Attorneys at Butera & Andrews claim an unidentified hacker working within IBM’s WebSphere services facility in Durham, N.C., secretly dropped malicious code into the firm’s e-mail server, giving him or her unauthorized access to the system. The IBM worker “initiated, directed and managed this attack from the Durham, North Carolina facility,” Butera & Andrews claims in a lawsuit. The firm says its servers were hit by the assailant’s code more than 40,000 times throughout 2005.
In its complaint, filed in April in the U.S. District Court for Washington, D.C., Butera & Andrews gives no motive for the attack. However, it says it fingered IBM because an IP address traced to the computer initiating the attacks is registered to a system inside the IBM facility.
Butera & Andrews also charges IBM with maintaining lax security procedures at the Durham facility, thus making it easier for would-be hackers to carry out their work undetected. The lawsuit states that IBM last year implemented a policy under which all computer user logs at the facility are wiped clean after 24 hours. The policy “assures anonymity for any wrongdoer,” the firm charges.
IBM has filed a motion to dismiss the suit. Among other things, the computer vendor claims that the IP address identified in the suit belongs to Workforce.com, an unrelated Web publication that operates from Michigan. A trace of the IP address conducted by InformationWeek confirms that the address is registered to Workforce, which is owned by Crain Communications. Butera & Andrews maintains that the address belongs to IBM, even if Workforce is currently “residing” at the addresss. It says it has documents that prove the link.