A former Fannie Mae IT contractor has been charged with planting malicious software on the mortgage giant's systems on the day he lost his job last October.
Rajendrasinh Makwana, 35, who at the time was a contract employee at Fannie Mae, planted a nasty custom script designed to wipe out about 4,000 of the company's servers on Jan. 31, 2009, according to a sworn affidavit from Federal Bureau of Investigation Special Agent Jessica Nye. Makwana was indicted Tuesday by a federal court in Maryland on a charge of computer intrusion.
The script was installed on Fannie Mae's servers less than an hour after Makwana was told that Oct. 24 would be his last day at the company, Nye said. It was discovered five days later by a Fannie Mae Unix administrator, who found it tagged on to the end of a legitimate script designed to check that the data-center's storage area network was running correctly.
"The malicious script was at the bottom of the legitimate script, separated by approximately one page of blank lines, apparently in an effort to hide the malicious script within a legitimate script. It was only by chance that [the Fannie Mae administrator] scrolled down to the bottom of the legitimate script to discover the malicious script," Nye said.
Makwana had been working as a Unix administrator at Fannie Mae's Urbana, Maryland, data center for nearly three years at the time of the incident. A Fannie Mae spokeswoman declined to comment on the matter.
He had apparently been in hot water before his termination. Nye said that he was fired because two weeks before the incident he had "erroneously created a computer script that changed the settings on the Unix servers without the proper authority of his supervisor."
From Nye's account, the code was nasty. It was set to lurk silently on the computer's network until Jan. 31, 2009, when it would catalog all servers in the company's data center, reset root passwords, destroy backup software and wipe out all data on the servers, and then power them off. "Had this malicious script executed, [Fannie Mae's] engineers expect it would have caused millions of dollars of damage and reduced if not shutdown operations at [Fannie Mae] for at least one week. If this script were executed, the total damage would include cleaning out and restoring all 4,000 ... servers, restoring and securing the automation of mortgages, and restoring all data that was erased," Nye said.
Engineers attempting to log in to the servers would be denied access and simply given the message "Server Graveyard."
Makwana was arrested in Richmond, Virginia, on Jan. 7. His court-appointed attorney did not return a call seeking comment for this story.