Slashdot Mirror

← Back to Stories (view on slashdot.org)

GSA Bidding Site Compromised By Flaw

Posted by Zonk on from the let's-form-a-committee dept.

thomville writes "NY Times reports that eOffer, the government site allowing on-line bids for contracting government computer services, allowed viewing and modification of other contractor's corporate and financial data." From the article: "The security flaw, which could have permitted contractor fraud, was reported to the agency's inspector general on Dec. 22, but almost three weeks passed before the system was taken offline Wednesday afternoon. The General Services Administration is the federal agency responsible for procuring equipment and services, including computer security technology, making the lapse all the more striking. 'This is the government entity responsible for letting contracts for security,' said Mark Rasch, chief security counsel for Solutionary, a security firm. 'Clearly the people who log in would know about security.'"

7 of 43 comments (clear)

  1. Nothing to see here.... by zappepcs · · Score: 3, Funny

    move along...
    First Military intelligence was considered an oxymoron, and now the govermnent gives us Government Computer Security ??? This is a surprise? This is news? Wow, and to think, next thing you know, they'll be outsourcing tax processing to India... oh, wait....

    Never mind

    --
    Support NYCountryLawyer RIAA vs People
  2. Yeah... by andreMA · · Score: 3, Funny
    Clearly the people who log in would know about security.
    This is the Federal Government. Don't bet on that.
  3. ComputerWorld has more detail by joeflies · · Score: 4, Informative
    Computerworld article Apparently the "Flaw" was that records were accessed by a unique ID in the URL. Change the Unique ID, see a different record.

    The site used digital certs to protect authentication, so it wasn't amtter of the wrong users getting in. But once inside, clearly there's a problem with access rights (the app probably accessed all records as privleged user) and coding.

    1. Re:ComputerWorld has more detail by DrMrLordX · · Score: 3, Interesting

      That explains the flaw, but can anyone explain why it took three weeks to take the system down after the flaw was reported? And here I was thinking the delay in correcting false news coming out of the Sago mine was bad. Three hours is nothing compared to twenty days.

  4. Tripwiring flaws by KiloByte · · Score: 3, Interesting

    Actually, it is possible that the GSA waited with the response on purpose. At least this is what I used to do on a MUD -- carefully logging every action, in an attempt to get a list of the crooks. The bastards would then get slapped with appropiate action, including revoking gains for a period in the past. This would make them appropiately punished as opposed to simply fixing the flaw and let them slide.

    This assumes some competency on the GSA's part -- but oh well, whom am I kidding?

    --
    The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    1. Re:Tripwiring flaws by DrMrLordX · · Score: 4, Interesting

      An interseting theory. However, the kind of data available due to this exploit was sensitive enough that the GSA would have been nuts to let it leak to competitors in the first place. One violater could have racked up tons of data on other bidding firms and distributed to any number of non-violaters, so the prospect of punishing exploiters later doesn't really make up for the fact that dozens, if not hundreds, of firms could wind up with sensitive data without ever being caught by the GSA.

  5. Ok, but.. by CCFreak2K · · Score: 5, Funny

    Did they find who left the Sony Music CD in the drive when they were done listening?

    --
    "Beware of he who would deny you access to information, for in his heart he dreams himself your master."