Liberating Businesses from Data Blackmail
Data is the core of every business, be it the names of their customers, when a delivery should be carried out, or even the business accounts. In a drive to scale a business and grow its efficiency, it is common for businesses to adopt software solutions, but, what happens if their software vendors try to hold their data hostage? In this article, KW Tech Solutions would conduct a deep dive into this growing phenomena, based on actual experiences to demonstrate how businesses can be free from data blackmail.
Background
Company A engaged vendor A, who positioned themselves as a cheap outsourced IT vendor, for over a decade. Vendor A sold an inventory and accounting system, as a wholly bespoke solution that is owned by Company A. However, the vendor secretly installed backdoors in the client’s system to allow them to automatically disable the system without any reason, to justify maintenance fees for effectively no real work done. Vendor A managed to get away with it due to Company A not having an in-house IT team/expertise. When Company A attempted to upgrade or change out the system in any way, Vendor A remotely disabled its functionalities and requested large sums of money to re-enable or upgrade the system.
Some of the backdoors includes
- Unattended remote access systems to allow the vendor to access the clients systems without anyone knowing
- Automated systems to copy the client’s data to their personal system, before disabling access to it for the client.
Company B engaged Vendor B for over two decades for their accounting and customer management system, for a relatively niche industry with few other vendors in the country. The software provided was extremely antiquated, with obvious limitations such as only allowing for a single user to edit any information at a time. This is despite charging a significant sum for a per-user licences. Any attempts at changing their systems (such as exporting their data) or upgrading the current system were ignored.
The software developed by Vendor B was clearly designed to extract every cent out of their client base, with an extremely explicitly lock in built into any relevant function which includes
- Having to email them for a key, every time there was a need to add and account for a new project or location
- Automated, monthly disabling of the system, requiring an email to be sent in to receive a key to restart the system
Approach
Based on the prior experience of the expert consultants at KW Tech Solutions, the situation was approached with a very core fundamental assumption – the vendors would use the cheapest method with the most corners cut to get the job done, even if it is for their moneymaking lock-in functions.
To that end, we set out to
- Align what could be found on the backend, with that which is shown to the user through the frontend user interface
- Recorded the processes and steps taken to retrieve all relevant information, in a robotic, repeatable manner
- Clone the system and look for any potential backdoors, or methods that the vendor can use to invent new issues (to squeeze out more money from the companies)
Challenge
While working on trying to safely retrieve the company’s data that were effectively being held ransom by their vendors, we faced some challenges due to the relatively superficial security and things done behind the scenes. Some examples of which would be available below.
- Vendor A
- Implemented a redirect from the login screen after the software “broke and required maintenance services”
- Hid their implementation of unattended FTP access from appearing in the usual FTP logs
- Vendor B
- Hid scheduled tasks to trigger jobs that would automatically disable the system on the client’s computer
- Limitation to the maximum number of document stored, with a key generation system to expand it
Findings
Turns out, both vendors stored all relevant data for the business locally on the company’s system, with a paper thin security. This perfectly fell in line with our assumption of cost-cutting (to avoid storage and network cost on the vendor’s end).
- Vendor A simply installed MSSQL on the client’s local PC to store the data, with a password that was not conveyed to company A
- Vendor B’s system stored all relevant information for their software in a zip file that was hidden on the client’s NAS
Such questionable “security” methods employed by the vendor exposes a lot about how they view their clients. They essentially do not respect any of their client’s intelligence or potential expertise when it comes to anything related to IT.
The technological framework used behind the scenes were antiques, with nearly no attempts made to upgrade it – even when upgrades would barely take a single man day. From what we can tell, most work and innovation by both Vendor A and Vendor B went into finding and creating new ways to squeeze out more money from their clients, with the absolute bare minimum of work put into trying to pass as a product.
Furthermore, we discovered that there was an extreme amount of bloat in their system. We found code and data written for other industries, including populated tables of dress measurements, credit card information, and others for a tailoring business. This is despite it not being relevant or even of a similar industry.
Solution
In essence, the solution we employed to break our clients free from their previous IT Vendor’s Data Blackmail were extremely simple, but, required extensive experience and expertise.
- Customer A
- We simply accessed the database as an administrator through windows authentication, before accessing and exporting the relevant information
- We compared the raw data seen in the database with that on the frontend, to map and piece together what every table was supposed to correspond with
- Customer B
- Inspected changes to the computer’s disk when any information was updated into the system, to discover the hidden zip file on the NAS
- We simply unzipped the hidden zip file, and pieced together the documents found
Conclusion
It is extremely important to trust your business data with vendors who will not blackmail you, who are committed to growing with you for the long term. Costing should not be the main (and only) concern, always remember that if an IT “expert” is selling you something so cheaply that they cannot survive, how can you trust that your systems and data would survive? Furthermore, if they are so cheap (and somehow survive), they must still earn their money somehow. This would usually come from you down the line. Corners will be cut. Blackmail and data hostage taking would likely happen.
If you or any business you know is facing this situation, feel free to reach out to KW Tech Solutions for a free, no-obligation consultation.
