Slashdot Mirror
Trojan Compromises Oregon Taxpayers
Blair writes "An employee at the Oregon Department of Revenue downloaded a trojan file from a porn site, possibly compromising up to 2,200 taxpayers. An information technology security officer with the state said, 'the released data likely involved names, addresses or Social Security numbers, or possibly in some cases all three.' I guess some of our public workers are having too much fun after all."
Cue trojan condom jokes, where's my +5 funny?
'The staff in the hand of a wizard may be more than a prop for age,' -Hamá, the doorward
No wonder my taxes this year were so high. Hey, guys, I can't pay for Trimet on my own!
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
That's why I haven't paid my taxes in years.
Ironically, my CAPTCHA was "Protects".
Forgive my crudeness, but...what an idiot!
Actually there seem to be multiple failures in this. Running Windows, not employing some sort of web filtering software, lax rules on conduct...I don't know where to even begin.
Take off every sig. For great justice.
What was real data doing on a workstation with Internet access in the first place? One would think (hope?) that such data would be under heavy lock and key and only accessible by the software written to manage it or, when absolutely necessary, a trusted administrator with lotsa logging.
It is absolutely amazing to me that this event was even possible.
It goes from God, to Jerry, to me.
Though on the bright side, porn site customers finally have a way to get screwed over the internet!
Recursive: Adj. See Recursive.
= Owned
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
Only figures... Since most of the money I was supposed to pay my taxes with, I used to buy porn anyway.
-- Mojo Tooth : exploring our world as only an idiot can.
There is no reason anyone handling SS numbers should be given this sort of carte blanche access to their computers.
An Education is the Font of All Liberty
Most people just dont give a damn about conmputer security.
This is the same old story over again, it shouldnt suprise you, why? Here's some links to get you started
Can't we all just get along
this just needs a midi rimshot for effect.
I can't wait to see what Larry Flint has to say about this.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
My guess is they had the data locally in Excel spreadsheets, fiddling with things. Everyone's PC has Internet access these days - it's hard to function without it. Many people have secure information on their hard drives too.
The alternative is thin-clients, which haven't ever taken off, mostly because they tend to be harder to use.
I knew Oregon had a lot of wood, but this is rediculous!
Not a good combination....
I hope the NSA wiretap logs are being secured under similar conditions. It would be supremely ironic if the computers holding those records/logs were infiltrated. Even more so if those data fell into the hands of those that the act against whom the act was supposed to defend us.
FTA:
"Electronic files containing personal data of up to 2,200 Oregon taxpayers may have been compromised by an ex-employee's unauthorized use of a computer, the Oregon Department of Revenue said Tuesday."
Lets read that again
Electronic files containing personal data of up to 2,200 Oregon taxpayers may have been compromised by an ex-employee's unauthorized use of a computer, the Oregon Department of Revenue said Tuesday.
EX-EMPLOYEEE!
What the hell was an ex employee doing on site, surfing porn. Forget computational security, what about physical security.
In the words of Napoleon Dynamite "Freakin Idiot!"
Can't we all just get along
I just saw on CNN that some stupid government people in arizona and virginia opened up a public record accessible online. Maricopa county http://recorder.maricopa.gov/recdocdata/GetRecData Select.asp
And the one who complain
Virginia Watchdog http://www.opcva.com/watchdog/
How come there were no filters in place ?
I mean, it is the taxpayers money that are paying for that computer, internet link and his time.
Yes, I know it is possible to circunvect those filter. But people who can circunvect filters are not likely to catch those trojans.
morcego
In my mind, the weakest link here was the employee. The employee had permissions to access both the data and the internet, probably both needed for the work involved. Unless somehow the user was restricted to only running certain executables, he (or she) could have just downloaded the linux version of DESKTOP_HOTNESS-VIRUS_SCANNED_SAFE. I don't like the idea of employees being constantly watched, but perhaps more education, or a low level account for internet use on break time, would have helped, but just installing linux wouldn't stop trojans.
I have freaks! I did something right...
The article was lacking on what would be some interesting information. I would like to know what Trojan was downloaded and how was it detected. Did the A.V. detetect the Trojan or did someone monitoring the network detect an unusual amount of data being sent out from the system in question? How long was the computer infected? Did the trojan install a backdoor such as an FTP or did it just redirect the browser to a porn site? Was this a laptop that was taken home or a desktop located in the agency office? Without any of this information the article is just fluff.
"Anything tastes good if you deep fry it."
Quote from this one: "We maybe had a false sense of security," O'Meara said.
Whoa, maybe. Y'think?
The Trojan horse gathered the equivalent of 7,000 text pages of data.
Somewhere a scammer is very, very busy.
.. paranoid crackpot leftover from the days of Amiga.
First off, you are right that direct access is Bad. Very Bad. In fact, internal systems should ideally be going through proxies and a firewall to prevent random applications (such as viruses) from setting up their own connections. For what is presumably a fairly low-bandwidth facility, they could probably even use layer 7 filtering and block unauthorized applications even if they did have all the correct passwords/tokens and port numbers.
Secondly, you are also correct that the data should not have been kept on a computer with such access. Normally, you'd have a private intranet that cannot access the outside world at all for sensitive data. There is no excuse for keeping data like that on a high-risk machine that may well be portscanned and attacked every few minutes anyway.
Then, there's the problem with the fact that the data was presumably in plain-text. If it was encrypted to any reasonable standard, there wouldn't have been any fuss made. Furthermore, since the trojan was presumably not designed with Oregon taxes in mind, it would have necessarily been your normal harvester looking in normal files. My suspicion is that the most likely place for the data to have been harvested would have been in e-mail. Anything else would require a disk search and that would have been amazingly obvious, even to the most idiotic. If (and I emphasise the if) I am correct and the data was indeed in an e-mail, then why the hell were they e-mailing plain-text files containing this kind of data? Particularly as it's so easy to e-mail the wrong person, using modern e-mail clients that guess at addresses.
I would very much like to see a requirement that ALL sensitive and personal data that is even potentially exposed to the Internet be encrypted using strong algorithms and strong keys, and that unnecessary risks with other peoples personal data be strongly penalized. (By my way of thinking, since the flaws in the VA office had been known for many years and never addressed by the Federal government even though the GAO had been sending up the red flags, rockets and flying saucers, those whose data was taken should be entitled to compensation at least equal to the cost they will have to endure to salvage and protect what they can.)
There is no excuse for insecure practices. There are far too many solutions, including free ones, that are easy enough, fast enough and secure enough to excuse delinquency on the part of any agency or (in e-commerce data theft cases) any corporation that puts laziness as a higher priority than standards.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
None of that information is secret. Your SSN, Address, and Name are all public information, the subject of numerous public records that anyone patient enough can pay $.10 per copy to get. Or just visit the appropriate county records website.
Anyone else think of condoms when they saw "trojan" and "porn", or is my mind just in the gutter?
Cliché (Score:5, Funny)
Is that a link to the trojan or the porn site?
get whipped (you know you like it)
Correction:
but when information is leaked about your own private stuff, you should shoot a lawyer.
Pre-paid legal is the biggest scam since rust-proofing or vinyl siding. Anyone following that link should definitely read all the fine print (especially apropos the hours of paid legal service you receive.)
and
So that's ~5.3 "pages of text" per person they got only the SSN, name and address for. Either people in Oregon have really long names and addresses, or something else got sent with that data. I smell a cover up!
A lawyer is unnecessary and expensive. It's easy to handle ID theft once you understand that the situation cannot be corrected immediately, that you shouldn't go ballistic, and that time and patience (and a few simple procedures) is all that's required to correct the situation:
Above all, be patient, take your time (there's no rush, all changes are made at snail mail speed at best) and don't worry. Just go through the steps and everything can be corrected within about 180 days.
After that, make sure you check your credit record with the major credit bureaus at least once a year. They'll send this for free. Follow the above steps whenever you see a fraudulent account or application. The Bad Guys won't be able to touch you.
...DO NOT need internet access IMO. I see can see intranet access, but full on Internet?
The bits on the bus go on and off... on and off... on and off...
are the colleges really THAT bad up there???
but in all seriousness...why in the wolrd would an (ex) employee go to WORK TO LOOK AT PORN???
i cant help but think of the mac commercials (where the mac doesn't get viruses) and the trojan comercials (stay protected)...its like they combined, but in the exact opposite way...
sometimes mankinds intellegence overwhelms me
Since when is the United States goverment AT any branch, competent in computing and security?
You almost have to go though limitless bureaucratic loops just to ASK to fix serious vulnerabilities in their system.
Don't even get me started about the waste of tax monies due to such annoyances and over regulation.
If I worked in a tax office I think I would need at least a coupla pr0n sites to make my work/life interesting. Have you seen the people who work there? uhhh *shudder
Is it just my perception or is this becoming routine now?
I used to be only concerned in a detached way. Then *today* I received a letter from the student loan people saying, in essence: "We lost a dataset including your information. Sorry! Better contact the credit bureaus, and watch your financial statements. Have a nice day!"
The only way we are going to have data security is if the parties that fail to secure data are held responsible for the consequences to others. Ideally, that would mean that if someone commits fraud using my stolen data, the organization that lost it has to pay me the actual cost of correcting credit reports, changing all my accounts, compensation for time spent, any lawyers needed, etc..
Instead the banks are allowed to exploit the situation by selling insurance against it. We can't even get disclosure laws everywhere.
Well excuse me for ranting. I guess my only point is, the only way the technical and user-education type of solutions will become relevant is if the costs are placed appropriately.
Ahh yes, cue the obligatory puns of "there are three players in this incident, the people screwing, the people doing the screwing, and We The People getting screwed"
Libertas in infinitum
What can you expect my lovely home town is a town of sin. If you look at the google search stats all we search for is weed porn and bush hate sites. Truly this city is lost to the liberals. (In case you can't tell I am being sarcastic) Portland/oregon Owns.
Well, at least the employee knows what the internet is for:1 227974645
The internet is for porn! http://video.google.com/videoplay?docid=543034384
Oolite: Elite-like game. For Mac, Linux and Windows
Civil servants *flash* (i.e. full frontal nude exposure) their colleagues
Artificial intelligence is no match for natural stupidity
Did the "Information Technology Security Officer" happen to say why they were running an OS and application configuration that would let this happen in the first place?
Noticeably missing from all of the articles I have seen is the name of the OS that was compromised. Is that because the news sites don't know there is more than one OS, because the reporters are incompetant, because Bill Gates will fire them if they mention it (think msnbc subsidiary), or because the reporters figure it is patently obvious that it was Windows since the compromise happened in the first place?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
I'm not a computer security professional, but logically I thought of a way that could/should thwart the majority of user data theft. I have described it a couple of times, but never really had any comment from anyone in the know. Input would be appreciated.
User database resides on one or more servers. They receive requests, and return the data that fits the request.
Requests and returns, or possibly requests only, are sent solely through connections that are monitored by an on-site computer that is not connected to the internet. Traffic is monitored in two ways. Firstly, any data that does not parse to a request specification is removed from the traffic flow - and never reach the server.
Secondly, the pattern of requests is monitored statistically with limits placed on it - e.g. if a single location requests 100.000 pieces of data, that location would be rejected. Or if the total requests exceed a certain expected point and a safety margin, they are all placed on hold. If your tax office expects a sudden massive inflow of data requests at certain times of the year, someone will manually have to sit down and crank the limit up.
There are many problems this wouldn't solve - theft of backups, trojans that steal each individual data to a client - but surely 'database downloads' would be prevented?
Is this workable? Comments from someone in the know?
It's just the universe compensating for Oregonians having cheaper gas which gets pumped for them... :-P
Is it ust me or has slashdot not updated the front page in almost 5 hours now? Did news stop happenning this evening, or are there server issues?
Philosophy.
Reduce, reuse, cycle
Call me a Nazi, but I'd lock down all these systems and prevent Internet Access. There is no reason these people need access the Internet. They need access internal systems only. If they want to access outside systems, they can have a shared system in the offer for that purpose. It would make them do more real work the lazy buggers. All goverment offices that I have installed systems on have been blocked from the Internet.
1) How (the fuck) is possible to have DOR private database on a computer that is connected to the internet ?
2) What (the fuck) is DOR employee doing on the internet porn site during working hours ?
3) Where (the fuck) is this whole world coming to!? (err, is he a prudent republican?)
At least he wasn't playing solitaire.
Oh, wait...
As a mattir of fakt, GA Tech has even more! 'Cause when they'r studying Elactricul Injeneering, they need bigger Bibles. Same goes for tha the other Injinering programms!
So, you shut up and dont kall us stewpid!
Did anyone else feel a little apprehensive about clicking a link labeled " trojan file from a porn site"?
what a surprise?
& we all know what drives them?
how is it allowed? just like corn passing through a bird's butt eye gas.
all they want is... everything. at what cost to US? not a pretty picture at all. quite infactdead from our viewpoint.
lookout bullow.
for many of US, the only way out is up.
don't forget, for each of the creators' innocents harmed (in any way) there is a debt that must/will be repaid by you/US as the perpetrators/minions of unprecedented evile will not be available after the big flash occurs.
'vote' with (what's left in) yOUR wallet. help bring an end to unprecedented evile's manifestation through yOUR owned felonious corepirate nazi life0cidal glowbull warmongering execrable.
some of US should consider ourselves very fortunate to be among those scheduled to survive after the big flash/implementation of the creators' wwwildly popular planet/population rescue initiative/mandate.
it's right in the manual, 'world without end', etc....
as we all ?know?, change is inevitable, & denying/ignoring gravity, logic, morality, etc..., is only possible, on a temporary basis.
concern about the course of events that will occur should the corepirate nazi life0cidal execrable fail to be intervened upon is in order.
'do not be dismayed' (also from the manual). however, it's ok/recommended, to not attempt to live under/accept, fauxking nazi felon greed/fear/ego based pr ?firm? scriptdead mindphuking hypenosys.
consult with/trust in yOUR creators. providing more than enough of everything for everyone (without any distracting/spiritdead personal gain motives), whilst badtolling unprecedented evile, using an unlimited supply of newclear power, since/until forever. see you there?
Go here for plenty of identities to steal!
Mod parent up. These guys are serious BUT..
If they tell me to choose between a civil servant who jumps naked off filing cabinets and another who does windows+IE+[possible pwning site] I'd pick servant A every time.
The screwing in lavatories thing is very strange tho. Are they gay?
What's really needed is an OS which allows him to do his job and nothing more. No screensaver downloads, no animated cursors, none of that crap.
No sig today...
otherwise we'd all be drinking Seminole fluid.
Is it just my observation, or are there way too many stupid people in the world?
...to pay taxes in Oregon!
Liberty uber alles.
As someone who has worked for State Government... I can empathize with the guy. He was just trying to get some happy pr0n in to deal with the soul-crushing-depressing-meaninglessness that is working in the public sector. I mean, without internet pr0n, I bet the number of state workers going beserk and killing everyone would skyrocket. I say 2000 SSNs is a small price to pay... after all, they aren't exactly making a killing on the salary.
Self-referential Sigs are cool on /. these days...
54
This is very prevalent in the federal government. The feds train you to give your social for every piece of paperwork you ever fill out. I was a federal employee and it amazed me that *everything* required a social. When these employees are so used to carelessly using their SS#'s, it is obvious why other people's data is treated the same. Social security numbers in the government are used everywhere and not nearly treated with the care that they should be.
When are people going to learn? The rule in security is denied unless explicitly allowed.
Simple math says there are an infinite number of sites to be blocked but only a handful of sites to be unblocked!
I have no sympathy for:
a) a company that allows the users to install software
b) a company that allows everything and only blocks after the fact
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
"the incident apparently occurred when an employee downloaded a contaminated file from a porn site"
What OS did this trojan run on?
davecb5620@gmail.com
I Want Your Sex Pootie!
(You'd get it if you'd read Big Trouble or Tricky Business.)
From your reply:
Perhaps you missed the sublety of the quotes around ITSO which implies "your" first point, and didn't read the remainder of my post, which states that the configuration was foobared?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Hey, maybe we should switch to a form of taxation that doesn't require state and federal agencies to keep personal info on every American citizen
Support the FairTax
Could this be a sign that we should switch to a form of taxation that doesn't require state and federal agencies to keep personal info on every American citizen?
Support the FairTax
So a corrected list may look like:
- Allowing data entry personnel to have access to the Internet.
- Allowing data entry personnel to have enough access to their own machine to install a logger.
- Failure to monitor all employees access to the Internet
How is logging all packets sent by a computer going to help? In this case, only by enumerating the personnel records compromised by the moron. Once the data is sent, what difference does it make if you have a log for it?Now that PCs are so cheap there is no excuse to not build a system intentionally for the job at hand.
If the job is to manage high value and sensitive date then why use a known flawed home OS?
Just read down the "features" of XP-professional, how many people consider all that multimedia junk applicable to business uses?
People should start to get fired for running Windows!
Virgina
Step 1: Click on story about pron
Step 2: Post witty comment with unintentional Freudian slip
Step 3: ???
Step 4: Profit!
Everyone here has their "personal" information ponied out, bought and sold so many ways that even people who work in the business have no clue how much they're just cattle.
Everyone who has bought a home in many parts of the country has their information freely available to anyone on the Internet, often through their local Chamber of Commerce, the same people who enjoy sharing your information with water purifier companies, carpet cleaning companies, local window-installers and the local sham boiler-room fundraising people who like to make you feel guilty that you're not giving money to them, ahem, I mean to the police or the firemen.
It's kind of sad that some chap browsing for fun was walking down a dark alley and got ambushed while using a crepe-paper OS, but I think the message here is that government shouldn't use a computer operating system with so many fundamental weaknesses that you can't even browse the Internet without being victimized.
If people still want security why did they shitcan all the closed-loop VT102 minicomputer systems in favor of Uncle Bill's special sauce? (No solitare on a VT102 system?)
Just like we can't stop someone from blowing themselves up it's foolish to chastise people for being human. We can't fix humanity but we can do something about idiot IT policy and asshat billionaire software moguls who EULA themseleves out of any kind of responsiblity when their software is so weak?
Why do people buy the right to be exploited? Screw putting the dumbass "commandments" on display!
P.T. Barnum's truisms should be hung on courthouse walls and in classrooms!
Microsoft never takes any responsibility, there's no safety net. Everyone who uses it simply ignores the fact that the software license clearly states that there's no promises of fitness or usability. It's one thing to accept that policy for software in general when it's free and another to have to pay for the privledge of being criminalized and exploited by the vendor/developer and anyone smart enough to modify a vbscript.
It's also one thing for an individual to make this choice, and a cockup of an entirely different scope when government offices choose to exploit citizens with such poor decisions.
The dismissed fellow should have been followed by at least two other people, the person who made the purchase decision and the person in IT who supported it.
Every new form of media has it's own Requirimento
Wow, I didn't think you were still around. You've outlived 'YOU ARE SO FIRED' and 'Lose, not loose', you should be proud, and I'm especially honoured to have conversed with you.
What I want to know is: why did he run the trojan? I can look at porn all day without executing any remote code.
The obvious answer is that he runs MS Windows, but that's also a very boring answer. What can go wrong even for people who use sane or modern OSes? Maybe a buffer-overflow in some codec library? Sure, it could happen. Web browsers should be sandboxed, so that it takes a lot of effort to download and execute something with the user's privs. You can't get rid of social engineering, but you can at least make it look stupider. e.g. "You did WHAT? You clicked on save, entered your personal passphrase, then adjusted the permissions on the file to make it executable, and then executed it, and then when the trojan asked you to, you entered the passphrase for the taxpayer database?!?"
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Whatever else government may be it is not trustworthy.
The real mystery is why someone who gets paid to screw people all day needs to look at porn.