Slashdot Mirror
Trojan Compromises Oregon Taxpayers
Blair writes "An employee at the Oregon Department of Revenue downloaded a trojan file from a porn site, possibly compromising up to 2,200 taxpayers. An information technology security officer with the state said, 'the released data likely involved names, addresses or Social Security numbers, or possibly in some cases all three.' I guess some of our public workers are having too much fun after all."
Cue trojan condom jokes, where's my +5 funny?
'The staff in the hand of a wizard may be more than a prop for age,' -Hamá, the doorward
No wonder my taxes this year were so high. Hey, guys, I can't pay for Trimet on my own!
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
That's why I haven't paid my taxes in years.
Ironically, my CAPTCHA was "Protects".
Forgive my crudeness, but...what an idiot!
Actually there seem to be multiple failures in this. Running Windows, not employing some sort of web filtering software, lax rules on conduct...I don't know where to even begin.
Take off every sig. For great justice.
What was real data doing on a workstation with Internet access in the first place? One would think (hope?) that such data would be under heavy lock and key and only accessible by the software written to manage it or, when absolutely necessary, a trusted administrator with lotsa logging.
It is absolutely amazing to me that this event was even possible.
It goes from God, to Jerry, to me.
Though on the bright side, porn site customers finally have a way to get screwed over the internet!
Recursive: Adj. See Recursive.
= Owned
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
Only figures... Since most of the money I was supposed to pay my taxes with, I used to buy porn anyway.
-- Mojo Tooth : exploring our world as only an idiot can.
There is no reason anyone handling SS numbers should be given this sort of carte blanche access to their computers.
An Education is the Font of All Liberty
Most people just dont give a damn about conmputer security.
This is the same old story over again, it shouldnt suprise you, why? Here's some links to get you started
Can't we all just get along
this just needs a midi rimshot for effect.
I can't wait to see what Larry Flint has to say about this.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
My guess is they had the data locally in Excel spreadsheets, fiddling with things. Everyone's PC has Internet access these days - it's hard to function without it. Many people have secure information on their hard drives too.
The alternative is thin-clients, which haven't ever taken off, mostly because they tend to be harder to use.
I knew Oregon had a lot of wood, but this is rediculous!
I hope the NSA wiretap logs are being secured under similar conditions. It would be supremely ironic if the computers holding those records/logs were infiltrated. Even more so if those data fell into the hands of those that the act against whom the act was supposed to defend us.
FTA:
"Electronic files containing personal data of up to 2,200 Oregon taxpayers may have been compromised by an ex-employee's unauthorized use of a computer, the Oregon Department of Revenue said Tuesday."
Lets read that again
Electronic files containing personal data of up to 2,200 Oregon taxpayers may have been compromised by an ex-employee's unauthorized use of a computer, the Oregon Department of Revenue said Tuesday.
EX-EMPLOYEEE!
What the hell was an ex employee doing on site, surfing porn. Forget computational security, what about physical security.
In the words of Napoleon Dynamite "Freakin Idiot!"
Can't we all just get along
I just saw on CNN that some stupid government people in arizona and virginia opened up a public record accessible online. Maricopa county http://recorder.maricopa.gov/recdocdata/GetRecData Select.asp
And the one who complain
Virginia Watchdog http://www.opcva.com/watchdog/
How come there were no filters in place ?
I mean, it is the taxpayers money that are paying for that computer, internet link and his time.
Yes, I know it is possible to circunvect those filter. But people who can circunvect filters are not likely to catch those trojans.
morcego
In my mind, the weakest link here was the employee. The employee had permissions to access both the data and the internet, probably both needed for the work involved. Unless somehow the user was restricted to only running certain executables, he (or she) could have just downloaded the linux version of DESKTOP_HOTNESS-VIRUS_SCANNED_SAFE. I don't like the idea of employees being constantly watched, but perhaps more education, or a low level account for internet use on break time, would have helped, but just installing linux wouldn't stop trojans.
I have freaks! I did something right...
Quote from this one: "We maybe had a false sense of security," O'Meara said.
Whoa, maybe. Y'think?
The Trojan horse gathered the equivalent of 7,000 text pages of data.
Somewhere a scammer is very, very busy.
.. paranoid crackpot leftover from the days of Amiga.
First off, you are right that direct access is Bad. Very Bad. In fact, internal systems should ideally be going through proxies and a firewall to prevent random applications (such as viruses) from setting up their own connections. For what is presumably a fairly low-bandwidth facility, they could probably even use layer 7 filtering and block unauthorized applications even if they did have all the correct passwords/tokens and port numbers.
Secondly, you are also correct that the data should not have been kept on a computer with such access. Normally, you'd have a private intranet that cannot access the outside world at all for sensitive data. There is no excuse for keeping data like that on a high-risk machine that may well be portscanned and attacked every few minutes anyway.
Then, there's the problem with the fact that the data was presumably in plain-text. If it was encrypted to any reasonable standard, there wouldn't have been any fuss made. Furthermore, since the trojan was presumably not designed with Oregon taxes in mind, it would have necessarily been your normal harvester looking in normal files. My suspicion is that the most likely place for the data to have been harvested would have been in e-mail. Anything else would require a disk search and that would have been amazingly obvious, even to the most idiotic. If (and I emphasise the if) I am correct and the data was indeed in an e-mail, then why the hell were they e-mailing plain-text files containing this kind of data? Particularly as it's so easy to e-mail the wrong person, using modern e-mail clients that guess at addresses.
I would very much like to see a requirement that ALL sensitive and personal data that is even potentially exposed to the Internet be encrypted using strong algorithms and strong keys, and that unnecessary risks with other peoples personal data be strongly penalized. (By my way of thinking, since the flaws in the VA office had been known for many years and never addressed by the Federal government even though the GAO had been sending up the red flags, rockets and flying saucers, those whose data was taken should be entitled to compensation at least equal to the cost they will have to endure to salvage and protect what they can.)
There is no excuse for insecure practices. There are far too many solutions, including free ones, that are easy enough, fast enough and secure enough to excuse delinquency on the part of any agency or (in e-commerce data theft cases) any corporation that puts laziness as a higher priority than standards.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
None of that information is secret. Your SSN, Address, and Name are all public information, the subject of numerous public records that anyone patient enough can pay $.10 per copy to get. Or just visit the appropriate county records website.
Anyone else think of condoms when they saw "trojan" and "porn", or is my mind just in the gutter?
Is that a link to the trojan or the porn site?
get whipped (you know you like it)
and
So that's ~5.3 "pages of text" per person they got only the SSN, name and address for. Either people in Oregon have really long names and addresses, or something else got sent with that data. I smell a cover up!
A lawyer is unnecessary and expensive. It's easy to handle ID theft once you understand that the situation cannot be corrected immediately, that you shouldn't go ballistic, and that time and patience (and a few simple procedures) is all that's required to correct the situation:
Above all, be patient, take your time (there's no rush, all changes are made at snail mail speed at best) and don't worry. Just go through the steps and everything can be corrected within about 180 days.
After that, make sure you check your credit record with the major credit bureaus at least once a year. They'll send this for free. Follow the above steps whenever you see a fraudulent account or application. The Bad Guys won't be able to touch you.
...DO NOT need internet access IMO. I see can see intranet access, but full on Internet?
The bits on the bus go on and off... on and off... on and off...
are the colleges really THAT bad up there???
but in all seriousness...why in the wolrd would an (ex) employee go to WORK TO LOOK AT PORN???
i cant help but think of the mac commercials (where the mac doesn't get viruses) and the trojan comercials (stay protected)...its like they combined, but in the exact opposite way...
sometimes mankinds intellegence overwhelms me
If I worked in a tax office I think I would need at least a coupla pr0n sites to make my work/life interesting. Have you seen the people who work there? uhhh *shudder
Is it just my perception or is this becoming routine now?
I used to be only concerned in a detached way. Then *today* I received a letter from the student loan people saying, in essence: "We lost a dataset including your information. Sorry! Better contact the credit bureaus, and watch your financial statements. Have a nice day!"
The only way we are going to have data security is if the parties that fail to secure data are held responsible for the consequences to others. Ideally, that would mean that if someone commits fraud using my stolen data, the organization that lost it has to pay me the actual cost of correcting credit reports, changing all my accounts, compensation for time spent, any lawyers needed, etc..
Instead the banks are allowed to exploit the situation by selling insurance against it. We can't even get disclosure laws everywhere.
Well excuse me for ranting. I guess my only point is, the only way the technical and user-education type of solutions will become relevant is if the costs are placed appropriately.
Ahh yes, cue the obligatory puns of "there are three players in this incident, the people screwing, the people doing the screwing, and We The People getting screwed"
Libertas in infinitum
What can you expect my lovely home town is a town of sin. If you look at the google search stats all we search for is weed porn and bush hate sites. Truly this city is lost to the liberals. (In case you can't tell I am being sarcastic) Portland/oregon Owns.
Well, at least the employee knows what the internet is for:1 227974645
The internet is for porn! http://video.google.com/videoplay?docid=543034384
Oolite: Elite-like game. For Mac, Linux and Windows
Civil servants *flash* (i.e. full frontal nude exposure) their colleagues
Artificial intelligence is no match for natural stupidity
Did the "Information Technology Security Officer" happen to say why they were running an OS and application configuration that would let this happen in the first place?
Noticeably missing from all of the articles I have seen is the name of the OS that was compromised. Is that because the news sites don't know there is more than one OS, because the reporters are incompetant, because Bill Gates will fire them if they mention it (think msnbc subsidiary), or because the reporters figure it is patently obvious that it was Windows since the compromise happened in the first place?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Reduce, reuse, cycle
1) How (the fuck) is possible to have DOR private database on a computer that is connected to the internet ?
2) What (the fuck) is DOR employee doing on the internet porn site during working hours ?
3) Where (the fuck) is this whole world coming to!? (err, is he a prudent republican?)
At least he wasn't playing solitaire.
Oh, wait...
Mod parent up. These guys are serious BUT..
If they tell me to choose between a civil servant who jumps naked off filing cabinets and another who does windows+IE+[possible pwning site] I'd pick servant A every time.
The screwing in lavatories thing is very strange tho. Are they gay?
What's really needed is an OS which allows him to do his job and nothing more. No screensaver downloads, no animated cursors, none of that crap.
No sig today...
...to pay taxes in Oregon!
Liberty uber alles.
As someone who has worked for State Government... I can empathize with the guy. He was just trying to get some happy pr0n in to deal with the soul-crushing-depressing-meaninglessness that is working in the public sector. I mean, without internet pr0n, I bet the number of state workers going beserk and killing everyone would skyrocket. I say 2000 SSNs is a small price to pay... after all, they aren't exactly making a killing on the salary.
Self-referential Sigs are cool on /. these days...
54
This is very prevalent in the federal government. The feds train you to give your social for every piece of paperwork you ever fill out. I was a federal employee and it amazed me that *everything* required a social. When these employees are so used to carelessly using their SS#'s, it is obvious why other people's data is treated the same. Social security numbers in the government are used everywhere and not nearly treated with the care that they should be.
When are people going to learn? The rule in security is denied unless explicitly allowed.
Simple math says there are an infinite number of sites to be blocked but only a handful of sites to be unblocked!
I have no sympathy for:
a) a company that allows the users to install software
b) a company that allows everything and only blocks after the fact
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
"the incident apparently occurred when an employee downloaded a contaminated file from a porn site"
What OS did this trojan run on?
davecb5620@gmail.com
From your reply:
Perhaps you missed the sublety of the quotes around ITSO which implies "your" first point, and didn't read the remainder of my post, which states that the configuration was foobared?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Hey, maybe we should switch to a form of taxation that doesn't require state and federal agencies to keep personal info on every American citizen
Support the FairTax
Could this be a sign that we should switch to a form of taxation that doesn't require state and federal agencies to keep personal info on every American citizen?
Support the FairTax
So a corrected list may look like:
- Allowing data entry personnel to have access to the Internet.
- Allowing data entry personnel to have enough access to their own machine to install a logger.
- Failure to monitor all employees access to the Internet
How is logging all packets sent by a computer going to help? In this case, only by enumerating the personnel records compromised by the moron. Once the data is sent, what difference does it make if you have a log for it?Now that PCs are so cheap there is no excuse to not build a system intentionally for the job at hand.
If the job is to manage high value and sensitive date then why use a known flawed home OS?
Just read down the "features" of XP-professional, how many people consider all that multimedia junk applicable to business uses?
People should start to get fired for running Windows!
Everyone here has their "personal" information ponied out, bought and sold so many ways that even people who work in the business have no clue how much they're just cattle.
Everyone who has bought a home in many parts of the country has their information freely available to anyone on the Internet, often through their local Chamber of Commerce, the same people who enjoy sharing your information with water purifier companies, carpet cleaning companies, local window-installers and the local sham boiler-room fundraising people who like to make you feel guilty that you're not giving money to them, ahem, I mean to the police or the firemen.
It's kind of sad that some chap browsing for fun was walking down a dark alley and got ambushed while using a crepe-paper OS, but I think the message here is that government shouldn't use a computer operating system with so many fundamental weaknesses that you can't even browse the Internet without being victimized.
If people still want security why did they shitcan all the closed-loop VT102 minicomputer systems in favor of Uncle Bill's special sauce? (No solitare on a VT102 system?)
Just like we can't stop someone from blowing themselves up it's foolish to chastise people for being human. We can't fix humanity but we can do something about idiot IT policy and asshat billionaire software moguls who EULA themseleves out of any kind of responsiblity when their software is so weak?
Why do people buy the right to be exploited? Screw putting the dumbass "commandments" on display!
P.T. Barnum's truisms should be hung on courthouse walls and in classrooms!
Microsoft never takes any responsibility, there's no safety net. Everyone who uses it simply ignores the fact that the software license clearly states that there's no promises of fitness or usability. It's one thing to accept that policy for software in general when it's free and another to have to pay for the privledge of being criminalized and exploited by the vendor/developer and anyone smart enough to modify a vbscript.
It's also one thing for an individual to make this choice, and a cockup of an entirely different scope when government offices choose to exploit citizens with such poor decisions.
The dismissed fellow should have been followed by at least two other people, the person who made the purchase decision and the person in IT who supported it.
Every new form of media has it's own Requirimento
Wow, I didn't think you were still around. You've outlived 'YOU ARE SO FIRED' and 'Lose, not loose', you should be proud, and I'm especially honoured to have conversed with you.
What I want to know is: why did he run the trojan? I can look at porn all day without executing any remote code.
The obvious answer is that he runs MS Windows, but that's also a very boring answer. What can go wrong even for people who use sane or modern OSes? Maybe a buffer-overflow in some codec library? Sure, it could happen. Web browsers should be sandboxed, so that it takes a lot of effort to download and execute something with the user's privs. You can't get rid of social engineering, but you can at least make it look stupider. e.g. "You did WHAT? You clicked on save, entered your personal passphrase, then adjusted the permissions on the file to make it executable, and then executed it, and then when the trojan asked you to, you entered the passphrase for the taxpayer database?!?"
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Whatever else government may be it is not trustworthy.