[Dataloss] Hacker hits Georgia state database via hole in security software

[security curmudgeon]

---------- Forwarded message ----------
From: InfoSec News <isn at c4i.org>


http://www.computerworld.com/securitytopics/security/holes/story/0,10801,110094,00.html

By Jaikumar Vijayan
MARCH 30, 2006
COMPUTERWORLD

An unpatched flaw in a "widely used security program" was exploited by an 
unknown hacker to gain access to a Georgia Technology Authority (GTA) 
database containing confidential information on more than 570,000 members 
of the state's pension plans.

The intrusion occurred sometime between Feb. 21 and Feb. 23 and involved a 
hacker who used "sophisticated hacking tools" to break through several 
layers of security after accessing the server hosting the database via the 
software flaw, said Joyce Goldberg, a GTA spokeswoman.

Goldberg refused to name the security vendor whose software was exploited, 
citing an ongoing investigation. She added, however, that the 
vulnerability exploited by the hacker had already been publicly disclosed 
by the vendor,

"We were in the midst of fixing the flaw that the software vendor had 
identified. But the hacker got in before we were able to do that," she 
said. "Shortly after the breach, we saw some unusual activity, and in 
looking at that, we discovered the breach."

Goldberg declined to elaborate on what that unusual activity was.

The breached server contained information on a total of eight pension 
plans administered by the state. The core database itself was managed by 
the state Employees Retirement System, though the server it was hosted on 
was administered by the GTA.

At this point, there is no evidence that confidential information, 
including names, Social Security numbers and bank-account details, have 
been misused, Goldberg said.

Even so, the GTA is sending out letters to 180,000 affected employees for 
whom it has contact information, she said. The state does not have current 
addresses for the remaining 373,000 individuals affected and is relying on 
media reports and its own outreach efforts to inform them of the potential 
compromise of data, Goldberg said.

The Georgia Bureau of Investigation is investigating the incident. The GTA 
is also bringing in outside security advisers to do a security assessment, 
the agency said in a note posted on its site.

This is the second major breach involving the GTA in the past year. In 
April 2005, the GTA disclosed that a state employee had downloaded 
confidential information belonging to more than 450,000 members of the 
state's health benefit plan onto a home computer.

Since that breach, the GTA has implemented several measures to tighten 
security, including stricter password controls, more timely reviews of 
logs and alerts, more extensive employee background checks and stricter 
control of access confidential data, according to the GTA's Web site.

Incidents such as this highlight the dangers companies face when the 
software they rely on to protect their data itself turns bad, said Lloyd 
Hession, vice president and chief technology officer at BT Radianz, a New 
York-based provider of telecommunications services to financial companies.

"The most important point to remember [from such incidents] is that you 
don't want to be overly dependent on a single vendor's product" for 
security, Hession said.

Earlier this month, a faulty antivirus update from McAfee Inc. mistakenly 
identified hundreds of legitimate programs as a Windows virus, resulting 
in the accidental deletion of significant amounts of data from company 
computers that had the faulty software installed on them.

Two years ago, the Witty worm, which was reported to have damaged 15,000 
to 20,000 computers worldwide, took advantage of a flaw involving the 
BlackIce and RealSecure intrusion-prevention products from Atlanta-based 
Internet Security Systems Inc. The worm wrote random data onto the hard 
disks of vulnerable systems, causing the drives to fail and making it 
impossible for users to start up the systems.

Such incidents highlight quality lapses that sometimes occur when security 
vendors try to rush out products to keep up with security threats, Hession 
said. "Security vendors have to adapt very quickly to new threats," 
resulting in very short development and testing cycles, he said.

With security products, "the perception is that it should be more reliable 
than other software," which is not always the case, said Ken Dunham, 
director of the rapid response team at VeriSign Inc.'s iDefense Labs unit. 
IT managers need to remember that all software is susceptible to errors 
that pose security risks, he said.