Slashdot Mirror
Pentagon Credit Union Database Compromised
Trailrunner7 writes "The credit union used by members of the US armed forces and their families has admitted that a laptop infected with malware.was used to access a database containing the personal and financial information of customers. The Pentagon Federal Credit Union (PenFed) issued a statement to the New Hampshire Attorney General that said data, including the names, addresses, Social Security Numbers and PenFed banking and credit card account information of its members were accessed by the infected PC."
Any banks or credit unions not using Windows?
As always, people not following proper procedures.
---- Booth was a patriot ----
I still find it crazy that systems like these don't have dedicated computers for accessing that info. Personally, I *refuse* to enter ANY kind of password into most peoples laptops, let alone access sensitive information belonging to thousands of people. Then again, no one cares about "other peoples information" until that other person is you...
They gave me a new CC# right away, and offered two years free credit monitoring. Meh, Better than nothing I guess.
Members of the U.S. government sure have knack for getting malware.
I'm in the same boat. The article mentions that affected customers were reissued credit and debit cards, so presumably not hearing anything is a good sign, but I'll be calling them as soon as I get home.
There needs to be more air-gap security implemented in systems that are as important as banks/credit unions.
I'm not referring to the air-gap currently between the ears of whoever is in charge of their computer systems.
What happened to keeping personal information like this to private mainframe computers, with LAN access only? Putting data like this on a laptop is only asking for trouble. We never seem to learn.
I wonder if there should be laws that make persons working for banks, utility companies, etc. criminally and civilly liable for violating that organization's IA rules.
I'm talking about organizations responsible for information systems whose compromize could lead to significant public harm.
Where was it stated otherwise?
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
usually their first recommendation is to put a watch on your credit score, a lot of the time when a bank has a breech they offer to pay for a year or so of this service to all their members whose information may have been exposed, so you can call them and see what they are offering for safeties after the fact.
Change your pin and password, security question, etc for this account immediately. If you have a pin or other password etc used on that account that you use in other places, you should change those other places also, as they may try to use the credentials on other accounts they can figure our are yours in other places.
Also while you're talking with this credit union, see what they can do to adjust the 'paranoia level' on your account. That's what gets you a phonecall from them when you go on a vacation and buy a bunch of stuff and suddenly the card is getting declined. You want high paranoia on their part for awhile. There may be ways to set reasonable hard limits on charges per day etc a bit like how you can usually only pull $250 cash a day from an ATM. Set those limits temporarily as tight as you feel you can. They may have other options, ask them.
And of course the ever-popular "consider changing banks". Do you really trust them as much with your money as you did before?
I work for the Department of Redundancy Department.
Let's look at this.
In short, infected devices have caused serious problems (and occasionally fatalities). The Pentagon has been subject to malware-related cyber-attacks, including (as noted in the list) serious cases of espionage, in the past. That people are (a) running devices that are open to attack, and (b) are able to connect such devices to any Pentagon network, is seriously pathetic.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Summary is misleading "The credit union used by members of the U.S. armed forces and their families" made me think it was referring to my credit union (USAA, open to federal employees and families, not just armed forces). It had me worried for a moment there.
My webcomic
In the end, these sorts of egregious breaches can be blamed on IT and/or management. The latter mostly in cases where they unduly restrict IT from doing their jobs properly. In other (most) cases, it is because IT wasn't on the ball with security.
These stories come out again and again and again, and yet we still see people being allowed to do the wow-stupidest things you can imagine.
A few simple rules for people who haven't learned from these countless news stories:
1. Company computers should only be allowed to perform company functions, and only company computers should be allowed to access company assets.
2. Computer users should never have more access to their own computer or to company assets than they need. And always be conservative at first, and bump up their privs later if it becomes necessary.
3. In situations where users might have access to assets that could potentially put other people's information at risk, those users should be required to undergo some basic security training.
I'm just typing off the top of my head (I'm sure /. can add a few more), and already I've delineated more than I see done in most operations I've seen. It is rather amazing.
And it is extremely infuriating. These people are in charge of my assets. Increasingly all of us have to (if we want to participate in modern society) put more and more of our data into the hands of others. And again and again they prove that they don't deserve the trust we're putting in them.
Because let's face it, the US government can't even keep ANYTHING secret or secure. Apparently not even their darn bank accounts.
(If at first you don't succeed, do it different next time!)
That information should have been encrypted within the database. Why, just the other day SQLServerCentral.com posted a tutorial on creating a transparent database encryption layer. When managing critical information like SSN's or embassy cables, clear text is just asking for a compromise.
Oh, and I am not saying Windows is anything at all good to have in anyone's life. In fact, the insecure nature of laptops and malware demands that security be increased closer to the sensitive data.
Seth
$5 / month hosted VPS on linux = awesome!
The simple solution is to publish (on wikileaks?) the address of the responsible culprit - and the military and ex-military personnel will probably somehow manage to ensure that the data isn't used for malicious purposes.
Maybe that's what they want you to think.
Either Microsoft fixes the problems (yeah, not going to happen) with its Windows OS or banking and other institutions must ban the use of MS Windows machines for handling sensitive information such as this.
At the very least, requirements that such machines can NEVER have been used to connect to the internet or process email that might originate from the internet must be issued. These lax security policies are making victims of their customers and good luck getting your SSN changed after it has been used for fraud.
I just use the simple approach of keeping VERY little money in my accounts. With the economy the way it's been lately, that hasn't been much of a problem.
Sometimes the light at the end of the tunnel is the headlight of an oncoming train.
The sentiment of "first" and "never done this before" is somewhat relevant.
"A laptop", only one? Cue the neverending laughter. Let us make an educated ballpark guess at the number of employees who access their personal banking information with an infected laptop. Session hijacking, background processes, like most of the office people who use online banking are watching a physical LED to see if there is additional traffic outside of their control after they log in. Maybe some folks, even in IT, do not know this but it is not very difficult to establish and maintain entire TCP/IP sessions without making a single LED blink or even turn on. I ran my entire LAN in what I comically dubbed "silent mode" and that worked for outgoing communciations as well. The wired router LEDs were completely dark (when I wanted them to be; ie. they were not broken). The wired ports of the wireless router were completely dark. Wireless communications still blinked.
Obviously the cable modem lights still worked as expected. Exploits existed but I did not want to taunt my provider.
the NPG electrode was replaced with carbon blac
And of course the ever-popular "consider changing banks". Do you really trust them as much with your money as you did before?
Do you really trust any other financial institution with your money more than you trust them? These issues are systemic, not isolated to one or even a handful of financial services firms. You might be surprised to know how many such events occur, but are never properly disclosed.
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
Nope, I do not trust banking institutions.. they're run by computers, and computer algorithms without question with program code created by people, who are fallible. often with no actual human available to identify, confirm or rectify these errors.. I went without a bank account for 5 years because of such an error, and to this day it irks me that I gave in. I've since worked in a lot of "secure" development... it really isn't anything I trust.
Michael J. Ryan - tracker1.info
I'm not disagreeing with what you've said, but I will point out that security is a process, not a product. It's never "done."
512 MB RAM, 20 GB disk, 200 GB transfer, five datacenters. $19.95/month.
They extended me two free years of credit monitoring service in addition to reissuing my cards. You might see if you can get the same.
What do you mean by "your security?" Are you under the mistaken impression that PenFed is a government entity? It's a credit union like any other. It's charter just happens to define its common bond as those involved in the military. This is not the droid you're looking for.
So a private company having a security breach is evidence that the US government can't keep anything secret or secure?
The pentagon, which is renowned for being anal about security, let someone plug their unsecure laptop unto their network and just start accessing data at the tip of a hat.....i do not believe it, they probably are not sure of where this breach came from, and this is their cover story....so in case we see conf. info showing up only they had in public domains, now they can save their *sses, as they let us know about it.
Trust them more, they admitted it.
Introduce tort law in the banking sector, just like they have in the medical sector.
-- I was raised on the command line, bitch
PenFed is one credit union used by members of the armed forces, but it is not the big player -- that's Navy Federal Credit Union (NFCU). It has three times the members (3M vs. 1M) and assets ($43M vs. $15M) that PenFed has. Not to minimize the impact, but the article reads as if all military personnel who join a credit union are affected, and this is not the case.