Attacks/Breaches
1/5/2012
02:12 PM
Connect Directly
RSS
E-Mail
50%
50%

AntiSec Hacks NY, California Law Enforcement

Breaches show database insecurity is still the norm, despite rash of attacks by hacktivists.

News of an AntiSec hack of law enforcement associations on both coasts earlier this week showed that while it might be a new year, we can pretty much expect lots of the same with respect to database security in 2012. The same insecure configurations. The same cleartext storage of passwords and sensitive information in unprotected databases. The same abysmal access control and password management practices. And, of course, the same embarrassing attacks that, maybe by the year 3012, will spur organizations to make some changes in the way they approach the basics of database security.

"We're just not learning from the successful attacks that keep happening," said Josh Shaul, CTO of Application Security. "It's astounding. It seems like almost anywhere Anonymous aims their targets to go out and penetrate, they're able to break in without any difficulty. It just makes me wonder what happens when people who want to do this for criminal purposes--more than hacktivist reasons, but to actually steal from organizations--if it is just as easy for them?"

This time around, AntiSec went after the email systems for New York State police chiefs and the website for the California Statewide Law Enforcement Association (CSLEA). The hacktivist group publicly dumped loads of stolen database information from both attacks on New Year's Eve.

In the former case, the group dumped a password file with MD5 hashed passwords and residential addresses for more than 300 police chiefs in New York, plus personal information and residential addresses for more than 1,000 more law enforcement personnel. In the latter case, AntiSec completely shut down and defaced CSLEA's website, putting up a snarky missive about its conquest on the site and dumping all of the information stored in its membership roster of 2,500 members, including passwords and credit card numbers stored in cleartext.

In its message, the group said that even as CSLEA administrators sniffed evidence of the breach and made changes to shut down the attacks, it was too little too late.

Read the rest of this article on Dark Reading.

In this new Tech Center report, we profile five database breaches--and extract the lessons to be learned from each. Plus: A rundown of six technologies to reduce your risk. Download it here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0607
Published: 2014-07-24
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.

CVE-2014-1419
Published: 2014-07-24
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.

CVE-2014-2360
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

CVE-2014-2361
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

CVE-2014-2362
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.