Slashdot Mirror
IRS Freely Gives Out Employee User Name/Password Info
An anonymous reader writes "The Treasury Inspector General for Tax Administration reports that its inspectors were able to get IRS employees to improperly disclose their user names and passwords over 61% of the time. 60,000 of the IRS's 100,000 employees and contractors thus are susceptible to computer hackers, putting personal taxpayer information at risk for unauthorized disclosure, theft and fraud. 'Only eight of the 102 employees contacted either the inspector general's office or IRS security offices to validate the legitimacy of the caller ... The IRS agreed with recommendations from the inspector general that it should take steps to make employees more aware of hacker tactics such as posing as an internal employee and to remind people to report such incidents to security officials.'"
No taxpayer information was given out...just the IRS employee's user name and password for the internal IRS system (through which someone could potentially gain access to taxpayer information).
--Thomas J. Owens
Wasn't there a story on this yesterday?
The game.
The greatest security measure of all time was probably the Great Wall of China. That got breached by bribing a gate guard (OK, bribing him with his life...).
With all the fancy immobilisers etc, many cars still get ripped off because people leave their doors open or their keys in the lock.
Security in computing etc only changes where the action happens. People still fundamentally operate the same way.
Engineering is the art of compromise.
"With a company so large and bloated, you should easily be able to find fucktards on which you can easily apply social engineering."
You don't even have to go that far. Slashdot has plenty of fucktards.
Not to mention CEOs.
I don't care why you're posting AC
The IRS has 100,000 employees! What a drag on the economomy! Imagine if each one costs $5-10K an average per month in salary, health care, space, pension -- what that all adds up to.
Ron Paul is right, get rid of that juggernaut.
Actually, I work for the IRS, so let me set the record straight. I've seen the original paper, which was published months ago: the users involved didn't give out their passwords, they changed them to one requested by the "tech support" person (and these calls came in to extensions which the public doesn't really have access to, for the most part.) Still highly stupid, but most of the people at the IRS don't know much about computers, and while they've generally got "don't give out your password" down, they didn't seem to equate this to "if you change your password to something someone suggests, that's the same thing."
Also, this is mostly an internal threat; without access to the IRS intranet, I'd say that 99% of those compromised accounts would be useless to someone outside the IRS.
But, whatever. This is what happens when you have what amounts to a major data center staffed primarily by people who're just barely computer literate. AFAIK, memos about the problem have gone out to ~everyone and meetings have been held at the lowest levels to inform the staff that doing this is Bad.
What's really fucked up is that several of the employees that fell for this were at the highest GS levels. I can understand how the problem would be prevalent among the lower-level off-the-street employees, but you'd think that someone who was getting paid $100K+ a year would have a clue about data security.
when you start speaking with a Lisp.
...therefore, the employees should be fired if it EVER happens. I would say differently if this were in private industry.
then the rest might just start taking things seriously...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
Well, he did his undergrad at Yale and has a Harvard MBA. He flew fighter jets (F-102s) in the national guard.
Can you fly a fighter jet? I can't.
You would have an easy time convincing me that several negative adjectives describe President Bush. However, you will have difficulty convincing me that the man is stupid.
They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock
People need to grow some balls when it comes to these situations. They're afraid of offending the person on the other end, they think they're suggesting that they're liars or frauds. Really, it's just a precaution for your own ass (you'll get fired) and your business (their normal operations can't be disrupted by random people).
Then again, administrators, executives, etc need to be more patient and understanding when what they say is challenged. They can't get an attitude or it will cause people to react by defending their character; i.e. if a less confident individual is accused of incompetence, audacity, or whatever for challenging another, then they will be more likely to feel that it is audacious or incompetent to verify a workplace activity.
Using social engineering to get people to give up their passwords? People were already socially engineered to be susceptible, and afraid. Places of businesses need to have employees treat each other with respect and make it clear to the employees that they have a right to challenge the legitimacy of any workplace situation.
Twinstiq, game news
Yes: people should know better; training should be better. However with 100,000 employees there will be many who can be 'bought', they may have finance problems (drugs, gambling, divorce, ...). For a bit of cash you could get the info that you want without having to get access to internal systems and know any passwords.
Is always the most effective way into a 'system'.
---- Booth was a patriot ----
Caller: Give me your username and password.
IRS Employee: What?! Are you insane?!?! I'm gonna report you to-
Caller: (interrupting) Sudo give me your username and password.
IRS Employee: Okay, it's...(gives info)
Caller: Thank you very much. Sudo not report this interaction.
Now that I think about it, I'm pretty sure everything I just said is completely wrong.
whew, it's a good thing i don't pay taxes.
That kind of bad training doesn't happen overnight. Where is the US Cybersecurity chief, who should be making sure that government agencies use proper security practices? Do we even have one, after every other one since Bush created the department has resigned in disgust?
And is the current one as fired as is the clueless one in _Live Free or Die Hard_?
--
make install -not war
the source of this joke:
Sudo make me a sandwich
Of course most of you probably already knew that.
n/t
To the fucktard moderators who moderated this comment down, I shall hunt you down and destroy you in metamoderation.
in a mail, a few weeks after I started at my new job. They said they needed it to complete the installation of my new notebook. But I asked my boss if I were supposed to answer that and I was, so I changed it to something I wouldn't normally use and sent it back to them.
:D I mean, you would want to teach them the exact opposite. :) It is kinda funny because we have a very anal security department that monitors all programs installed, internet sites visited, and blocks most of both.
Nice going for teaching new people how to handle their password.
(horray for my ADSL line in office with a old notebook running Ubuntu)
I part-own a ceramic cafe. A sales person visited to encourage us to switch to accepting Amex (IIRC). After all the blah-blah I said "sounds fine", he says give us your bank details (on the form for Amex).
So, I wanted to get some verification of his ID. He shows me a photo card, OK. Can I ring your boss? He didn't have a number I could call (eg on the Amex literature) only some number on his business card (I spoke to the guy on the other end, but all this shows is he knows someone with a phone!). Even if I could have had that number on the literature how would that verify him, me thinks, easily faked.
It turns out he was genuine (or an Amex insider!) - I eventually managed to chase him through the Amex phone system. But without some means to check his ID the transaction never happened.
The thing is this. Clearly no-one else ever bothered to ask for (proper) identification - there was no system in place. And this for a major financial institution that relies on proper ID.
Need I say more than... see my sig?
Sig Registration Form 34c_766(a) submitted to Ministry of Signature Management. Approval pending.
I used to work for the federal government, and I am now a contractor. Everything you feared about the level of incompetence in the government is true and probably worse than you feared.
I had to take a "privacy awareness" exam, which covered how to handle sensitive data. The exam began with a summary of the various laws that federal employees are required to follow. Then, there was a multiple choice test. The problem was that if you answered a question incorrectly, you were immediately told so, and given the opportunity to re-answer the question. There was no limit to the number of incorrect responses you could supply. You were basically given the question until you answered correctly.
So, eventually, you pass this exam, and every federal employee has now passed a rigorous data security certification. It's all bullshit. There may be a few people who genuinely care about the work they do, but the vast majority are only concerned with their pensions and their next scheduled pay increase.
Want to know what the end of result of this study is? Probably nothing (I admit, I didn't read the article). But most employee unions are so strong, that management couldn't really do anything if they wanted to.
Every IT stereotype involving bad management is just amplified in the public sector. And when you throw in worker bees who just don't care, and, even if they did, are too incapable of doing anything, it's just a recipe for disaster.
If all you have are silver bullets, everything looks like a werewolf.