Acxiom Hacking Details Made Public

pgrote writes "As mentioned previously, the Acxiom consumer database company was compromised. More details have emerged including the background of the alleged hacker and the method used to gather access. It turns out he had access since December of 2002 and came in through an unsecured FTP server. The suspect was not a former employee of Acxiom as previously reported, but an employee of data mining company."

Comments

No Excuse

[TedCheshireAcad]

At first I thought maybe this guy was a DBA or Sys Admin at the company, but an outsider? This is unacceptable for a place that stores such sensitive data.

Re:No Excuse

[AstroDrabb]

Well the article I read said he was an employee of data mining company. Which means he had some inside knowlege of the systesm. He broke in through an external FTP server and did not get through their firewall. So I think Acxiom deserves a little break. There is no such thing as a 100% secure system, especially with inside knowlegde of the systems. As a programmer for a fortune 500 company, I could literally bring that company to it's knees and cause millions (USD) lost per day. However, I don't do that because I am a professional and would not use my skills to be abusive. I hope this dude get some hard time.

Question

[Henry V .009]

How is it hacking if you publish it on your FTP server? I'm sure no one would call it hacking if the protocol had simply been http instead. Now, this fellow may have used the information for nefarious purposes, and if there is any law he broke in doing so, go get him. But I don't see this as hacking.

What!

[Matt_Fisher]

So you mean, that this company has a open FTP account that was rooted to the files of all that material! Is it just me or does that make you not want to trust anyone?

Here I was hoping for real details...

[RenQuanta]

...but let's see what we can figure out from the article:

The breach involved one FTP server outside the Acxiom firewall, the company said. No internal systems or internal databases were accessed, and there was no breach of the security firewall.

Why did they have a server outside their firewall?!?

The company said only a small percentage of its clients' data was involved in the incident, and the hacker, a former employee of an Acxiom client, was arrested.

I guess they were trying to keep the article under a certain word count, because they forgot the word "alleged".

According to law enforcement officials, the person arrested was a known sophisticated hacker. Acxiom said the person apparently gained access through the hacking of encrypted passwords.

Okay, so this was probably little more than an attack against the /etc/shadow file if it's a UNIX box, or the SAM file if it's NT. In either case, I'm guessing they brute-forced / dictionary attacked the file with John the Ripper or the like. If that's what they did, how did they get the password file to begin with? Perhaps the FTP was a bit too willing to follow instructions? (recursion anyone? ;)

After learning of the breach, Acxiom immediately moved to close the security gap and changed all passwords on the FTP server involved. The company is now in the process of communicating with all clients who might be potentially affected.

Now, does that mean they had all users change their passwords, or just their passwords on that server? I wonder how many of those users have the same passwords on other machines as they had on the compromised FTP server...hmm.....

"Acxiom is proud of its long-standing commitment to the security of our systems and our efforts toward continuous improvements in that area, so we deeply regret this breach," said Acxiom Company Leader Charles Morgan in the statement.

Which is why their infrastructure was vulnerable to begin with? Why was their FTP server outside their firewall? Why aren't they using a Firewall proxy? How about FTP servers with jails? Without more details, it's impossible to be sure, but this smells like a successful attack due to careless configuration and insecure architecture

Re:Here I was hoping for real details...

[bourne]

Why did they have a server outside their firewall?!?

I think that if you translate from Dumb Reporter to Technical you get "server on a service network or DMZ, available to the Internet but segregated from their internal network." That's standard practice, the thing has to be available to the Internet.

In either case, I'm guessing they brute-forced / dictionary attacked the file with John the Ripper or the like

Again, you need to translate here. Based on personal experience with similar organizations, I believe this translates to "He sniffed the plaintext (non-anonymous) FTP passwords off the Internet and used them to log in himself and get files."

Now, does that mean they had all users change their passwords, or just their passwords on that server

Translation: "We changed all the FTP passwords, so that they will be secure until the next time someone sniffs them.

Which is why their infrastructure was vulnerable to begin with?

Note that they also state the information he got was encrypted and not believed to have been used. It is not unusual for organizations like Acxiom to accept PGP or ZIP encrypted files via FTP. Obviously, that isn't good enough - if only because of the negative publicity that comes out of an incident like this - but that's what they do.

The only sign of weak infrastructure here is FTP passing plaintext passwords over the Internet. I don't see any real evidence that anything else was compromised - except their PR shell.

Hacking?

[Anonymous Coward]

Odd but where I come from anonymous ftp isn't hacking.. that's why it's anonymous.. if I posted confidential customer information on a website and you viewed my page did you hack me? At what point did we say anonymous web is ok, but don't try anonymous ftp even though there are plenty of anonymous ftp servers meant for public use.

Computer world issues Acxiom press release...

[Anonymous Coward]

...wow!

That's some incredible reporting!

When the news story first broke, we get "no personal information was released to others"

And we get that it was an insider.

And we get that "very, very little...information was compromised...", as compared to the amount of information that could have been stolen.

Specifically, we get this quote:

She says less than ten percent of the files on a single server were affected. She says Acxiom has thousands of computer servers -- and the amount of material taken is small compared with all the information the company handles...Acxiom's Web site says the company serves 14 of the top 15 credit card companies, seven of the top ten auto manufacturers, and five of the top six retail banks.

Source: Associated Press, 8/8/03

With one bank handling millions of customers, one of the top ten car companies handling millions of customers, one of the top 15 credit card companies handling millions of customers, what exactly is Acxiom's definition of small?

Thanks, Linda Rosencrance, linda_rosencrance@computerworld.com of Computer World, for being a mouthpiece of Acxiom, instead of actually doing a bit of reporting!

yeah, that's what they said . . . .

[Anonymous Coward]

when they passed the income tax in 1913 that only hit the top ten percent of people. When U. Sinclair wrote the Jungle, people said that now the food industry will be cleaned up. Do you know what I ate for lunch ? No, I don't either. That's what they said about Roosevelt's new deal. Oh, Hitler smashed all the Jewish businesses ? Surely now the people will diselect him. When the EPA started telling private landowners the land was public because it flooded once a year, they all said "that's great, surely we'll have a groudswell now." When the Brady Bill was passed, people said "ok now the people will really revolt." How long have we lived under the Patriot Act's extra-constitutional government now ?

Face it, if you want to protect your self there is no hope in waiting for the masses to get pissed. Just start fighting.

Re:Victims

[Anonymous Coward]

I know if it was my info in there, I'd be pretty pissed if they didn't tell me about it.

Your info was in there. And they didn't. And you are so not pissed you will never read this, never cancel your cards and start using cash, never write a congressmen, and just move on to the next slashdot story about legos and linux.

Re:Disturbing

[FuckMeter]

Let's say I have a single lock on the handle of my front door... with no dead bolt. Along comes someone and kicks the door open and proceeds to rob my house. While he's robbing my house he steals a cd that I borrowed from my friend. Are you saying that *I* should be arrested because I failed to install an adequate dead bolt on my front door and thus the robber stole a cd that didn't belong to me?

You're comparing apples to oranges. In fact, you're comparing apples to... zebras, or something not even closely related.

The first distinction is that in your example, your friend willingly loaned you the CD. I don't think anyone has intentionally "loaned" their personal information to Acxiom. Before the initial story was reported here, I'd never heard of Acxiom, though various articles proclaim them to be [one of] the biggest data-mining compan[y|ies] around. If they have any data on me, I sure as hell didn't loan it to them.

The second problem with your analogy is that a CD is nothing like personal data. A CD is a vanity, something worth maybe $15, less now that it's used. Acxiom has been described as serving "most top credit card companies and retail banks." What do you think the credit card or bank details of a single person - much less however many people were affected by this breach - are worth? That $15 CD pales in comparison.

What's adequate? Let's say I did install a dead bolt but the robber was sophisticated enough to pick both locks? In this case I shouldn't be arrested because I had "adequate" security and was victimized by a "skilled" robber who had the proper knowledge that surpassed my own in lock technology?

Your analogy fails here as well. You, as a private citizen, do not have any liability for the stolen items. Your friend loaned you the CD, there was no business agreement surrounding that friendly exchange. Acxiom is a business, the rules are different.

Suppose you rent a storage facility at one of those mini-storage places. Their property is surrounded by a chainlink fence complete with razorwire. The gate requires a keycode to enter. Each bay is padlocked. Now let's say some joker breaks into the place, gets into your bay and steals everything you have stored there. Surely a fence with razorwire, key-coded facility access, and padlocks are "adequate" security... But you're damn sure that the mini-storage company would be liable for your loss, unless that was covered in your contract with them.

But, see, none of us have a contract with Acxiom.

Acxiom is liable, one way or another.

--
Rate Naked People! at Fuck Meter (not work-safe)

Re:What OS?

[Anonymous Coward]

"I wonder why do people call Outlook the best Virus Transport Protocol ever designed."

Naah... stupid people are the best protocol. Opening something that says "click me for fun" is a bit like getting ebola and going to the shops saying "oh, it's only a cold..." and infecting a truckload of people. Some people like the risk, others don't take it...

Remember, the most secure Windows installation has no modem or network card.

Relax.

[thatguywhoiam]

Would you plese stop using "hacker" word when the proper word would be "cracker"!

No. See, it's like this: practically everyone in the world associates 'hacker' with 'computer expert' and a fairly large percentage of those people also think 'nefarious' when they hear 'hacker'.

I know you really, really want your word back, but you just can't have it. The populace has kidnapped it. This is what it means now. It won't change. It's jargon anyways, so the meaning is fluid.

Hackers are computer experts who sometimes circumvent established systems, for learning or mischief. Crackers are small biscuits you eat.

IT Malpractice Suit?

[PSaltyDS]

If a company that handles sensitive information can't use ssh and scp, or some other secure mechanism, aren't they liable for legal action? Isn't financial data required to be protected by something equivelent to HIPPA?

And on the prosecution...

[It's the tripnaut!]

Prosecutor Mike Allen said...

"Businesses have to feel secure that their information stays confidential. You just can't have someone hacking into a business's confidential information," he said. "It's really no different than someone breaking into an office and stealing files."

Somebody should tell Prosecutor Mike Allen that...

Businesses have to make their information secure so that it stays confidential. You just can't leave your business' confidential information. It's really no different than someone leaving an office open to burglars who steal files.

Difference between Business & individual

[Jaeger-]

He was charged with the same crime against an unnamed company on June 3, also for another April 10 offense, records show. In that case, Baas is accused of hacking into the computer database of an unnamed company and providing "personal information regarding a subject's name and home address and telephone number without the consent or permission of the owner," records show.

If a business provides (sells) this information, its legal and considered "good business".

If an individual does the same thing, he's a criminal.

Glad we cleared that one up. Hacking is illegal, but we definitely need better laws that protect our private information here in the USA!

What good would a firewall have done?

[KalvinB]

If that FTP server was meant to be accessible to the outside then putting it behind a firewall would have accomplished exactly nothing. The ports to it would be open anyway and he got in through the standard FTP port.

"because they forgot the word "alleged"."

If he admitted to the crime then "alledged" is no longer needed. He just needs to try to convince people he shouldn't be punished much.

Ben