Breaches show database insecurity is still the norm, despite rash of attacks by hacktivists.
News of an AntiSec hack of law enforcement associations on both coasts earlier this week showed that while it might be a new year, we can pretty much expect lots of the same with respect to database security in 2012. The same insecure configurations. The same cleartext storage of passwords and sensitive information in unprotected databases. The same abysmal access control and password management practices. And, of course, the same embarrassing attacks that, maybe by the year 3012, will spur organizations to make some changes in the way they approach the basics of database security.
"We're just not learning from the successful attacks that keep happening," said Josh Shaul, CTO of Application Security. "It's astounding. It seems like almost anywhere Anonymous aims their targets to go out and penetrate, they're able to break in without any difficulty. It just makes me wonder what happens when people who want to do this for criminal purposes--more than hacktivist reasons, but to actually steal from organizations--if it is just as easy for them?"
This time around, AntiSec went after the email systems for New York State police chiefs and the website for the California Statewide Law Enforcement Association (CSLEA). The hacktivist group publicly dumped loads of stolen database information from both attacks on New Year's Eve.
In the former case, the group dumped a password file with MD5 hashed passwords and residential addresses for more than 300 police chiefs in New York, plus personal information and residential addresses for more than 1,000 more law enforcement personnel. In the latter case, AntiSec completely shut down and defaced CSLEA's website, putting up a snarky missive about its conquest on the site and dumping all of the information stored in its membership roster of 2,500 members, including passwords and credit card numbers stored in cleartext.
In its message, the group said that even as CSLEA administrators sniffed evidence of the breach and made changes to shut down the attacks, it was too little too late.
In this new Tech Center report, we profile five database breaches--and extract the lessons to be learned from each. Plus: A rundown of six technologies to reduce your risk. Download it here (registration required).
Published: 2015-04-27 Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) DataMappingEditorCommands, (2) DatastoreEditorCommands, and (3) IEGEditorCommands servlets in IBM Curam Social Program Management (SPM) 5.2 SP6 before EP6, 6.0 SP2 before EP26, 6.0.3 before 22.214.171.124 iFix8, 6.0.4 before 126.96.36.199 iFix...
Published: 2015-04-27 IBM Curam Social Program Management (SPM) 5.2 before SP6 EP6, 6.0 SP2 before EP26, 6.0.4 before 188.8.131.52, and 6.0.5 before 184.108.40.206 requires failed-login handling for web-service accounts to have the same lockout policy as for standard user accounts, which makes it easier for remote attackers to cause...
Published: 2015-04-27 The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation...
Published: 2015-04-27 The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 220.127.116.11 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Published: 2015-04-27 IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 18.104.22.168 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors.
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.