Twin brothers wipe 96 government databases minutes after being fired
112 points by jnord 21 hours ago | 59 comments

scottlamb 33 minutes ago
> [Opexus] said that “the individuals responsible for hiring the twins are no longer employed by Opexus.”

Getting close to the classic Monty Python line: "Those responsible for sacking the people who have just been sacked, have been sacked."

Jokes aside, stuff like this sucks because I suspect many employers will take from it the most extreme, dehumanizing lessons, e.g.: (a) make firings [edit: including lay-offs] as abrupt as possible including terminating all access immediately, (b) never give second chances to anyone with any sort of criminal record (even say decades old marijuana posession or something).

I'd prefer a more balanced version: limit unilateral access to sensitive systems in general (not just of recently-fired employees), when someone is fired immediately shut off particularly sensitive credentials if they do exist (but not their general-purpose login/email account), avoid hiring people convicted of wire fraud as sysadmins, hash your @!#$ing passwords, etc.

reply
tempaccount5050 19 minutes ago
When you are talking about access like they had "make firings as abrupt as possible including terminating all access immediately" not doing this is incompetence. This is absolutely a standard and has to be for these kinds of positions. I've never worked anywhere where it wasn't for the majority of IT staff. You meet with HR, someone clears your desk, and security walks you out.
reply
scottlamb 14 minutes ago
> When you are talking about access like they had "make firings as abrupt as possible including terminating all access immediately" not doing this is incompetence.

You're proving my point—employers take the most extreme lesson and it's considered expected practice. They absolutely should have immediately terminated the credentials that granted unilateral access to sensitive databases. (Ideally those would never exist in the first place—there are two-person schemes. A pair of bad actors...well apparently happens according to this article...but is far more unusual.) But employers regularly (but shouldn't) terminate all access including credentials that allow last email to colleagues exchanging personal contact info or something.

reply
tempaccount5050 5 minutes ago
Yeah I don't see why that's necessary. I'm sure you can always reach out to HR and ask (I have facilitated this in the past, pulling contact lists and phone numbers) but that also gives them ways to exfiltrate data. It's company data. Just think of all the info you have in your inbox. Unless you've managed offboarding for high level IT positions it seems harsh, but the risk is just too high to allow the user to do that stuff themselves.
reply
paulpauper 3 minutes ago
Jokes aside, stuff like this sucks because I suspect many employers will take from it the most extreme, dehumanizing lessons, e.g.: (a) make firings [edit: including lay-offs] as abrupt as possible including terminating all access immediately

The employee is always the last to know. This is standard fare.

reply
giantg2 11 minutes ago
How did they get access to 5k passwords? Are they being sent/stored in cleartext? This is the most baffling part of the article for me.

The second part I'm unclear about is how you could pass SOC2 when you aren't terminating account access simultaneously with the employment termination.

reply
inetknght 7 minutes ago
From the article, it sounds like the passwords are indeed stored in cleartext:

> On Feb. 1, 2025, Muneeb Akhter asked Sohaib Akhter for the plaintext password of an individual who submitted a complaint to the Equal Employment Opportunity Commission’s Public Portal, which was maintained by the Akhters’ employer. Sohaib Akhter conducted a database query on the EEOC database and then provided the password to Muneeb Akhter. That password was subsequently used to access that individual’s email account without authorization.

reply
soVeryTired 19 minutes ago
> On March 12, 2025, a search warrant was executed at Sohaib’s home in Alexandria. Agents grabbed plenty of tech gear but also turned up seven firearms and 370 rounds of .30 caliber ammunition. Given his former crimes, Sohaib should have had none of this.

For god's sake, don't commit crimes while you're committing crimes.

reply
paulpauper 2 minutes ago
Only commit one crime at a time
reply
chatmasta 19 hours ago
> At 4:58 pm, he wiped out a Department of Homeland Security database using the command “DROP DATABASE dhsproddb.”

This article is hilarious. The two bickering brothers remind me of the guys in the Oceans movies played by Casey Affleck and Scott Caan. It’s amazing they got this close to sensitive data.

reply
game_the0ry 30 minutes ago
> At 4:59 pm, he asked an AI tool, “How do i clear system logs from SQL servers after deleting databases?” He later asked, “How do you clear all event and application logs from Microsoft windows server 2012?”

So many red flags, I can't even.

reply
lostlogin 15 minutes ago
Ready access to AI tools sure makes vandalism easy.
reply
game_the0ry 4 minutes ago
Ai is just a tool. You can kill with hammer, doesn't mean you ban hammers. And they could have used stack overflow instead of ai.
reply
bmitc 19 hours ago
Those two in the movies were always a highlight for me, especially when the one joins the other in the Mexican factory riot.
reply
johnbarron 17 hours ago
I think its them on video: https://youtu.be/Rx19zOzQeis
reply
capibara13 26 minutes ago
A true professional always makes sure to leave their workspace completely spotless before going home
reply
lostlogin 15 minutes ago
So no guns and ammo?
reply
chrisra 21 hours ago
I have no problem with my credentials being revoked everywhere before I know about a layoff. I don't really care how I learn about it, just please don't make me come in to the office.
reply
nine_k 2 hours ago
> just please don't make me come in to the office.

But how do you pick up the stuff from your desk? I once lost a nice pair of headphones this way.

reply
paulpauper 47 seconds ago
ship it?
reply
jagged-chisel 2 hours ago
Meh. Don't leave anything at work. Forgo the convenience and carry your things on your commute. Use a bag. If there's "too much stuff", that's a sign to pare back what you "need" at work.
reply
whatshisface 13 minutes ago
I know this is not a good year on the job market, but if you are traveling to work with a "go bag" and not leaving coffee mugs on your desk to prepare for being laid off maybe it is time to carry that go bag to some other buildings...
reply
jdev-hn 2 minutes ago
[dead]
reply
afavour 10 minutes ago
God, if we're at the point where we're so paranoid about being laid off that we don't dare leave a single piece of personal property in the office then I think we're in a very dark place indeed. Can’t imagine the mental damage from considering losing your job every single day you wake up.
reply
cromka 49 minutes ago
I had my gym stuff in a gym locker. The reason I was able to commit to a gym routine was being able to get off my desk, get down the elevator, enter the gym and change in gym clothes in literally 5 minutes. I would never be willing to commute with all that gear. And I never got that gear back.

Still a net positive in my experience.

reply
ccimmergreen 18 hours ago
So this was why the FBI Director Kash Patel was in a panic when he couldn't log in one day. Revoking credentials before firing someone makes a lot of sense in security.
reply
lostlogin 13 minutes ago
> So this was why the FBI Director Kash Patel was in a panic when he couldn't log in one day

Ever tried to login with two factor and justify a maxed out company card while high as a kite and drunk?

It’s stressful.

reply
deepsquirrelnet 52 minutes ago
Professionally, he spells his name thusly: FBI Director Ka$h Patel, so you know he’s serious.
reply
tty456 25 minutes ago
Written in bourbon
reply
metalman 11 hours ago
no, becaus the simple and pragmatic solution for ANYONE who is subject to arbitrary termination, is to litter everything they build with caltrops and dead man triggers and then hint that they will go into "consulting" when fired.

I know of one case where this was totaly unintentional, and a machinest at a local pulp and paper plant had self delegated to write the software that controlled tension on the giant machines in the mill, but as it was his only real forey into sofware, nobody else could operate it, and they fired him after a manegment reshuffle, and then after the next scheduled shut down, nothing worked right, greasy dusty ancient screen with a blinking cursor was what they had, plugged into the important bits of a half sqare mile plant. still funny to think about!

reply
cj 2 hours ago
Or if you don't want to booby trap your code, buy one of those tiny devices that make a cricket noise randomly every 5-15 minutes, and hide it somewhere in the restroom.

https://annoyingpcb.com/

reply
zimpenfish 48 minutes ago
These are too obvious - 5-15 minutes gives your victim way too many opportunities to narrow down the location.

What you really need is one that chirps once every (multiple of) 20-28 hours (with weighting towards 23-25 to keep it roughly around the time you set it going and an infrequent skipping of a day.) Also with different volumes and, ideally, different chirps. Occasionally a double chirp just for extra insanity causing.

(A Michael Jackson "hee heee" would be another good option.)

reply
therobots927 2 hours ago
That is some top notch wrongthink… HN does NOT find it funny!
reply
xingped 19 hours ago
[flagged]
reply
libpcap 49 minutes ago
Nice handwritings, though.
reply
nostrademons 2 hours ago
> Muneeb Akhter asked Sohaib Akhter for the plaintext password of an individual who submitted a complaint to the Equal Employment Opportunity Commission’s Public Portal, which was maintained by the Akhters’ employer. Sohaib Akhter conducted a database query on the EEOC database and then provided the password to Muneeb Akhter.

WTF?

reply
game_the0ry 36 minutes ago
No back ups? Skill issue.
reply
iJohnDoe 16 hours ago
It’s crazy that people are desperate for jobs and these clowns get hired.
reply
alphawhisky 6 hours ago
Well, who else would you hire for the circus?
reply
hunterpayne 58 minutes ago
Perhaps don't hire people who act as foreign adversaries for government work? Is that really such an absurd proposition?
reply
lostlogin 11 minutes ago
> Perhaps don't hire people who act as foreign adversaries for government work?

Hilarious in the context of this administration.

reply
ChrisMarshallNY 53 minutes ago
I don't think they were spies. They have ethnic names, but it sounds like they are just good ol' red-blooded Yankee crooks.
reply
titanomachy 31 minutes ago
You can’t assume someone is foreign based on their name.

In fact I’d guess they’re not, since they’ve been employed on government projects since a young age.

reply
leptons 14 minutes ago
>who act as foreign adversaries

This does not mean they are from another country.

reply
leptons 16 minutes ago
Uhh... The guy in charge of the whole thing does things a foreign adversary would do. Has for years and he's back for round two. He even tried to overthrow the government once.
reply
kaikai 20 hours ago
How on earth did someone previously convicted of what sounds like hacking get job access to so many prod government databases? Wild that it took them so long to get caught.
reply
AlexB138 2 hours ago
I had the same questions. Apparently discovery of the prior conviction is what lead to them being fired:

> When the company discovered Sohaib Akhter’s felony conviction, it terminated both brothers’ employment during an online remote meeting on Feb. 18, 2025

from https://www.justice.gov/opa/pr/federal-jury-convicts-virgina... which is a better source on this.

That prompts the question of why background checks are so lax that they were hired before this was discovered.

reply
charonn0 59 minutes ago
The company involved here is apparently based in Washington, DC, which has a "Ban the Box" ordinance that limits employment background checks for most kinds of jobs. And apparently DC's version of the law is particularly strict.
reply
giantg2 4 minutes ago
Shouldn't this force companies that need to pass a SOC2 out of the district? Doesn't SOC2 require background investigation of personnel with access to sensitive systems?
reply
anonSrEng202309 2 hours ago
And I recently couldn't get a job through a federal contractor for a federal position (requiring NO security clearance) because they didn't like something on my credit report.
reply
sieabahlpark 2 hours ago
[dead]
reply
waterTanuki 20 hours ago
> On Feb. 1, 2025, Muneeb Akhter asked Sohaib Akhter for the plaintext password of an individual who submitted a complaint to the Equal Employment Opportunity Commission’s Public Portal, which was maintained by the Akhters’ employer. Sohaib Akhter conducted a database query on the EEOC database and then provided the password to Muneeb Akhter. That password was subsequently used to access that individual’s email account without authorization.

It should be a federal crime with prison time to make a DB for a federal agency and not hash and salt passwords or other auth credentials.

reply
mijoharas 8 hours ago
This is what I want to know. Are there any consequences for this contractor? At least fraud or negligence or something?
reply
cyanydeez 21 hours ago
so, apparently, the passwords were stored in cleartext.
reply
whynotmaybe 19 hours ago
Remind me of a forum a long time ago that sent me my password in clear when I used the "forgot password" link.

When I advised them that it was a bad idea to store password in clear, they answered that they keep it in clear so that they can send it when someone forget.

Defeated by such argument, I deleted my account.

reply
syntheticnature 2 hours ago
In my free time, I help maintain the web presence for a small non-profit org with memberships. The original system when I started helping was a bespoke system that was smart in many ways (essentially a static site generator with membership control years before SSGs were cool, with regular automated tests), but the guy who wrote it absolutely insisted on storing passwords in plaintext and could not be convinced otherwise. Eventually he had to drop the volunteer position due to other things in life, and the first thing we did was correct this issue.
reply
miki123211 54 minutes ago
There was a screenshot of some website floating around a few years ago, where if you entered the correct password but a wrong username, it would helpfully tell you which user the password is really for.
reply
nodesocket 16 minutes ago
Product manager; “That’s a great UX.”
reply
SoftTalker 52 minutes ago
Gnu Mailman still does this, and sends a monthly reminder email of your password.
reply
scorpioxy 16 hours ago
I've got a better one. I once had the same argument mentioned to me by my manager at the time when I pointed out that passwords were being stored in clear text. That it needs to be this way so that it is read/sent when the users forget their passwords(which happened a lot). I tried to explain that typically a "reset password" flow is used for that but that fell on deaf ears. That system contained healthcare data.

Something bad did end up happening due to that lax security and there were oh so many meetings about it.

reply
bluefirebrand 52 minutes ago
> Something bad did end up happening due to that lax security and there were oh so many meetings about it.

This is the sort of thing that makes me want to check out of the whole circus. Here I am, telling you ahead of time, and you ignored me

So how there's a circus that we could have avoided and not only do I get zero recognition for identifying the threat ahead of time, the people who ignored me keep their jobs and turn it into a zoo where everyone is scrambling in endless meetings

And I've seen it play out a few times. After a point, why bother...

reply
tetris11 5 hours ago
Greetings, Bioconductor
reply