Slashdot Mirror
$2,000 Bribe Bought Password To DC P.O. System
theodp writes "While the Administration is counting on new Federal CIO Vivek Kundra to simplify and speed the federal IT procurement process, it's doubtful he'll be able to reduce red tape to the extent that a former minion of his did at the scandal-rocked D.C. Office of the CTO. Exhibiting some truly out-of-the-box thinking, project manager Tawanna Sellmon not only processed phony invoices for the contractor at the center of the D.C. bribery and kickback scandal, she also gave him the password to the city's computerized database used to track purchase orders. Sellmon pleaded guilty last week for her role in the scam, which netted her an envelope containing $2,000 in cash, as well as an undisclosed number of $25-$100 gift cards."
what should I set the reserve for the database password of the state police toxicology test results?
Do you have remote access capabilities onto your Network? VPN, Citrix, not blocking GotomyPC? Has anyone at your company done the same thing, offering the competition direct access to your systems?
...is just how laughably cheap people can be bought for. Two grand and some gift cards? SERIOUSLY? You'd go to jail for that? When you're a project manager at a government job with great benefits, probably making more than that every WEEK?
It's like the Abramoff scandal. People will sell out their country for Capitals tickets. It's not even the Bulls or something!!
Freedom isn't free; its price is the well-being of others.
If TFA isn't a Troll I'll eat my shorts.
What's the best way to SEO slander someone.... without getting hit by a lawsuit? Just put them in the same article with a dubious individual - make a virtual connection even if no real connection exist... then people will start discussing them together and voila - they must be close friends!
Shameless and disgusting.
What's worse is that the reference to Kundra was obviously added after the story was initially posted on the linked site... that text with Kundra's name isn't even in a p tag, it appears styled differently in the rendered version as well, almost like an editor went in and added it after the author had published - "Hmm we need more hits on this story, let's put Kundra's name in it... that will get hits".
A fool throws a stone into a well and a thousand sages can not remove it.
Reading TFA, it looks as if she didn't sell the password, she gave it away to be helpful, and the contractor only later gave her the $2000 (and gift cards) as a present. I.e. she didn't realise what she was doing, that the password she gave him permitted him, basically, to authorise any bill he chose to submit. So she is primarily guilty of total stupidity rather than criminal intent. Maybe, for the good of the species, such stupidity should be treated as even more criminal - but it isn't.
What this makes clear, yet again, is that the human is the weakest point in any system, and any human who has not received positive training in security is a very weak point indeed. Which says that, whatever the physical security, any government database with thousands of users, let alone hundreds of thousands as planned form some, will be subverted, for certain, within months.
Consciousness is an illusion caused by an excess of self consciousness.
This article is an ideal example of a social engineering crack. Consider the comparative difficulty of a technical cracking job and compare it to the simplicity and cheapness of what actually took place. The solution was actually quite elegant in a sordid way.
I once worked for a company that was experiencing a surge of highly organized fraud originating from Romania. Before I left, we were preparing to develop a major anti-fraud application, etc., at great expense. At one meeting I suggested that we just hire a few Romanian private detectives to knock on some doors and quietly suggest to the lowlifes that it would be healthier to leave us alone; the other people in the meeting looked at me as though I were green.
LOL.
"Man is nothing without the works of man" -- Helvetius
No manner of technology can defeat good, social engineering. An intelligent attack is made upon the weakest link in the system. In this case, an unscrupulous user with privileges.
The cancel button is your friend. Do not hesitate to use it.
The Constitution defines treason. And this isn't it, much as you'd like it to be.
"I do not agree with what you say, but I will defend to the death your right to say it"