Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Pentagon Credit Union Database Compromised

samzenpus posted more than 3 years ago | from the leaking-like-a-sieve dept.

Government 108

Trailrunner7 writes "The credit union used by members of the US armed forces and their families has admitted that a laptop infected with malware.was used to access a database containing the personal and financial information of customers. The Pentagon Federal Credit Union (PenFed) issued a statement to the New Hampshire Attorney General that said data, including the names, addresses, Social Security Numbers and PenFed banking and credit card account information of its members were accessed by the infected PC."

cancel ×

108 comments

First? (-1, Offtopic)

ArthurDA (1598081) | more than 3 years ago | (#34854740)

Never done this before...

Re:First? (-1, Offtopic)

Caratted (806506) | more than 3 years ago | (#34854872)

Clearly.

Re:First? (1)

HomelessInLaJolla (1026842) | more than 3 years ago | (#34856186)

The sentiment of "first" and "never done this before" is somewhat relevant.

"A laptop", only one? Cue the neverending laughter. Let us make an educated ballpark guess at the number of employees who access their personal banking information with an infected laptop. Session hijacking, background processes, like most of the office people who use online banking are watching a physical LED to see if there is additional traffic outside of their control after they log in. Maybe some folks, even in IT, do not know this but it is not very difficult to establish and maintain entire TCP/IP sessions without making a single LED blink or even turn on. I ran my entire LAN in what I comically dubbed "silent mode" and that worked for outgoing communciations as well. The wired router LEDs were completely dark (when I wanted them to be; ie. they were not broken). The wired ports of the wireless router were completely dark. Wireless communications still blinked.

Obviously the cable modem lights still worked as expected. Exploits existed but I did not want to taunt my provider.

Nice work (-1)

Anonymous Coward | more than 3 years ago | (#34854748)

I guess the death penalty will be demanded for that leak as well by the usual morons.

Quick... (2)

butalearner (1235200) | more than 3 years ago | (#34854756)

Any banks or credit unions not using Windows?

Re:Quick... (-1)

Anonymous Coward | more than 3 years ago | (#34854898)

yeah because Linux never has security issues. You're a tool.

Re:Quick... (1)

butalearner (1235200) | more than 3 years ago | (#34855050)

Oh dear, so many ways to feed the troll. Hmmm, how about a bad car analogy?

That's like a customer wanting a car that has high safety ratings, but calling them a tool because people seldom get in wrecks anyway.

It's the IT, not the OS (3, Insightful)

Toe, The (545098) | more than 3 years ago | (#34855104)

In the end, these sorts of egregious breaches can be blamed on IT and/or management. The latter mostly in cases where they unduly restrict IT from doing their jobs properly. In other (most) cases, it is because IT wasn't on the ball with security.

These stories come out again and again and again, and yet we still see people being allowed to do the wow-stupidest things you can imagine.

A few simple rules for people who haven't learned from these countless news stories:

1. Company computers should only be allowed to perform company functions, and only company computers should be allowed to access company assets.

2. Computer users should never have more access to their own computer or to company assets than they need. And always be conservative at first, and bump up their privs later if it becomes necessary.

3. In situations where users might have access to assets that could potentially put other people's information at risk, those users should be required to undergo some basic security training.

I'm just typing off the top of my head (I'm sure /. can add a few more), and already I've delineated more than I see done in most operations I've seen. It is rather amazing.

And it is extremely infuriating. These people are in charge of my assets. Increasingly all of us have to (if we want to participate in modern society) put more and more of our data into the hands of others. And again and again they prove that they don't deserve the trust we're putting in them.

Re:It's the IT, not the OS (0)

Anonymous Coward | more than 3 years ago | (#34855834)

I worked at a bank for a few years and I can attest to the fact that banks hire the cheapest IT people they can get. Even worse, banks often put business people in charge of IT. Business folks, of course, have no idea what they're doing, but are usually very adept at the illusion of work/progress/success. In most cases only the programmers know the IT department is a train wreck.

The common business notion that "good managers can manage anything" may be true, but I've worked at a lot of IT shops and never once found this to be the case. Make no mistake, the business person in charge believes it to be a success, only because they have no idea what success really looks like. I turned down a job recently where the CIO was an MBA whose "synergistic" initiatives were causing the best and brightest to vacate stat.

Re:It's the IT, not the OS (1)

turbclnt (1776692) | more than 3 years ago | (#34856250)

Although I agree with everything you are saying in theory, I think there are some practical matters here that make these things tricky:

1. Company computers should only be allowed to perform company functions, and only company computers should be allowed to access company assets.

So, what is a company function? I agree - changing/revealing SSNs is a company function. However, a ton of viruses come from contaminated USB sticks too. If your job is to review a bunch of vendor presentations from USB sticks/e-mail/other external sources, how do you secure your "company" computer?

2. Computer users should never have more access to their own computer or to company assets than they need. And always be conservative at first, and bump up their privs later if it becomes necessary.

Sounds great. However, it always takes IT at least an hour to do this at my company, so its a royal pain in the ass. If someone could make an automated IT system that gives rights only when needed (yes - just like sudo), I'd be all over implementing something like this because it wouldn't didn't completely screw up work days time after time after time.

3. In situations where users might have access to assets that could potentially put other people's information at risk, those users should be required to undergo some basic security training.

Yep. This happens already. I think you are forgetting that most people are retards when it comes to this kind of stuff though. Oopsie-daises still happen. Maybe at a lower rate than before, but they still happen. And before you say that the solution is just not to hire that person for the job, realize that a lot of times they are the old farts sitting at the top of organizations that are making the mistakes...i.e. you can't fire them (even if you'd like to).

I really think people just need to realize that f-ups are going to happen every now and again. Maybe the easier solution is no SSNs required for bank accounts! No me telling telephone operators secret codes in plain, spoken, English over the phone! That way, all this data could be encrypted in a way that no human would be able to read or retrieve it.

Re:It's the IT, not the OS (1)

Charliemopps (1157495) | more than 3 years ago | (#34856444)

1. a company computer can just as easily be infected as a private computer. The idea that Antivirus provides anything more than protection against the more common threats out there is the leading myth that lets managers think they are protected. "We have Norton, so we don't have to worry about viruses" I could write a virus, specifically for you... in about 20min and no antivirus would pick it up.

2. This is all fine and well to say... but in actual practice most companies, especially older companies and Government agencies, have a rats nest of legacy systems that their entire infrastructure is tied to. Their billing and account data is on an antiquated Unix server from the 70s. The hardware's been upgraded but Oracles quoted them some stupefying price to move them over to a newer database. The interface is a BBS style monochrome terminal window. About 10 years ago someone that no longer works there and whos name no one remembers wrote a web based front end for it. It's buggy and no one knows what half the commands do anymore but its miles better than the terminal window. But for that to work you need special permissions, and the server hosting the web interface needs permissions to telnet to the Unix system which forces a password change every 30 days. This has to be done manually. But about 2 years ago some act of congress said that XYZ accounts must retain a series of tracking codes for tax purposes. There were only 4 new codes, but updating the old system was impossible and moving to oracle would cost millions. IS was their usual immovable selves and demanded the entire system be scrapped and moved to something more modern, upper management wouldn't have it. So some intern still in community college made an access database and linked the tables to a key on the webapp. But IS was again totally immovable and refused to give access to the company tables for something so ridiculous. Department heads fought but in the end the kid just ended up using Access Jet database. The thing gets corrupted about once a month so now the admins have to repair that routinely. Meanwhile every user that uses that webapp now has to have access installed and permissions to the folder the Jet database is in. About the 4th time some Senior VP trys to look up info for the first time on a Saturday and can't, the order comes down... everyone's got permissions to everything. The fact of the matter is this sort of shit happens all the time... and admins get fired all the time for hiccups that are caused by people not having the right access. An actually breach in security is extremely rare or at least goes unnoticed... and when it does happen they can just blame "Hackers." As far as the majority of management, and the public for that matter, are concerned, hackers are geniuses that can not be stopped once they target you. (see the movie hackers)

3. And they'll be playing games on facebook all the way through the class. I took such a class myself and one of the questions I got wrong was: "When on a business trip, if you're going out for the evening you should: A. Leave your laptop in the locked hotel room B. Take the laptop with you. According to them the correct answer was B. But I see the likely hood of my laptop getting stolen or forgotten in a bar far more likely than someone breaking into my hotel room and steeling corporate data. I think the ambiguity of the question itself underlies just how difficult security really is.

Re:It's the IT, not the OS (0)

Anonymous Coward | more than 3 years ago | (#34857426)

The correct answer was to cross out both A and B and write in, "Use full-disk encryption so it doesn't matter whether I leave it in my room to risk getting stolen by night-maids, or take it with me and risk it being forgotten at a restaurant or stolen from my rental car."

But then you get to the real world, where the answer is, "Have a different password for every single company resource and keep the big list of passwords on a web page on the company intranet."

Re:It's the IT, not the OS (0)

Anonymous Coward | more than 3 years ago | (#34856680)

Oh... it gets worse, brother. I just finished a short contract at a firm I will refer to as ShittyStink, who is now one of largest background and title tracking service providers for lenders. All the users in the company have XPboxen... upon which they all have administrative rights... and all the passwords are the same. The backend is entirely Windows servers as well. Oh, a few years back they tried to tighten security by moving to a thin client schema that sorta rhymes with tangy fruit... you know the tech I speak of... c.2003 it was hot stuff. Today? Not so much.... The place is literally falling apart, and it absolutely IS the fault of the IT dept there that is filled with smiling spineless stuffed shirts (excluding the lower level tech specialists, who basically just follow the ridiculous orders of their uninformed superiors).

Before you apply for a loan consider that your personal information may be handled poorly by the institution that you are applying for a loan through... but you can be assured that the bigger leak is when that institution outsources.

I actually looked into the whistle blower protection laws because I found the institution so lacking in regard to ANY security practices, let alone best practices. Unfortunately for me, they aren't actually hurting the environment or your drinking water (thus no whistleblower protections for me), just operating botnets with your SS#, bank account info, addresses, names... everything about your identity that you want kept secret... flitting around their network for anyone (hopefully not their employees, but malicious attackers) to harvest.

I realize I am opening myself up to criticism here, thus the AC post, but I assure you for the first month of the contract, pointing out security issues was an email to my supervisor at least a few times a week, who would repeatedly "take it under advisement"... until I was so browbeaten by their smiling ignorance that I just stopped altogether... omg, sooo happy that contract has ended. Worried, however, if I ever need a loan I know what's really happening with my personal info (good thing I'm broke, I guess... no one would want my identity :P)

Re:It's the IT, not the OS (1)

nobodie (1555367) | more than 3 years ago | (#34858614)

I agree 100% but, what are people doing? When I investigated the crapware that my bank put on a virtual copy of winXP (required by the bank so that it could connect to the bank site with IE6, no this is not a joke) it quickly became apparent that I should not/ could not use the USB dongle they SOLD me for the connection. The dongle had no real use beside triggering IE6 to download a certificate and a few other "programs" necessary for the connection. I used it once and it was so unfriendly and stupid i threw it away.

Ah, yes, then I uninstalled the 4 different programs that had been installed and purged the certificate from my system. All gone? Anti-virus check on the system showed that what remained were two virus/ trojans as well as "virus writing" software. WTF? My guess is that the bank used viruses to install stuff into the registry so that they didn't have to get permissions through the admin or from windows but could just use a virus to get in. These viruses and the software were all in hidden folders that had been created by and for the banking software, so there was little question about their provenance.

Did it screw the system? damned if i know or care. not like it really mattered to me, it was just a virtual copy of windows that didn't count for doodly squat, but the principle was stunning.

Re:It's the IT, not the OS (1)

couchslug (175151) | more than 3 years ago | (#34859654)

As a PenFed customer, I'll be contacting them.

Corporations in charge of important personal data should choose security over convenience, should not use Windows, should not WANT to use Windows, and should lock down their systems.

IMO they should restrict uses to thin clients at the their brick-and-mortar locations. No laptops, no mobility, tough shit.

An institution that serves the military should have a military chain of command, give orders not requests, and crush anyone who doesn't obey them.

Re:It's the IT, not the OS (1)

hal2814 (725639) | more than 3 years ago | (#34860052)

As another PenFed customer, I'm surprised they didn't contact you. They sent me a letter a few days ago explaining the situation and offering 2 years of free enrollment in one of those identity theft tracking services. I also have a new credit card and number being mailed to me.

I'm not happy about the situation but how they're handling it is everything I've come to expect from PenFed.

Re:It's the IT, not the OS (0)

Anonymous Coward | more than 3 years ago | (#34860818)

Another PenFed customer here. I've received no letter. Guess I'll contact them myself

Re:Quick... (2)

kaptink (699820) | more than 3 years ago | (#34854906)

It's sad when your first thoughts on reading this story is 'oh another windows fail' but the sad reality is that I would bet my life that it was. Assuming I am correct, will Microsoft be held accountable?

Re:Quick... (1)

Amorymeltzer (1213818) | more than 3 years ago | (#34855108)

No.

Re:Quick... (1)

Thud457 (234763) | more than 3 years ago | (#34855248)

Wait, I thought one of the justifications against going FOSS was that if something went disastrously wrong with a Windows system, at least you could sue Microsoft.

?

Re:Quick... (2)

TheRaven64 (641858) | more than 3 years ago | (#34855554)

Nope. The justification is that you can blame Microsoft. You can say to your boss 'we went with the same thing that everyone else is using' and then you don't get blamed personally.

Re:Quick... (0)

Anonymous Coward | more than 3 years ago | (#34855876)

Nope. The justification is that you can blame Microsoft. You can say to your boss 'we went with the same thing that everyone else is using' and then you don't get blamed personally.

mod parent up

Re:Quick... (2)

butalearner (1235200) | more than 3 years ago | (#34855126)

It's sad when your first thoughts on reading this story is 'oh another windows fail' but the sad reality is that I would bet my life that it was. Assuming I am correct, will Microsoft be held accountable?

Of course Microsoft is not responsible, but also consider, had the laptop-toting person responsible been using something other than Windows, it would be highly unlikely that we would be having this discussion. It occurred to me after I posted (and after reading the article) that the laptop could have been an personal one, and it doesn't really matter what the bank is using if the guy loaded up the database on it and the malware quietly sent it elsewhere.

Re:Quick... (0)

Anonymous Coward | more than 3 years ago | (#34856704)

it doesn't really matter what the bank is using if the guy loaded up the database on it

Yes, that old middle management trick again, performing as it always has againandagainandagainandag

Re:Quick... (1)

TheLink (130905) | more than 3 years ago | (#34857030)

What I find strange is if this statement was really true: "data, including the names, addresses, Social Security Numbers and PenFed banking and credit card account information of its members were accessed by the infected PC."

Most malware programs don't copy every file and send the data over.

So either the malware was suspiciously very targeted (looks for such files and sends contents out) or this was just a precautionary measure - they had to assume the data was compromised even if the malware didn't actually access all of that.

Re:Quick... (1)

pinkushun (1467193) | more than 3 years ago | (#34860170)

More than likely if the PC was up to date, and safe practices were used, then this issue could have been prevented.

That said, such safe practices are much more maintenance and unwieldy in the Windows world - no I'm not dissing, it's fact from experience, as many of you may know.

Technically, Microsoft is accountable. Legally, not.

Re:Quick... (2)

forkfail (228161) | more than 3 years ago | (#34854916)

Only Ye Ole Under The Mattress Bank.

And even then, it's up to the depositor to ensure that the room is windowless...

Re:Quick... (1)

sunderland56 (621843) | more than 3 years ago | (#34856050)

Even if the bank had absolutely NO windows machines, and no Microsoft products anywhere - their database can be compromised by malware loaded on an external, non-bank-owned machine. Anywhere a login/password combination is stored is a potential data breach.

It is the fact that they allow database access from an external, insecure site that is the issue - not which operating system is in use.

What should I do? (0)

Anonymous Coward | more than 3 years ago | (#34854824)

I have a PenFed account and haven't heard anything from them. What should I be doing? The article doesn't give any advice.

Re:What should I do? (1)

swilly (24960) | more than 3 years ago | (#34854896)

I'm in the same boat. The article mentions that affected customers were reissued credit and debit cards, so presumably not hearing anything is a good sign, but I'll be calling them as soon as I get home.

Re:What should I do? (1)

hal2814 (725639) | more than 3 years ago | (#34860074)

They extended me two free years of credit monitoring service in addition to reissuing my cards. You might see if you can get the same.

Re:What should I do? (4, Insightful)

v1 (525388) | more than 3 years ago | (#34854998)

usually their first recommendation is to put a watch on your credit score, a lot of the time when a bank has a breech they offer to pay for a year or so of this service to all their members whose information may have been exposed, so you can call them and see what they are offering for safeties after the fact.

Change your pin and password, security question, etc for this account immediately. If you have a pin or other password etc used on that account that you use in other places, you should change those other places also, as they may try to use the credentials on other accounts they can figure our are yours in other places.

Also while you're talking with this credit union, see what they can do to adjust the 'paranoia level' on your account. That's what gets you a phonecall from them when you go on a vacation and buy a bunch of stuff and suddenly the card is getting declined. You want high paranoia on their part for awhile. There may be ways to set reasonable hard limits on charges per day etc a bit like how you can usually only pull $250 cash a day from an ATM. Set those limits temporarily as tight as you feel you can. They may have other options, ask them.

And of course the ever-popular "consider changing banks". Do you really trust them as much with your money as you did before?

Re:What should I do? (0)

Anonymous Coward | more than 3 years ago | (#34855586)

You might look into transaction notifications. I get an instant alert to my cell phone for any transaction over $100. I don't get cell alerts for scheduled home banking payments, but I do get emails on they say they're paid out.

I went a crazy step forward this year as well. I had my credit union issue me ATM-only cards, no Visa/Mastercard, and then destroyed and cancelled the ATM/Visa debit cards. What inspired this is that I had a fraud charge for a business account at the same credit union linked to an ATM/Visa debit card which I've only used in less than a dozen places over 2 years. My business account was fairly easy to spot this on. My personal account at times is rather busy, and if the amount is low enough (this fraud charge was, ~$79), I probably wouldn't notice it.

So, I use AMEX wherever I can, have a non-Checking Visa for places I cannot, and use my ATM+PIN at the local grocers. AMEX/Visa are very easy to dispute charges with and you're never out the cash. Bank-linked cards may reverse all fees in the end, but can be a pain to deal with fixing. I also use Citibank's Virtual Account Number to issue a different credit card number (all linked to my same account) for each online purchase, and I don't use the account for any in-person charges (the physical card is locked up).

Compartmentalize your finances and make it harder to abuse and easier to spot and most of all easier to clean up (as fraud will occur, nothing you can do about it - even having no accounts doesn't prevent someone opening an account in your name).

Re:What should I do? (1)

mswhippingboy (754599) | more than 3 years ago | (#34856114)

I just use the simple approach of keeping VERY little money in my accounts. With the economy the way it's been lately, that hasn't been much of a problem.

Re:What should I do? (1)

palegray.net (1195047) | more than 3 years ago | (#34856272)

And of course the ever-popular "consider changing banks". Do you really trust them as much with your money as you did before?

Do you really trust any other financial institution with your money more than you trust them? These issues are systemic, not isolated to one or even a handful of financial services firms. You might be surprised to know how many such events occur, but are never properly disclosed.

Re:What should I do? (1)

aztracker1 (702135) | more than 3 years ago | (#34856732)

Nope, I do not trust banking institutions.. they're run by computers, and computer algorithms without question with program code created by people, who are fallible. often with no actual human available to identify, confirm or rectify these errors.. I went without a bank account for 5 years because of such an error, and to this day it irks me that I gave in. I've since worked in a lot of "secure" development... it really isn't anything I trust.

Re:What should I do? (1)

palegray.net (1195047) | more than 3 years ago | (#34856758)

I'm not disagreeing with what you've said, but I will point out that security is a process, not a product [schneier.com] . It's never "done."

Re:What should I do? (1)

fulldecent (598482) | more than 3 years ago | (#34861104)

Trust them more, they admitted it.

Introduce tort law in the banking sector, just like they have in the medical sector.

Legislation (0)

Anonymous Coward | more than 3 years ago | (#34854850)

NOW can we get legislation fixing the authentication problems in our banking system? Or do we need it to happen to every member of Congress, too?

The weak link (2)

nurb432 (527695) | more than 3 years ago | (#34854852)

As always, people not following proper procedures.

Re:The weak link (1)

eko3 (1975468) | more than 3 years ago | (#34855194)

As always, people not following proper procedures.

Is it really people not following procedures? Or is it lack of procedures for people that don't follow procedure?

Re:The weak link (1)

matazar (1104563) | more than 3 years ago | (#34856228)

It's usually a healthy mix of both.

m\od up (-1)

Anonymous Coward | more than 3 years ago | (#34854856)

you have a play as it is licensed OS I do, 3ecause And she ran Clearly become keed to be Kreskin

Re:m\od up (0)

Anonymous Coward | more than 3 years ago | (#34855342)

uh, what?

How can you blame Assange (0)

VincenzoRomano (881055) | more than 3 years ago | (#34854858)

When your security leaks like a sieve?
And if those data get secretely sold to bad guys, do you think it's better than free publishing all of them?

Re:How can you blame Assange (1)

hal2814 (725639) | more than 3 years ago | (#34860132)

What do you mean by "your security?" Are you under the mistaken impression that PenFed is a government entity? It's a credit union like any other. It's charter just happens to define its common bond as those involved in the military. This is not the droid you're looking for.

I still find it crazy that... (4, Interesting)

Anonymous Coward | more than 3 years ago | (#34854878)

I still find it crazy that systems like these don't have dedicated computers for accessing that info. Personally, I *refuse* to enter ANY kind of password into most peoples laptops, let alone access sensitive information belonging to thousands of people. Then again, no one cares about "other peoples information" until that other person is you...

Re:I still find it crazy that... (1)

gclef (96311) | more than 3 years ago | (#34855346)

This (and several other comments) really boil down to one thing: the price of security. The companies or organizations that get compromised rarely face any actual cost to being compromised, so the costs for doing security right (like, having dedicated computers for accessing financial information) are seen as "not worth the money."

This will only get better when the cost of being compromised is borne by the group that screwed up, not the customers of that organization.

Re:I still find it crazy that... (1)

shentino (1139071) | more than 3 years ago | (#34856810)

People are selfish.

News at 11.

Re:I still find it crazy that... (1)

pinkushun (1467193) | more than 3 years ago | (#34860372)

Geek Tip: It's handy to keep a Live OS on a USB drive on your keyring, for emergency access to sensitive sites, like banking and /.

This what they did for me... (2, Interesting)

Anonymous Coward | more than 3 years ago | (#34854886)

They gave me a new CC# right away, and offered two years free credit monitoring. Meh, Better than nothing I guess.

Freeze credit now (0)

Anonymous Coward | more than 3 years ago | (#34855206)

Freeze your credit and put a fraud warning on your profile with ALL three bureaus. I wouldn't trust your credit union to do that.

Credit monitoring tells you someone has gotten credit out in your name after the fact and two years free isn't enough. It should be for life.

See clarkhoward.com for more info - search for "Credit Freeze" and "Identity theft".

The CAC number 404.892.8227 is out so far this week because HothAtlanta in still under snow and ice.

Malware... (2)

calebpburns (1925438) | more than 3 years ago | (#34854892)

Members of the U.S. government sure have knack for getting malware.

Facts please! (0, Redundant)

girlintraining (1395911) | more than 3 years ago | (#34854902)

This is a credit union that happens to be used by military personnel. The credit union is not on a military network.

Re:Facts please! (1)

ShaunC (203807) | more than 3 years ago | (#34854988)

Where was it stated otherwise?

Re:Facts please! (0)

girlintraining (1395911) | more than 3 years ago | (#34855188)

Where was it stated otherwise?

Everywhere. References to "air gap [slashdot.org] " security, references to Wikileaks [slashdot.org] , and of course -- "the pentagon network [slashdot.org] " (as if there is actually such a thing...). And this is only in the first few minutes since the story got posted. Just wait a few hours and there'll be dozens, maybe hundreds...

Re:Facts please! (0)

Anonymous Coward | more than 3 years ago | (#34857136)

I propose they try air tight the next time. That way they would have all the bases covered and it might even be more enjoyable.

Re:Facts please! (1)

Peeteriz (821290) | more than 3 years ago | (#34855998)

The simple solution is to publish (on wikileaks?) the address of the responsible culprit - and the military and ex-military personnel will probably somehow manage to ensure that the data isn't used for malicious purposes.

Air-gap security! (2)

SaDan (81097) | more than 3 years ago | (#34854908)

There needs to be more air-gap security implemented in systems that are as important as banks/credit unions.

I'm not referring to the air-gap currently between the ears of whoever is in charge of their computer systems.

Re:Air-gap security! (0)

Anonymous Coward | more than 3 years ago | (#34855408)

Just how can you air-gap a system that needs to interface with outside agencies to process transactions?

Sneaker-netting it via USB or whatever won't even work (look at the Iranian nuclear program).

Re:Air-gap security! (0)

Anonymous Coward | more than 3 years ago | (#34855576)

Air gap solutions are not particularly feasible due all of the system interdependency. The closest solution to an air gap configuration would be to use something like WTS, Citrix, or a VDI solution but many software vendors don't fully remote setups and hardware devices like signature pads and check scanners are either not support or don't work reliably in that kind of configuration.

Mainframe only? (1)

Anonymous Coward | more than 3 years ago | (#34854930)

What happened to keeping personal information like this to private mainframe computers, with LAN access only? Putting data like this on a laptop is only asking for trouble. We never seem to learn.

Re:Mainframe only? (0)

Anonymous Coward | more than 3 years ago | (#34855456)

The data was unlikely to be stored on the computer and was probably "sniffed" as the notebook communicated with the "core" system. It was only in the second half of last year that the largest credit union software package would support encryption. Many of those credit unions are running a vendor created version of AIX 5.3 (think Windows server embedded) and could not enable SSH. Typically, installing the vendor provided OS updates would remove nearly all software related to OpenSSH. The latest OS patches from the manufacturer install SSHD and the latest client optionally allows tunneling the client session over SSH. Newer"core" system installs, as in the last 12 - 18 months, are using a full version of AIX 6.1 and had SSHD enabled but was only supported for administrative functions. I don't know what core PenFed was using. Any credit union using a mainframe is the exception, not the rule.

Re:Mainframe only? (0)

Anonymous Coward | more than 3 years ago | (#34855736)

I forgot the data could have been in a report saved to the local drive but generally, Social Security numbers are masked in reports.

A case for laws? (2)

DoofusOfDeath (636671) | more than 3 years ago | (#34854932)

I wonder if there should be laws that make persons working for banks, utility companies, etc. criminally and civilly liable for violating that organization's IA rules.

I'm talking about organizations responsible for information systems whose compromize could lead to significant public harm.

Re:A case for laws? (2)

TaoPhoenix (980487) | more than 3 years ago | (#34855012)

Only if the infected laptop shared two Justin Bieber songs with the host machine. Then we'd see the correct penalalty.

Not so fast (0)

Anonymous Coward | more than 3 years ago | (#34855174)

This is an opportunity for more spending. More spending is justification for a bigger budget. A bigger budget is the objective of every politician and bureaucrat. (You do realize that every year, government costs more than the year before, don't you?) Finally, this makes the business of government more lucrative for those who can exploit -- ahem, "distribute" -- that cash flow for personal gain.

You're not in the business of government, are you?

Re:A case for laws? (1)

OrigamiMarie (1501451) | more than 3 years ago | (#34857878)

This stuff happens a little less often with credit card numbers because the credit card processors take PCI (Payment Card Industry) standards pretty seriously, audit their big clients yearly, and give the real threat of cutting off companies that don't have enough security. On the other hand, PCI compliance is kind of loose, so I think the real effect of the PCI audits is that they make companies actually _think_ about security. Once you get thinking about security, you can probably do better than PCI requires. As far as I know, the banks as a collective aren't nearly as much into the whole computer security thing.

Socialists in the Pentagon? (-1, Troll)

Sub Zero 992 (947972) | more than 3 years ago | (#34854934)

Wow, I mean, WTF?

Of all the places, the Pentagon? They do know that the Credit Union idea [wikipedia.org] has socialist. or at least a mutualist roots [wikipedia.org] , right?

Re:Socialists in the Pentagon? (0)

Anonymous Coward | more than 3 years ago | (#34855040)

Your troll-fu is very weak.

They only care about their secrets, not your data (0)

Anonymous Coward | more than 3 years ago | (#34854944)

I wonder what will happen the first time data the Government actually cares about is compromised. It will be interesting to compare their response to this to what they would do if someone were to download the TSA's no fly list, for example.

Re:They only care about their secrets, not your da (0)

Anonymous Coward | more than 3 years ago | (#34855162)

They'd have you deported to Sweden on charges of "sex by surprise".

Well played, Iran (1)

Frank Fry (1483231) | more than 3 years ago | (#34855056)

This point goes to you.

This is incredibly sad. (3, Insightful)

jd (1658) | more than 3 years ago | (#34855062)

Let's look at this.

In short, infected devices have caused serious problems (and occasionally fatalities). The Pentagon has been subject to malware-related cyber-attacks, including (as noted in the list) serious cases of espionage, in the past. That people are (a) running devices that are open to attack, and (b) are able to connect such devices to any Pentagon network, is seriously pathetic.

Re:This is incredibly sad. (1)

blueg3 (192743) | more than 3 years ago | (#34855114)

That people are (a) running devices that are open to attack, and (b) are able to connect such devices to any Pentagon network, is seriously pathetic.

With the current security landscape, this boils down, essentially, to:
(a) People are using computing devices
(b) Some computers are able to connect to the Pentagon network

Re:This is incredibly sad. (1)

TheSpoom (715771) | more than 3 years ago | (#34855240)

Except that Windows is more vulnerable to malware than other OSes by orders of magnitude.

Re:This is incredibly sad. (1)

blueg3 (192743) | more than 3 years ago | (#34857248)

To meet OP's requirements, number of vulnerabilities doesn't really matter. All systems have some vulnerabilities. With few exceptions, they're not theoretical vulnerabilities, either -- they're actively exploited. So regardless of the device people use, it will be the case that they are using a device that is open to attack.

Re:This is incredibly sad. (1)

c0lo (1497653) | more than 3 years ago | (#34856134)

That people are (a) running devices that are open to attack, and (b) are able to connect such devices to any Pentagon network, is seriously pathetic.

With the current security landscape, this boils down, essentially, to: (a) People are using computing devices (b) Some computers are able to connect to the Pentagon network

Best solution... Pentagon to drop the reliance on computers. Errr... wait... and paper too (because the Pentagon papers were... well... on paper).

Re:This is incredibly sad. (1)

jwarnick (637847) | more than 3 years ago | (#34855662)

The Pentagon has been subject to malware-related cyber-attacks... To clarify, it's a credit union and not the actual DoD Pentagon.

Re:This is incredibly sad. (1)

Jeian (409916) | more than 3 years ago | (#34855682)

PenFed is not affiliated with the Pentagon, except that the majority of their members are Pentagon employees.

Re:This is incredibly sad. (1)

hal2814 (725639) | more than 3 years ago | (#34860208)

You could probably argue that the majority of Pentagon employees are members but with one million members I highly doubt the majority of PenFed members are Pentagon employees.

I think the only reason Pentagon is in the title is for the prestige. It's wicked cool when you pull out your credit card with a huge Pentagon on it to pay your bar tab. It's also cool when the lady at the tag office looks over your new car paperwork and asks you wide-eyed, "Do you work for the Pentagon?" (To which I have a canned Chevy Chase reply: "No... not anymore.")

Re:This is incredibly sad. (1)

pinkushun (1467193) | more than 3 years ago | (#34860484)

Well said!

!USAA (1)

T Murphy (1054674) | more than 3 years ago | (#34855094)

Summary is misleading "The credit union used by members of the U.S. armed forces and their families" made me think it was referring to my credit union (USAA, open to federal employees and families, not just armed forces). It had me worried for a moment there.

Re:!USAA (1)

Anonymous Coward | more than 3 years ago | (#34855192)

USAA isn't a credit union.

Re:!USAA (0)

Anonymous Coward | more than 3 years ago | (#34855446)

True, but still, PenFed is hardly the only credit union serving the armed forces. Or even the only Credit Union in the Pentagon.

Re:!USAA (0)

Anonymous Coward | more than 3 years ago | (#34856012)

Penfed has some pretty good deposit rates. And my auto-insurnace company gives discounts to penfed members.

You don't have to be in the armed forces or even be related to someone. Just be in some organizations that you pay one-time membership fees to.
https://www.penfed.org/howtojoin/overview.asp

I was tempted to join, but they made it too much of a pain to join, so I'm glad I did not.

McAfee or Norton? (0)

Anonymous Coward | more than 3 years ago | (#34855120)

They were probably running McAfee or Norton. It seems quite a number state and federal organizations still use the relatively useless security software from these two awful corporations.

Re:McAfee or Norton? (1)

monkyyy (1901940) | more than 3 years ago | (#34855506)

wasn't aware mcafee was in bisness, and norton has important customers?

This is why I don't belive in Conspiracy Theories (2)

Timmy D Programmer (704067) | more than 3 years ago | (#34855468)

Because let's face it, the US government can't even keep ANYTHING secret or secure. Apparently not even their darn bank accounts.

Re:This is why I don't belive in Conspiracy Theori (1)

BenSchuarmer (922752) | more than 3 years ago | (#34856046)

Maybe that's what they want you to think.

Re:This is why I don't belive in Conspiracy Theori (1)

hal2814 (725639) | more than 3 years ago | (#34860188)

So a private company having a security breach is evidence that the US government can't keep anything secret or secure?

database design is at fault (1)

SethJohnson (112166) | more than 3 years ago | (#34855668)

That information should have been encrypted within the database. Why, just the other day SQLServerCentral.com posted a tutorial on creating a transparent database encryption layer [sqlservercentral.com] . When managing critical information like SSN's or embassy cables, clear text is just asking for a compromise.

Oh, and I am not saying Windows is anything at all good to have in anyone's life. In fact, the insecure nature of laptops and malware demands that security be increased closer to the sensitive data.

Seth

Re:database design is at fault (0)

Anonymous Coward | more than 3 years ago | (#34855974)

The database was unlikely to be on the notebook due to:
a) size. 1 million member w/ at least a 6 month transaction history puts the size in at least the 500GB - 1TB range.
b) probably a proprietary core system database format. The databases tend to not be standard proprietary formats like DB2 or MS SQL but instead tend to be in a proprietary core system database format.

See comments http://it.slashdot.org/comments.pl?sid=1948112&cid=34855456 and http://it.slashdot.org/comments.pl?sid=1948112&cid=34855736 for other possible vectors.

NCUA has been working with the core system providers to set deadlines on encrypting client sessions and databases. Currently, database information only has to be encrypted when it leaves the possession of the credit union.

Re:database design is at fault (1)

SethJohnson (112166) | more than 3 years ago | (#34856550)

Sorry to write a vague comment.

I never assumed the database was on the laptop. Encrypting data within the database means that client compromises like this one still protects critical assets such as SSN's. It means, as I alluded to in my original post, that a person or piece of malware, can't execute a select social_security_number, address, patient_name from patient_table and store the resulting rows in a clear text file. Well, at least the resulting rows will be encrypted in DES or some such algorithm. This has nothing to do with encrypting the communication between the client and the database server. It has everything to do with encrypting the content of the database and using a secure mechanism to read and write to those rows in an encrypted format. Developers can still work in the database without themselves being able to see or touch the content. Same with users. Same with compromised laptops. etc. etc.

Seth

Re:database design is at fault (1)

zippthorne (748122) | more than 3 years ago | (#34857438)

When managing critical information like SSN's or embassy cables, clear text is just asking for a compromise.

Both of those things are run by people who think that it's their job to compromise...

will they catch the offender before it's too late? (1)

Gravis Zero (934156) | more than 3 years ago | (#34855764)

it seems like a running theme that the government makes a slow/half-assed attempt to apprehend this criminal brand of hacker. this seems like one situation they should actually putting significant resources into tracking down a jailing this individual and anyone that purchases the data regardless of the nation they are in. i know they can do it, i saw how quickly the got to Bradley and how many strings they have been pulling to get to Assange. this seems like one enterprise worth shutting down regardless of cost.

One of two things MUST happen (1)

erroneus (253617) | more than 3 years ago | (#34856078)

Either Microsoft fixes the problems (yeah, not going to happen) with its Windows OS or banking and other institutions must ban the use of MS Windows machines for handling sensitive information such as this.

At the very least, requirements that such machines can NEVER have been used to connect to the internet or process email that might originate from the internet must be issued. These lax security policies are making victims of their customers and good luck getting your SSN changed after it has been used for fraud.

espionage? (0)

Anonymous Coward | more than 3 years ago | (#34857244)

Gee, I wonder who would be interested in which U.S. military service members are having financial difficulties?

Skype Worldwide Customer Database Compromised? (0)

Anonymous Coward | more than 3 years ago | (#34857828)

You register with Skype using a unique, private, pseudorandom alphanumeric 12-character long email address that you use nowhere else, and then what happens? I did this as protection against possible spam and so did four colleagues in Japan. Today we all suddenly received various spam emails that were addressed to these unpublished email addresses that we registered with Skype. The only plausible source of the email addresses is Skype's Worldwide Customer Database. A friend who works in Skype admits they run their customer database on a Windows system, but denies any system breach. What's going on? Has Skype suffered a system breach or has somebody inside Skype leaked their database to spammers?

OMFG (1)

hesaigo999ca (786966) | more than 3 years ago | (#34860756)

The pentagon, which is renowned for being anal about security, let someone plug their unsecure laptop unto their network and just start accessing data at the tip of a hat.....i do not believe it, they probably are not sure of where this breach came from, and this is their cover story....so in case we see conf. info showing up only they had in public domains, now they can save their *sses, as they let us know about it.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...