Slashdot Mirror
Uncle Sam's Travel Site Grounded By Breach
McGruber writes "Northrop Grumman's Govtrip.com website has been shut down following a security breach, according to a report by 'Security Fix' blogger Brian Krebs. Being a federal employee and frequent work traveler, I am (was?) a Govtrip user. My agency required me to use Govtrip to book all of my trips, including my airfare, car rentals, and hotel reservations, so Northrop Grumman's Govtrip databases contain my frequent flier numbers, Avis & Budget car rental numbers and frequent hotel guest (Choice Privileges, Marriott Rewards, Priority Club, etc.) numbers. Northrup-Grumman also stored all of my trip itineraries, including destinations, dates & modes of travel and the particular vendors (airline, hotel, rental car brand, etc.) used on a particular trip. Also stored on the website were my work travel credit-card (it has a $15,000 charge limit), personal checking account where my travel reimbursements were deposited, my home address, and emergency contacts ... just imagine what an accomplished social engineer can do with that combination of information!"
I think you should have posted that anonymously, just to be safe.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
If having another's check book account number means that one can withdraw from it, here's an easy fix:
Each account gets (at least) 2 numbers:
1. to deposit INTO it,
2. another to write cheques to get $$$ OUT of it, &
3. maybe a 3rd to let vendors & banks (with a cheque in-hand) to check that the balance covers the cheque.
It would - with that structure - not matter that this web site's security is breached (at least for -that- particular account).
The first line of the summary doesn't even match TFA. A few agencies, FAA & DoT are mentioned explicitly, started blocking the website on their networks to prevent the download of malware/viruses.
TFA specifically says that user information was not compromised, the submitter's car reservation confirmation number from last month is safe. The site was not shut down and loads fine for me.
What I don't get is the reasoning behind hosting 3 servers containing information on US government employees in Taiwan, what the hell?
Contractors basically bid on any contract they can. Then hire the expertise needed to complete that contract during/after the bidding. Many of the big name contractors do A LOT more than their traditional public image leads many to believe. .gov or .com? The government, in general, doesn't have the desire to produce and maintain a site like that in-house.
Also, would it have really made a difference if the website was
...you're totally screwed.
'hackers breached the site, then modified it to redirect users to a rogue URL that in turn directed attack code against their systems'
'was this breach similar to what happened in the FISERV/CheckFree incident, or did something else happen?'
Can we at least spell Nothrop Grumman correctly?
Northrop-Grumman (i.e. the company who runs the site, the guys who fucked up) is private sector.
Being in the private sector is not magic pixie dust that makes people smarter and systems more secure.
Fixed now.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
They are also the company that is basically taking over all of the IT functions for the Commonwealth of Virginia. It's working about as smoothly as you would expect.
I'm sure once all the agencies have turned over all their equipment, applications, and network services to Northrop-Grumman to be run from their new high-efficiency data center, that It service will improve, security will be rock-solid, and costs will drop like a stone.
"Somebody has to do something. It's just incredibly pathetic it has to be us."
--- Jerry Garcia
Let me enlighten you here mr security expert. Once you hit that submit button on your shopping cart at joe's online store, you have no idea what just happened with that information. I don't care if you
put in your cc number a thousand times it does not in any way mean that the other end is not storing the information. In fact for all you know it sends a email to someone that processes the order, however
mr hacker already owns that server and grabs everything running through the mail spool. Or has just modified the code to send himself a copy of your information as well.
Got Code?
The company has been claiming to be "...expanding their monitoring capabilities to include additional network and host based intrusion monitoring technologies" for years. The problem is that no one is willing to pay for it, because Northrop's customers correctly assert it should be a part of any IT infrastructure implementation contract. Since no one is willing to pay Northrop additional money to competently manage their networks, Northrop doesn't.
Making the problem worse, Northrop's sysadmins routinely delete or trim logs to which they have access because the company's information security will not tell the sysadmins what events are considered "reportable", so they log everything, which results in log files so large they can't be stored, or even reviewed daily.
And some of Northrop's server infrastructure won't support the current revision of the vendor's anti-virus software, so various divisions of the company request waivers to those requirements. Those waivers are a violation of company policy, even if compliance is impossible to achieve, but no one wants to re-write the policy to recognize the cold, hard reality that Northrop's infrastructure is so complicated that the "one size fits all" approach is the path to failure.
And, to top it all off, Northrop's information systems auditors are incompetent. They routinely refuse to document known deficiencies because it would make the company look bad, and the company's external auditor, Deloitte, sends softball auditors to Northrop that have no knowledge or expertise in the information systems they're auditing. Because Northrop has a documented "system of control", it's considered "mature", even if most of the controls are fiction.
So this doesn't surprise me in the least.
I was working at CSC in 2001 - 2002, and CSC had the contract for the Navy's civilian personnel timekeeping system. CSC had similar problems, with similar causes. Then, as with Northrop, the real problem is the utter lack of customer oversight and accountability.
If it let them snoop on who was traveling to their competitor's facilities during particularly hectic contracts, I'd say it would have made a difference.
Not that it's contracted out, but that it's contracted out to a large firm who already does a specific kind of business with the government. Contracting out to orbitz or american express for travel is one thing. Contracting to someone who has a corporate interest in knowing who visits Boing, is another.
I hope the CIA wasn't required to use it! :-)
The Website was not disabled. Rather, the web-based compromise began redirecting users to malicious websites.
It is interesting to read that the 'compromise' was achieved through eAuthentication, a ubiquitous federal application serving multiple agencies.
It seems like the attack could have been more harmful than this apparently relative ineffectual inconvenience.
I'm a Govtrip user as well (the "E-Gov Travel Center for Excellence" just emailed me to tell me everything is just fine, so it must be back) and my primary question is why do we have defense contractors running internet travel sites?
Govtrip took a long time to become ready for prime-time and to this day isn't a model of the programming arts.
Wonder how much it costs...
A greater concern is "Electronic Questionnaires for Investigations Processing (e-QIP)". If you need a security clearance you go to the e-QIP site and put in your life history, friends, bank info, credit history, medical history, everything.
It's a identity thief's dream, absolutely everything needed for somebody else to become you. In fact someone with this kind of information would have a better claim to being you than YOU would.
But don't worry, it's hacker proof.