Slashdot Mirror
Pentagon Credit Union Database Compromised
Trailrunner7 writes "The credit union used by members of the US armed forces and their families has admitted that a laptop infected with malware.was used to access a database containing the personal and financial information of customers. The Pentagon Federal Credit Union (PenFed) issued a statement to the New Hampshire Attorney General that said data, including the names, addresses, Social Security Numbers and PenFed banking and credit card account information of its members were accessed by the infected PC."
Any banks or credit unions not using Windows?
I have a PenFed account and haven't heard anything from them. What should I be doing? The article doesn't give any advice.
NOW can we get legislation fixing the authentication problems in our banking system? Or do we need it to happen to every member of Congress, too?
As always, people not following proper procedures.
---- Booth was a patriot ----
When your security leaks like a sieve?
And if those data get secretely sold to bad guys, do you think it's better than free publishing all of them?
Maybe Computers will never be as intelligent as Humans.
For sure they won't ever become so stupid. [VR-1988]
I still find it crazy that systems like these don't have dedicated computers for accessing that info. Personally, I *refuse* to enter ANY kind of password into most peoples laptops, let alone access sensitive information belonging to thousands of people. Then again, no one cares about "other peoples information" until that other person is you...
They gave me a new CC# right away, and offered two years free credit monitoring. Meh, Better than nothing I guess.
Members of the U.S. government sure have knack for getting malware.
This is a credit union that happens to be used by military personnel. The credit union is not on a military network.
#fuckbeta #iamslashdot #dicemustdie
There needs to be more air-gap security implemented in systems that are as important as banks/credit unions.
I'm not referring to the air-gap currently between the ears of whoever is in charge of their computer systems.
What happened to keeping personal information like this to private mainframe computers, with LAN access only? Putting data like this on a laptop is only asking for trouble. We never seem to learn.
I wonder if there should be laws that make persons working for banks, utility companies, etc. criminally and civilly liable for violating that organization's IA rules.
I'm talking about organizations responsible for information systems whose compromize could lead to significant public harm.
I wonder what will happen the first time data the Government actually cares about is compromised. It will be interesting to compare their response to this to what they would do if someone were to download the TSA's no fly list, for example.
Your troll-fu is very weak.
This point goes to you.
Let's look at this.
In short, infected devices have caused serious problems (and occasionally fatalities). The Pentagon has been subject to malware-related cyber-attacks, including (as noted in the list) serious cases of espionage, in the past. That people are (a) running devices that are open to attack, and (b) are able to connect such devices to any Pentagon network, is seriously pathetic.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Summary is misleading "The credit union used by members of the U.S. armed forces and their families" made me think it was referring to my credit union (USAA, open to federal employees and families, not just armed forces). It had me worried for a moment there.
My webcomic
In the end, these sorts of egregious breaches can be blamed on IT and/or management. The latter mostly in cases where they unduly restrict IT from doing their jobs properly. In other (most) cases, it is because IT wasn't on the ball with security.
These stories come out again and again and again, and yet we still see people being allowed to do the wow-stupidest things you can imagine.
A few simple rules for people who haven't learned from these countless news stories:
1. Company computers should only be allowed to perform company functions, and only company computers should be allowed to access company assets.
2. Computer users should never have more access to their own computer or to company assets than they need. And always be conservative at first, and bump up their privs later if it becomes necessary.
3. In situations where users might have access to assets that could potentially put other people's information at risk, those users should be required to undergo some basic security training.
I'm just typing off the top of my head (I'm sure /. can add a few more), and already I've delineated more than I see done in most operations I've seen. It is rather amazing.
And it is extremely infuriating. These people are in charge of my assets. Increasingly all of us have to (if we want to participate in modern society) put more and more of our data into the hands of others. And again and again they prove that they don't deserve the trust we're putting in them.
They were probably running McAfee or Norton. It seems quite a number state and federal organizations still use the relatively useless security software from these two awful corporations.
They'd have you deported to Sweden on charges of "sex by surprise".
This is an opportunity for more spending. More spending is justification for a bigger budget. A bigger budget is the objective of every politician and bureaucrat. (You do realize that every year, government costs more than the year before, don't you?) Finally, this makes the business of government more lucrative for those who can exploit -- ahem, "distribute" -- that cash flow for personal gain.
You're not in the business of government, are you?
Freeze your credit and put a fraud warning on your profile with ALL three bureaus. I wouldn't trust your credit union to do that.
Credit monitoring tells you someone has gotten credit out in your name after the fact and two years free isn't enough. It should be for life.
See clarkhoward.com for more info - search for "Credit Freeze" and "Identity theft".
The CAC number 404.892.8227 is out so far this week because HothAtlanta in still under snow and ice.
uh, what?
Because let's face it, the US government can't even keep ANYTHING secret or secure. Apparently not even their darn bank accounts.
(If at first you don't succeed, do it different next time!)
That information should have been encrypted within the database. Why, just the other day SQLServerCentral.com posted a tutorial on creating a transparent database encryption layer. When managing critical information like SSN's or embassy cables, clear text is just asking for a compromise.
Oh, and I am not saying Windows is anything at all good to have in anyone's life. In fact, the insecure nature of laptops and malware demands that security be increased closer to the sensitive data.
Seth
$5 / month hosted VPS on linux = awesome!
it seems like a running theme that the government makes a slow/half-assed attempt to apprehend this criminal brand of hacker. this seems like one situation they should actually putting significant resources into tracking down a jailing this individual and anyone that purchases the data regardless of the nation they are in. i know they can do it, i saw how quickly the got to Bradley and how many strings they have been pulling to get to Assange. this seems like one enterprise worth shutting down regardless of cost.
Anons need not reply. Questions end with a question mark.
Maybe that's what they want you to think.
Either Microsoft fixes the problems (yeah, not going to happen) with its Windows OS or banking and other institutions must ban the use of MS Windows machines for handling sensitive information such as this.
At the very least, requirements that such machines can NEVER have been used to connect to the internet or process email that might originate from the internet must be issued. These lax security policies are making victims of their customers and good luck getting your SSN changed after it has been used for fraud.
The sentiment of "first" and "never done this before" is somewhat relevant.
"A laptop", only one? Cue the neverending laughter. Let us make an educated ballpark guess at the number of employees who access their personal banking information with an infected laptop. Session hijacking, background processes, like most of the office people who use online banking are watching a physical LED to see if there is additional traffic outside of their control after they log in. Maybe some folks, even in IT, do not know this but it is not very difficult to establish and maintain entire TCP/IP sessions without making a single LED blink or even turn on. I ran my entire LAN in what I comically dubbed "silent mode" and that worked for outgoing communciations as well. The wired router LEDs were completely dark (when I wanted them to be; ie. they were not broken). The wired ports of the wireless router were completely dark. Wireless communications still blinked.
Obviously the cable modem lights still worked as expected. Exploits existed but I did not want to taunt my provider.
the NPG electrode was replaced with carbon blac
Gee, I wonder who would be interested in which U.S. military service members are having financial difficulties?
You register with Skype using a unique, private, pseudorandom alphanumeric 12-character long email address that you use nowhere else, and then what happens? I did this as protection against possible spam and so did four colleagues in Japan. Today we all suddenly received various spam emails that were addressed to these unpublished email addresses that we registered with Skype. The only plausible source of the email addresses is Skype's Worldwide Customer Database. A friend who works in Skype admits they run their customer database on a Windows system, but denies any system breach. What's going on? Has Skype suffered a system breach or has somebody inside Skype leaked their database to spammers?
So a private company having a security breach is evidence that the US government can't keep anything secret or secure?
The pentagon, which is renowned for being anal about security, let someone plug their unsecure laptop unto their network and just start accessing data at the tip of a hat.....i do not believe it, they probably are not sure of where this breach came from, and this is their cover story....so in case we see conf. info showing up only they had in public domains, now they can save their *sses, as they let us know about it.
Infected Laptop Leads to Data Breach at Pentagon Federal Credit Union, SoftPedia, January 6 2011
Notification to the NH Attorney General's Office, December 30, 2010.
There may be even earlier public reports.
This is not news to affected PFCU members either. I was notified that my data might have been compromised and issued a new credit card and offered free monitoring services weeks ago.
As a member-owned credit union PFCU is accountable to its members. They, or should I say as a proud member, we, take our responsibilities to our fellow members very seriously.
PenFed is one credit union used by members of the armed forces, but it is not the big player -- that's Navy Federal Credit Union (NFCU). It has three times the members (3M vs. 1M) and assets ($43M vs. $15M) that PenFed has. Not to minimize the impact, but the article reads as if all military personnel who join a credit union are affected, and this is not the case.