[ISN] N.H. state server eyed in possible credit card data breach

[InfoSec News]

http://www.computerworld.com/securitytopics/security/story/0,10801,108896,00.html

By Todd R. Weiss 
FEBRUARY 22, 2006
COMPUTERWORLD

The FBI, the Department of Justice and New Hampshire officials are 
investigating a potential security breach after the Cain & Abel 
computer worm was found on a state Department of Motor Vehicles (DMV) 
server during a routine security check last week. 

The state's Office of Information Technology said in a statement that 
no evidence has been found that indicates any user credit card 
information was accessed. Residents who used the state server for 
transactions were warned to keep an eye on their credit card 
transaction histories, but state officials said no illegal credit card 
use has been reported. The server held only credit card numbers, with 
no other personal information. 

New Hampshire state CIO Richard C. Bailey Jr. said it is still not 
clear how the worm -- a variation of a legitimate application, the 
Cain & Abel password recovery program for Microsoft products -- was 
placed on the server. That could have been done from inside the 
state's system or over the Internet. No other instances of the worm 
have been found on other servers in the state network, Bailey said. 

An unnamed employee at the state's Office of Information Technology 
(OIT) was placed on paid leave as part of the investigation, Bailey 
said. He declined to comment further. 

The worm was found during a routine security checkup as IT workers 
were evaluating a network intrusion system from Cisco Systems Inc., 
Bailey said. The Cisco Security Monitoring, Analysis and Response 
System appliance was used by the IT workers to look for anomalies, 
track them down and stop any threats, he said. 

The Cain & Abel worm could allow an intruder to watch activity on the 
server, according to the OIT. 

The affected server was taken last week by the FBI, which is 
conducting forensic analysis on it to try to determine how the worm 
was placed on it. In addition to being used by the state DMV, the 
server is also used by the New Hampshire Veterans Home and as a backup 
system for the state's Liquor Commission. The DMV and Veterans Home 
use the server to transmit financial information, while the Liquor 
Commission uses it as a backup system for sales transactions in state 
liquor stores. 

"As of yesterday, no one had reported an instance in which their 
credit card information had been compromised, which we're taking as a 
good sign," Bailey said. 

Pamela Walsh, a spokeswoman for the New Hampshire governor's office, 
said the ongoing investigation will probe whether the Cain & Abel worm 
was ever activated on the server to look at the stored credit card 
numbers. "We don't know at this point [that] it that actually 
happened," she said.