Trojan Compromises Oregon Taxpayers

Blair writes "An employee at the Oregon Department of Revenue downloaded a trojan file from a porn site, possibly compromising up to 2,200 taxpayers. An information technology security officer with the state said, 'the released data likely involved names, addresses or Social Security numbers, or possibly in some cases all three.' I guess some of our public workers are having too much fun after all."

Comments

Cliché

[TheGatekeeper]

Cue trojan condom jokes, where's my +5 funny?

Re:Cliché

[tomhudson]

Hey, maybe I can get government funding for creating an approved porn list of sites that government employees can surf without getting a drive-by smack ...

.. or at least a research grant from the Department of Homeland Security ... after all, if we don't have safe pr0n, the terr'rists have won!

Re:Cliché

[afaik_ianal]

It's just lucky this happened in Oregon, rather than Virgina.

Now where's my +5, huh?

Re:Cliché

[kfg]

If people from Troy, Oregon are called Trojans, how come people from Tampa, Florida aren't called Tampons?

KFG

Re:Cliché

[FrankDrebin]

Here goes...

• Somebody's gonna get a ribbing for that cock-up!
• Obviously a problem with the firewall's LaTeX filter...

Only 2000 people paying tax in Oregon?

[jd]

No wonder my taxes this year were so high. Hey, guys, I can't pay for Trimet on my own!

moron!

[eobanb]

Forgive my crudeness, but...what an idiot!

Actually there seem to be multiple failures in this. Running Windows, not employing some sort of web filtering software, lax rules on conduct...I don't know where to even begin.

Re:moron!

[megaditto]

Actually there seem to be multiple failures in this. Running Windows, not employing some sort of web filtering software,[...] Actually, this is not surprizing at all. Remember all the red tape envolved!!!! To deploy 'web filtering software', a request has to be generated, afeasibility study needs to be performed, a 'validation' process has to be followed, SOPs have to be written, then the whole thing re-certified in its entirety (used to be, you would need to re-certify each component again after modifying one part). Of course the reason you they Windows is that NT 4 and 5 were 'certified' by the govt... if the site admin decided to bend the corners by installing linux on the desktop or router, he's be out of a job and possibly in jail! Frankly, they don't get paid enough for it.

Re:moron!

[Anonymous Coward]

We should list the failures. Otherwise we don't learn anything. Since events like this are occurring all over the place, there is obviously an issue with government security controls. I'll start:

1. Allowing private data to be stored on a workstation that has access to the Internet.
2. Failure to encrypt private data or a private key (presumably) when the computer is connected to the Internet.
3. Allowing a user who has access to private data to access sites that do not have anything to do with official duties.
4. Failure to log data packets sent on a secure computer (not every packet, but at least the bytes sent).

All of these have the same root cause: the government and government employees did not consider the private data in their custody important enough to require rigorous controls and rigorous controls were not implemented. We could break down the problems into training issues, operational issues, etc., and politicians certainly will. But I would guess that the issue was due to a lack of political motivation to hold accountable every state IT group that has access to private data. Secure networks with access to classified or private information can be built, like the SIPRNET, but people didn't think the private data was important enough. It will change in Oregon (at least for the Dept. of Revenue) due to this incident, but elsewhere in the country people will carry on business as usual, until it affects them.

Anyone want to guess how long it takes before Social Security numbers become worthless because of these data intrusions? We know the government isn't going to learn.

Re:moron!

[Anonymous Coward]

I work for a school district in California and as part of my duties I am responsible for the content filter (squid children+dansguardian+squid parent peers) and I parse the content to sarg logs with a few custom reports. One of those reports is between the hours of 3-5pm and on

I can tell you, the majority of web usage during the hours where students are not present (90%+ of bandwidth utilization yearly, nearly 100% during Late Nov/all Dec) is personal shopping. Sure, there is a good deal of sports and a spattering of news sites as well. But the people your tax dollars pay to be doing work, are spending your tax dollars and getting paid to do it.

Individuals who get caught have their internet disabled and *might* be written up. Being written up in government means you might be able to have it used against you if you: a) sexually harass someone, or b) come to work drunk/stoned. As far as penalties in government work, umm... there aren't really any. I do have to pay state income tax (with no other income source than the state) of course there are lots of other inefficiencies, rampant graft, overly complex beurocratic heirarchies and completely complacent unions but such are the benefits of socialism.

Re:moron!

[Anonymous Coward]

Why do you assume there was no web filtering software?
There was. Major player in the industry, updated every day.
Virus software on the desktops set to update ever 2 hours.
This was a zero day exploit from a non-obvious, not yet blocked web site.
It reported back only via port 80.
The trojan wasn't picked up by virus protection until after we reported it, which was after we discovered it.
He might have been an idiot, but not a dumb one.
As for rules on conduct, suprisingly, browsing porn is actually against the rules.
You have to sign an Internet Use agreement before you can use the Internet.
Windows? Well, we have no choice there.
There were some things that the tech staff has asked for that we now are likely to change, but the tech stuff is much better than I've seen in the other agencies.

Re:moron!

[djupedal]

nearly 100% during Late Nov/all Dec) is personal shopping

'Cake & eat it too' kind of Sheriff you are, eh?

There is a reason you're only a filter nazi and the school admin is an admin...

Most employers know that their employees shop online via their work computer - and most don't break a sweat of it, because it is either allow it or face having them absent an entire afternoon just to drop by Border's. Shopping online for 30 minutes can take the place of driving around, looking for parking, cruising the mega-mall on foot and standing in long queues just to pay for one pair of ear rings....all of which can take up the better part of an afternoon.

What the district give up in active hours is made up for in spades simply by having the teacher at their desk. Take the ability to shop away and see how fast they all head for the exit. Besides, when they stop using the computers, and there is no longer a need to filter the hell out of 'em, you no longer have a job.

Re:moron!

[Mr Z]

BINGO! And that time not spent driving around hells half acre to get some chores done leads to a less stressed, happier employee. And, in the case of teachers, more time at home to grade papers. :-) It's not like teachers do all their work on site between 8AM and 5PM.

--Joe

Re:moron!

[Secrity]

Social Security numbers should never have had any value to anybody except to track an individual's Social Security (not IRS) taxes and benefits.

There are only four entities that should have your Social Security number; Yourself, your spouse, your employer, and the US Social Security Administration. Nobody else should have your Social Security number; not the IRS, no state or local governments, and especially; not the banks, lenders or credit bureaus.

When Social Security numbers were introduced, many people resisted them because they feared that they would become national ID numbers. The US government appeased the US citizens by assuring them that Social Security numbers would and could never be used for identification -- that is why Social Security cards used to say "Not to be used for Identification." The long and short of it is that the US government lied to the citizens and Social Security numbers have become de-facto national identification numbers used and misused both by various government agencies and private entities.

Indicitive of a larger problem

[mcpkaaos]

What was real data doing on a workstation with Internet access in the first place? One would think (hope?) that such data would be under heavy lock and key and only accessible by the software written to manage it or, when absolutely necessary, a trusted administrator with lotsa logging.

It is absolutely amazing to me that this event was even possible.

Re:Indicitive of a larger problem

[megaditto]

a trusted administrator with lotsa logging

A competent admin is working elsewhere, where s/he is paid accordingly. The IT leftovers, not able to get hired by the private sector, get to work for the Govt... Generalization, of course, but more true than not.

Remember, in 2006, nearly 5 years after 9/11, most FBI employees still do not have a work email access, or the ability to do multiple word searches (e.g. cannot search for "bin laden", have to enter just "bin", then scroll down, because of the space character!). So what can you expect from a State govt of Oregon...

Re:Indicitive of a larger problem

[KnowledgeFreak]

Mod this guy up, he knows what he's talking about. I work with Data in the private sector and data like this cannot be on an unprotected machine.

What he's saying is that the data should only be on an oracle or whatever database where only reporting applications can run pre-written reporting programs on it, Those program will then return reports to the idiot business people. Those reports will not return a soc. or other identifying info all at the same (and rarely that stuff at all).

The reporting monkeys take *that* home. No one actaully gets to see the data. This is exactly what part of sarbanes oxley is forcing the private sector to do with customer credit card data and other sensitive info.

Re:Indicitive of a larger problem

[TheViewFromTheGround]

It is absolutely amazing to me that this event was even possible.

Actually, it isn't that amazing at all. I'm wrapping up a sysadmin gig in the nonprofit world (and moving back to strictly commercial work) right now. Specifically, I'm in legal services, where the IT talent is very thin but some of the privacy and security needs are pretty serious. I can tell you, I know of three legal services organizations or programs in the US that practice anything resembling defense-in-depth. That's why a lot of recent attacks (like the rise of "spear-phishing") use social engineering to get in. Because once you're inside the walls, so to speak, far too many networks are open season that really shouldn't be.

If you're throwing around passwords in the clear or unecrypted files or have network shares with sensitive information and broad access on the local network, the risk is there because there's always a door to the inside in our pervasive-Internet world. In many cases, that door is through human nature/sociological probability/whatever you want to call it.

A sysadmin must absolutely assume that there will be a user that is going to pull this kind of stupid crap, and design their defenses around it. But, speaking from experience, go to a big ol' local nonprofit that has lots of sensitive client information and start grilling the sysadmins about defense-in-depth and see what they say. You think they're monitoring all local network segments for malicious traffic with Snort? Encrypting local traffic and keeping a tight lock on any shared resources? Have a containment strategy if they detect an intrusion? Have clear and enforceable policies with respect to data retention or user activity? You'll definitely find folks are running Symantec Enterprise and have a badass firewall, etc, and that's cool, but it just isn't enough.

Shoot, this isn't local security, but nonetheless some major ASPs that handle donations for nonprofits provide the option of sending credit cards numbers in the clear. Sure, you're looking at a secure page, but some script is actually doing the real POST over straight http, and you never see it.

Defense-in-depth is going to become more and more critical for everybody, especially small and medium sized businesses that have been marketed elaborate and powerful perimeter defenses and anti-virus companies have hawked products that day-by-day become increasingly irrelevant to the real security threats, which must rely on tightening local security measures and doing actual traffic analysis of the network itself, not just watching for compromises on the client, because those compromises are going to be harder and harder to detect as the compromises become more and more social in nature and frankly, only good for post-mortem analysis, after the catastrophe has already hit.

A final thought: Elaine Scarry, a philosopher, is writing a book on the meaning of consent in a world where nuclear war is a possibility. I think one could ask some questions about the meaning of technological freedom in a world where a lot of greedy, malicious people are out to clobber any and all security weaknesses on computing machines that store and transmit incredibly sensitive information.

Re:Indicitive of a larger problem

[mr_zorg]

What he's saying is that the data should only be on an oracle or whatever database where only reporting applications can run pre-written reporting programs on it, Those program will then return reports to the idiot business people. Those reports will not return a soc. or other identifying info all at the same (and rarely that stuff at all).

You seem to be forgetting about the developers who design these things and the reports that the idiot business people run. Only 2,200 records were compromised? Sounds to me like a sample data file for a developer. I'm a developer and I have real data on my hard drive. Of course, I like to think I'm smarter than downloading sketchy files from a porn site on my work machine. But I'm only human, I may screw up some day, who knows.

Re:Indicitive of a larger problem

[ObsessiveMathsFreak]

I work with Data in the private sector and data like this cannot be on an unprotected machine.

I don't know what companies you've been working for, but out there in the real world, people tend to run things by the seat of their pants. I've seen data, including credit card data, stored in a database on a windows 2000 server directly connected to the internet. I've had data worth millions of dollars emailed to me on the same machine I browsed Slashdot on during lunch. It was a windows 2000 machine too.

That's just personal expierience. I've heard stories of critical data sitting in USB shared drives, secured by nothing but friction to their sockets. Private company files transferred to the upstairs office via a hotmail account. Databases being backed up to iPods. The list goes on.

These stories didn't come from government or other public organisations. No. These are stories straight from private industry, that magical market force that will save us all. If you think people actually follow the rules out there in the real world, you'd do better to think again.

Re:Indicitive of a larger problem

[maxwell demon]

I work with Data in the private sector

You work with Data? I always thought he were just a fictionary Star Trek character ...
SCNR :-)

From the I've-never-had-a-2,200-some-before dept.

[NMerriam]

Though on the bright side, porn site customers finally have a way to get screwed over the internet!

Windows+IE+Porn

[pembo13]

= Owned

It's fitting I suppose...

[mojotooth]

Only figures... Since most of the money I was supposed to pay my taxes with, I used to buy porn anyway.

Re:It's fitting I suppose...

[Hobbes897]

most of the money I was supposed to pay my taxes with, I used to buy porn anyway.

Woah woah, you paid for porn? When did this start?

Whitelist sites they can and cannot use

[linzeal]

There is no reason anyone handling SS numbers should be given this sort of carte blanche access to their computers.

Indicative of the norm

[Sentri]

Most people just dont give a damn about conmputer security.

This is the same old story over again, it shouldnt suprise you, why? Here's some links to get you started

Wow...

[zmilo]

I knew Oregon had a lot of wood, but this is rediculous!

On the other hand

[Sentri]

FTA:

"Electronic files containing personal data of up to 2,200 Oregon taxpayers may have been compromised by an ex-employee's unauthorized use of a computer, the Oregon Department of Revenue said Tuesday."

Lets read that again

Electronic files containing personal data of up to 2,200 Oregon taxpayers may have been compromised by an ex-employee's unauthorized use of a computer, the Oregon Department of Revenue said Tuesday.

EX-EMPLOYEEE!
What the hell was an ex employee doing on site, surfing porn. Forget computational security, what about physical security.

In the words of Napoleon Dynamite "Freakin Idiot!"

Re:On the other hand

[MostAwesomeDude]

Well, if he wasn't fired before, he sure is now...

Re:On the other hand

[whitehatlurker]

There is a switch in the story from employee to "ex". The employee was fired subsequent to the leak, but was "working" at the time of the download.

You don't need a trojan ...

[Nicolas1979]

I just saw on CNN that some stupid government people in arizona and virginia opened up a public record accessible online. Maricopa county http://recorder.maricopa.gov/recdocdata/GetRecData Select.asp And the one who complain Virginia Watchdog http://www.opcva.com/watchdog/

Another view, better tech quality

[whitehatlurker]

Here's a better version. The site did hassle me about where I lived for a bit, until I said I was a foreigner.

Quote from this one: "We maybe had a false sense of security," O'Meara said.

Whoa, maybe. Y'think?

The Trojan horse gathered the equivalent of 7,000 text pages of data.
  Somewhere a scammer is very, very busy.

Oregon = Oregon Trail

[Tickle Cricket]

You get a Trojan!
You die of dysentary lol

Welcome to the present...

[Sparr0]

None of that information is secret. Your SSN, Address, and Name are all public information, the subject of numerous public records that anyone patient enough can pay $.10 per copy to get. Or just visit the appropriate county records website.

Re:Likely a reporting wonk

[mcpkaaos]

My guess is they had the data locally in Excel spreadsheets, fiddling with things.

Dummy data. In all my years as a software engineer I have never worked with real or production data. There is never a reason for it, so just dummy something up and use that. Then situations like this are simply impossible.

Many people have secure information on their hard drives too.

Not in the Department of Revenue. At least, they shouldn't. That they obviously do should be a huge cause for concern and a process audit or three.

So...

[getwhipped]

Is that a link to the trojan or the porn site?

7000 pages?

[afaik_ianal]

More than 1,300 people face identity theft after a state employee let in data-stealing spyware.

and

The Trojan horse gathered the equivalent of 7,000 text pages of data. But O'Meara said his staff spent weeks poring over the data and found no tax files or financial information. He said it was limited to Social Security numbers, names and addresses.

So that's ~5.3 "pages of text" per person they got only the SSN, name and address for. Either people in Oregon have really long names and addresses, or something else got sent with that data. I smell a cover up! :)

No Lawyer Necessary - Only Patience. Here's How

[Anonymous Coward]

when information is leaked about your own private stuff, you should get a lawyer.

A lawyer is unnecessary and expensive. It's easy to handle ID theft once you understand that the situation cannot be corrected immediately, that you shouldn't go ballistic, and that time and patience (and a few simple procedures) is all that's required to correct the situation:

1. Write to the major credit bureaus and ask for a credit report from each. Explain that you're a victim of ID theft and they'll give you a free credit report.
   
2. Ask the credit bureau to place a 7-year freeze on your credit report (not the 3-month freeze). That ensures that anyone who extends credit must contact you directly (usually by phone) prior to extending credit. Make sure the credit bureau has your phone number correct!
   
3. If the ID theft resulted from something locally enforceable (stolen wallet, burglary), file an offense report with the local police and get a printed copy of the report.
   
4. find any fraudulent/old accounts on your credit report. For old accounts, write to the address on the credit report informing the creditor and ask that the account be closed. For fraudulent accounts, notify the creditor of same and include a copy of the police report (above). For any fraudulent account _applications_, also notify the creditor that the application was fraudulent.
   
5. In all cases, ask the creditor to notify the major credit bureaus of all updates/closure of accounts.
   
6. Keep paper copies of all letters - use a separate paper file folder for each account or account application. Seems tedious, but you'll be glad you did, believe me.
   

Above all, be patient, take your time (there's no rush, all changes are made at snail mail speed at best) and don't worry. Just go through the steps and everything can be corrected within about 180 days.

After that, make sure you check your credit record with the major credit bureaus at least once a year. They'll send this for free. Follow the above steps whenever you see a fraudulent account or application. The Bad Guys won't be able to touch you.

They don't have to care as long as others pay

[quentin_quayle]

Is it just my perception or is this becoming routine now?

I used to be only concerned in a detached way. Then *today* I received a letter from the student loan people saying, in essence: "We lost a dataset including your information. Sorry! Better contact the credit bureaus, and watch your financial statements. Have a nice day!"

The only way we are going to have data security is if the parties that fail to secure data are held responsible for the consequences to others. Ideally, that would mean that if someone commits fraud using my stolen data, the organization that lost it has to pay me the actual cost of correcting credit reports, changing all my accounts, compensation for time spent, any lawyers needed, etc..

Instead the banks are allowed to exploit the situation by selling insurance against it. We can't even get disclosure laws everywhere.

Well excuse me for ranting. I guess my only point is, the only way the technical and user-education type of solutions will become relevant is if the costs are placed appropriately.

The internet is for porn

[Alioth]

Well, at least the employee knows what the internet is for:
The internet is for porn! http://video.google.com/videoplay?docid=5430343841 227974645

An information technology security officer!!!??

[Zero__Kelvin]

Did the "Information Technology Security Officer" happen to say why they were running an OS and application configuration that would let this happen in the first place?

Noticeably missing from all of the articles I have seen is the name of the OS that was compromised. Is that because the news sites don't know there is more than one OS, because the reporters are incompetant, because Bill Gates will fire them if they mention it (think msnbc subsidiary), or because the reporters figure it is patently obvious that it was Windows since the compromise happened in the first place?

Three questing before firing DOR squatters

[BadassJesus]

1) How (the fuck) is possible to have DOR private database on a computer that is connected to the internet ?
2) What (the fuck) is DOR employee doing on the internet porn site during working hours ?
3) Where (the fuck) is this whole world coming to!? (err, is he a prudent republican?)