Attacks/Breaches
8/30/2013
02:05 PM
Connect Directly
RSS
E-Mail
50%
50%

Energy Dept. Hack Details Emerge

Exclusive: Unpatched ColdFusion server containing employee information was hacked; agency claims lack of budget to put proper fixes in place.

The Department of Energy has disclosed new information concerning a recent cyberattack that compromised employees' personally identifying information (PII).

The sensitive PII data compromised was limited to names, dates of birth and social security numbers, according to an internal DOE memo distributed on Aug. 29. It said the stored information did not include banking, credit card or clearance information.

A spokesman for the DOE wasn't immediately available to confirm that it sent the memo, but an agency source confirmed its authenticity. Agency officials have so far declined to respond to all requests for comment on the breach.

[ What can we learn from the DOE breach? Read Department Of Energy Cyberattack: 5 Takeaways. ]

The data breach was first disclosed to employees in an Aug. 14 email, which said that no confidential DOE information had been stolen, and that data on 14,000 employees was compromised. The agency promised to notify all affected employees individually by the end of August.

The Aug. 29 memo revealed that the system hacked by attackers is called "DOEInfo." The system is owned and maintained by the agency's Office of the Chief Financial Officer.

According to agency sources, who spoke on condition of anonymity, the hacked application was Internet-accessible and written in ColdFusion, a rapid Web application development platform -- developed by Allaire, then purchased by Adobe in 2005 -- that was originally designed to allow HTML pages to be connected to databases. But the version of ColdFusion being used for DOEInfo remained outdated and vulnerable to known exploits.

According to DOE sources, the problem of insecure systems that contain PII is widely known at the agency but difficult to change since more than 1,000 systems tap DOEInfo, which maintains a single user ID for each employee, tied to employee access permissions. "Our logins still use our initials and parts of our SSN (duh), who would think that was good enough in the first place?" one source said in an email message. "Complaining doesn't help. The answer is always, it costs too much to redo our PII."

The breach notification was also published on a DOE intranet, where some employees complained about a lack of timely, forthright communication about the breach. Some questioned whether agency officials are covering up the full extent of the breach.

The July breach marked the second time this year that DOE employee information was compromised in a cyberattack, following a January intrusion.

The memo distributed on Aug. 29 stated "The Office of Cyber Security is working with organizations at DOE to obtain verifiable information and direction," presumably referring to the agency's participation in the breach investigation, which also involves federal law enforcement agencies. "As information becomes available, we will inform employees through e-mail and updates to the article," it continued, referring to a copy of the Thursday data breach notification that was also posted to an agency intranet.

According to a spokeswoman, the DOE has offered a year's worth of free credit monitoring services to affected employees.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
builder7
50%
50%
builder7,
User Rank: Apprentice
9/2/2013 | 4:50:06 AM
re: Energy Dept. Hack Details Emerge
It is just that they lack of the tools necessary to know what to do, like knowledge - but of course they have been hired because of who they know!
builder7
50%
50%
builder7,
User Rank: Apprentice
9/2/2013 | 4:48:36 AM
re: Energy Dept. Hack Details Emerge
So, these are the people who do security checks on educated individuals who work for them when they cannot even buy the proper software so that they can do their job? How can one trust the people that do these security checks on people when they themselves cannot even support a modicum of security? It seems to me that it is another case of the good old boys running the show without having the smarts to actually do that. What are we going to do if we get attacked and our nuclear plants and electrical grid are targeted - trust the DOE?
erlrodd
50%
50%
erlrodd,
User Rank: Apprentice
8/31/2013 | 1:37:08 PM
re: Energy Dept. Hack Details Emerge
When they say they "don't have funds to update", this is a political statement meant for outside consumption. In the "real" world, it means "other things are higher priorities than security." Maybe so. However, I fear that government bureaucrats are so used to an unlimited funds environment that the concept of priorities becomes foreign to them!
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Moderator
8/30/2013 | 7:29:52 PM
re: Energy Dept. Hack Details Emerge
"Taking Charge"? The FTC pamphlet should really be called "Surrendering To The Inevitable." Taking Charge would be avoiding this sort of thing in the first place.
WKash
50%
50%
WKash,
User Rank: Apprentice
8/30/2013 | 7:19:11 PM
re: Energy Dept. Hack Details Emerge
Thanks for sharing the details on why this happened. It offers yet another example of why agency leaders can't just shrug their shoulders about legacy software, especially for the web.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5619
Published: 2014-09-29
The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame.

CVE-2012-5621
Published: 2014-09-29
lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains invalid UTF-8 strings.

CVE-2012-6107
Published: 2014-09-29
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2012-6110
Published: 2014-09-29
bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.

CVE-2013-1874
Published: 2014-09-29
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.