COI Report – Part IV
Page 129 of 425
381. Wee was copied in an email from Benjamin to Veerendra at am on
13 June 2018, in which Benjamin mentioned the obtaining of the server image of Citrix Server 1, which was referred to by its hostname. Wee has explained that this was the first time he recalls a server image being acquired for forensics. He has explained that he “could not tell what kind of server Benjamin was
investigating, based only on the hostname mentioned”, and that he was waiting for Benjamin’s investigation findings.
22.3 Setting-up the TigerConnect chat group
382. After meeting with the Citrix Team on the morning of 13 June 2018, Benjamin created a chat group called “Citrix-SCM Incident on the
TigerConnect messaging platform to discuss the events of 11 and 12 June 2018, and to update members of the chat group on his findings and actions taken. Persons added to the chat group included Ernest, Zac, Azzlan, Alvin Chua Yu Long, and Benjamin from the SMD; Lum from the Citrix Team and Cluster ISO Wee.
383. On the chat group, IHiS staff discussed the events that occurred on 11 and
12 June 2018, including the failed logins to the SCM database, and the use of workstations with unusual hostnames to access Citrix Server 1 from May 2018 onwards.
384. Ernest has explained that he was overseas until 18 June 2018, and did not read the messages on the TigerConnect chat group before then.
385. Wee has explained that his recollection of the updates on the chat group regarding the multiple attempts to login to the SCM database on 11 and 12 June
2018 using multiple usernames was “very vague”, and he “cannot recall if (he)
saw this update”. However, he also represents that had he seen the update, he
“would have questioned more about how this had occurred.”
At the same time, Wee “vaguely remembers” Benjamin mentioning workstation VM 2, and the collection of images of affected endpoints. He was of the impression that
|
