McDanel did contact managment on several occasions prior to sending the emails out. There were weblogs on his system from Tornado staff visiting his page prior to him informing anyone about the problem.

McDanel included a solution to this problem, to not click on links in email, but instead cut and paste the url into a new browser. The problem had to do with HTTP_REFERER information, Tornado claimed that the *name* of a CGI variable that appeared on the location bar as part of the url was a *trade secret* at one point!!! I have a hard time seeing how anything in the url that you can see is in any way secret or confidential.

McDanel sent emails at a rate of 10 wait 1.5 seconds then 10 more.. This works out to about 6.67/second. The system logs prove that the system had no cpu problems until after admins logged in and shut sendmail (as well as pop3, and httpd) down. As soon as they shut sendmail down no amount of sending mail will cause any cpu load. They did this to delete the already delivered emails (in violation of 18 USC 2701). He did not crash the email server, there was even testimony that people read the email first, then made the decision to take the system down to delete the email.

McDanel did a couple of things that were really dumb. The first was crashing his former employer Tornado’s email system by flooding it. This is malicious and he was just lucky that the company didn’t manage to put together a case that by themselves his three flood attacks caused the requisite $5000 in damage.

Second, he wanted to inform the customers about a vulnerability in the Tornado software that might put the customer’s confidential data at risk, a laudable goal. But by its nature, there is no way to distribute that kind of information without also informing the bad guys of the possible exploit. This is a current hot topic in the vulnerability community. The emerging consensus is that the right thing to do is to inform the company that you are going public with the information and give them a reasonable advance notice, of perhaps two to a few weeks. McDanel did not do so, apparently, and although he had tried to get the company to fix its problems while an employee, they had no way to know that once he left he would go public with the data.

Going beyond what is right and wrong here, as a practical matter it was foolish for McDanel to associate his name with his actions by including in his warning email links to a web site he controlled. I would suggest that he should have posted the information anonymously, if he decided it needed to be propagated. This accomplishes his goals and would have protected him against his 16 months in prison.

I should add BTW that based upon personal experience I agree that Jennifer Granick is worth her weight in gold!