Medco sys admin gets 30 months for planting logic bomb

A former systems administrator at Medco Health Solutions was sentenced to 30 months in federal prison this week for planting a logic bomb that could have taken down a corporate network that held customer health care information.

Yung-Hsun Lin, 51, who faced a maximum of 10 years in prison, pleaded guilty to one count of computer fraud in September. He was responsible for programming and maintaining the servers at Medco, where he worked from 1997 to 2005.

The court also ordered Lin to pay US$81,200 in restitution to the company, and to serve two years of supervised release after he completes his prison term. He was forbidden from working on computers during his prison time and supervised release as well.

This is believed to be the longest federal prison sentence for an attempted crime intended to damage a computer system, according to the US Attorney's Office.

"This case is unique in that it touches on the public health system," Assistant US Attorney Erez Liebermann told Computerworld. "Other logic bomb and intrusion cases have dealt mostly with money. Not to belittle that -- it's a very, very serious issue. But they hadn't risen to being a risk to human beings. ... A stiff sentence like this sends the message to companies that it's important to report these crimes, and when you do, the criminal justice system will take this seriously. When companies come forward with these crimes, it's worth their while, and if someone is caught, even in the attempt stage, they will get a stiff sentence."

Liebermann said that in court this morning, Lin, who is also known as Andy Lin, apologized to Medco, to his family and to the court.

The logic bomb, which was designed to delete "virtually all of the information" on about 70 Medco servers, was made up of malicious code that Lin wrote and planted in multiple scripts on the company network, according to court documents. It was designed to trigger at a certain time and date. That didn't happen, though. The first time the logic bomb was set to go off, a coding error kept it from working. And before the second time it was set to go off, one of Lin's own co-workers discovered the code hidden amidst a slew of other scripts and shut it down.

Finding the logic bomb was quite a feat, according to Liebermann, who called it a "sophisticated" attack. He explained that Lin used innocuous names to disguise the files holding the malicious code. He also went into the system's file properties and made it appear that they were old files and not something recently added that might need checking out.

However, Lin had another trick up his sleeve. He embedded different pieces of the malicious code in four different scripts. It would be difficult for an administrator to interpret it without seeing all of the malicious code together; he would have to look at the different scripts to get a real sense that something malicious was going on, Liebermann said.

"On January 1, 2005, a Medco employee was working on another problem," Liebermann said. "He went to check it and saw a call to another script, and that script has a call to another script. He did a great job and dug all the way down and discovered the logic bomb."

Liebermann noted that if the bomb had taken down Medco's network, people using a Medco prescription card would not have been able to fill any new prescriptions. "That could be very serious, maybe even life-threatening, depending on the need for that medication," Liebermann said.

Page Break

He also noted that pharmacists around the country regularly tap into the Medco system to find out if patients' new prescriptions will interact badly with their current medications. If the malicious code had worked, pharmacists would have had no way to make sure a new prescription wouldn't put a patient's health at risk.

Such a situation could have caused grave financial and public relations trouble for Medco, which handles health insurance prescription benefit plans and is reportedly the largest mail-order pharmacy operation in the US. The company is based in Franklin Lakes, N.J.

Sentencing documents noted that in his role as systems administrator, Lin had access to Medco's network, which is made up of about 70 HP Unix servers, and that he was "proficient" in coding for them. The network contained applications related to clients' clinical analyses, coverage applications and billing, as well as corporate financial applications and employee payroll input. The network also ran the company's Drug Utilization Review, a database of conflicting drug interactions, as well as patient information.

In September 2003, as part of a restructuring after Medco was spun off from parent company Merck & Co., its Unix group merged with an e-commerce group. As part of that merger, "a number" of systems administrators were laid off in October of that year, according to government records. Lin did not lose his job.

Sentencing records also show that Lin began trading e-mails with his co-workers that September, discussing the anticipated layoffs. Then, in October, he sent an e-mail saying he was unsure whether he would survive the upcoming layoffs.

That same month, Lin modified existing code and inserted new code into pre-existing scripts on the Medco servers. Sentencing documents show that Lin wrote the code to delete nearly all the information on the affected servers, along with the Drug Utilization Review database, billing data and subscriber lists.

The logic bomb initially was set up to be triggered on April 23, 2004 -- Lin's birthday -- but it failed to launch because of a coding error. In September 2004, Lin changed the code to fix the error and reset it to deploy on April 23, 2005.

During the sentencing hearing today, Lin's attorney argued that his client simply made a mistake. Liebermann, however, argued that this was far from a mistake. "We said a mistake is something you make once," he said. "You fly off the handle and make a mistake. He had from October 2003 to January 2005 to wipe it out and he didn't."