VPN traffic logs showed a regular series of logins to the company’s main server from Shenyang, China, using the credentials of the firm’s top programmer, “Bob”.

“The company’s IT personnel were sure that the issue had to do with some kind of zero day malware that was able to initiate VPN connections from Bob’s desktop workstation via external proxy and then route that VPN traffic to China, only to be routed back to their concentrator,” said Verizon. “Yes, it is a bit of a convoluted theory, and like most convoluted theories, an incorrect one.”

After getting permission to study Bob’s computer habits, Verizon investigators found that he had hired a software consultancy in Shenyang to do his programming work for him, and had FedExed them his two-factor authentication token so they could log into his account. He was paying them a fifth of his six-figure salary to do the work and spent the rest of his time on other activities.

The analysis of his workstation found hundreds of PDF invoices from the Chinese contractors and determined that Bob’s typical work day consisted of:

9:00 a.m. – Arrive and surf Reddit for a couple of hours. Watch cat videos

11:30 a.m. – Take lunch

1:00 p.m. – Ebay time

2:00-ish p.m – Facebook updates, LinkedIn

4:30 p.m. – End-of-day update e-mail to management

5:00 p.m. – Go home

The scheme worked very well for Bob. In his performance assessments by the firm’s human resources department, he was the firm’s top coder for many quarters and was considered expert in C, C++, Perl, Java, Ruby, PHP, and Python.

Further investigation found that the enterprising Bob had actually taken jobs with other firms and had outsourced that work too, netting him hundreds of thousands of dollars in profit as well as lots of time to hang around on internet messaging boards and checking out the latest Detective Mittens video.

Bob is no longer employed by the firm. ®