http://www.computerworld.com/securitytopics/se
curity/holes/story/0,10801,110094,00.html
By Jaikrishna Vijayan
MARCH 30, 2006
COMPUTERWORLD
An unpatched flaw in a "widely used security
program" was exploited by
an unknown hacker to gain access to a Georgia Technology
Authority
(GTA) database containing confidential information on more
than
570,000 members of the state's pension plans.
The intrusion occurred sometime between Feb. 21 and Feb. 23
and
involved a hacker who used "sophisticated hacking
tools" to break
through several layers of security after accessing the
server hosting
the database via the software flaw, said Joyce Goldberg, a
GTA
spokeswoman.
Goldberg refused to name the security vendor whose software
was
exploited, citing an ongoing investigation. She added,
however, that
the vulnerability exploited by the hacker had already been
publicly
disclosed by the vendor,
"We were in the midst of fixing the flaw that the
software vendor had
identified. But the hacker got in before we were able to do
that," she
said. "Shortly after the breach, we saw some unusual
activity, and in
looking at that, we discovered the breach."
Goldberg declined to elaborate on what that unusual activity
was.
The breached server contained information on a total of
eight pension
plans administered by the state. The core database itself
was managed
by the state Employees Retirement System, though the server
it was
hosted on was administered by the GTA.
At this point, there is no evidence that confidential
information,
including names, Social Security numbers and bank-account
details,
have been misused, Goldberg said.
Even so, the GTA is sending out letters to 180,000 affected
employees
for whom it has contact information, she said. The state
does not have
current addresses for the remaining 373,000 individuals
affected and
is relying on media reports and its own outreach efforts to
inform
them of the potential compromise of data, Goldberg said.
The Georgia Bureau of Investigation is investigating the
incident. The
GTA is also bringing in outside security advisers to do a
security
assessment, the agency said in a note posted on its site.
This is the second major breach involving the GTA in the
past year. In
April 2005, the GTA disclosed that a state employee had
downloaded
confidential information belonging to more than 450,000
members of the
state's health benefit plan onto a home computer.
Since that breach, the GTA has implemented several measures
to tighten
security, including stricter password controls, more timely
reviews of
logs and alerts, more extensive employee background checks
and
stricter control of access confidential data, according to
the GTA's
Web site.
Incidents such as this highlight the dangers companies face
when the
software they rely on to protect their data itself turns
bad, said
Lloyd Hession, vice president and chief technology officer
at BT
Radianz, a New York-based provider of telecommunications
services to
financial companies.
"The most important point to remember [from such
incidents] is that
you don't want to be overly dependent on a single vendor's
product"
for security, Hession said.
Earlier this month, a faulty antivirus update from McAfee
Inc.
mistakenly identified hundreds of legitimate programs as a
Windows
virus, resulting in the accidental deletion of significant
amounts of
data from company computers that had the faulty software
installed on
them.
Two years ago, the Witty worm, which was reported to have
damaged
15,000 to 20,000 computers worldwide, took advantage of a
flaw
involving the BlackIce and RealSecure intrusion-prevention
products
from Atlanta-based Internet Security Systems Inc. The worm
wrote
random data onto the hard disks of vulnerable systems,
causing the
drives to fail and making it impossible for users to start
up the
systems.
Such incidents highlight quality lapses that sometimes occur
when
security vendors try to rush out products to keep up with
security
threats, Hession said. "Security vendors have to adapt
very quickly to
new threats," resulting in very short development and
testing cycles,
he said.
With security products, "the perception is that it
should be more
reliable than other software," which is not always the
case, said Ken
Dunham, director of the rapid response team at VeriSign
Inc.'s
iDefense Labs unit. IT managers need to remember that all
software is
susceptible to errors that pose security risks, he said.
_________________________________
InfoSec News v2.0 - Coming Soon!
http://www.infosecnews.org
|