Attacks/Breaches

Energy Dept. Hack Details Emerge

Exclusive: Unpatched ColdFusion server containing employee information was hacked; agency claims lack of budget to put proper fixes in place.

The Department of Energy has disclosed new information concerning a recent cyberattack that compromised employees' personally identifying information (PII).

The sensitive PII data compromised was limited to names, dates of birth and social security numbers, according to an internal DOE memo distributed on Aug. 29. It said the stored information did not include banking, credit card or clearance information.

A spokesman for the DOE wasn't immediately available to confirm that it sent the memo, but an agency source confirmed its authenticity. Agency officials have so far declined to respond to all requests for comment on the breach.

[ What can we learn from the DOE breach? Read Department Of Energy Cyberattack: 5 Takeaways. ]

The data breach was first disclosed to employees in an Aug. 14 email, which said that no confidential DOE information had been stolen, and that data on 14,000 employees was compromised. The agency promised to notify all affected employees individually by the end of August.

The Aug. 29 memo revealed that the system hacked by attackers is called "DOEInfo." The system is owned and maintained by the agency's Office of the Chief Financial Officer.

According to agency sources, who spoke on condition of anonymity, the hacked application was Internet-accessible and written in ColdFusion, a rapid Web application development platform -- developed by Allaire, then purchased by Adobe in 2005 -- that was originally designed to allow HTML pages to be connected to databases. But the version of ColdFusion being used for DOEInfo remained outdated and vulnerable to known exploits.

According to DOE sources, the problem of insecure systems that contain PII is widely known at the agency but difficult to change since more than 1,000 systems tap DOEInfo, which maintains a single user ID for each employee, tied to employee access permissions. "Our logins still use our initials and parts of our SSN (duh), who would think that was good enough in the first place?" one source said in an email message. "Complaining doesn't help. The answer is always, it costs too much to redo our PII."

The breach notification was also published on a DOE intranet, where some employees complained about a lack of timely, forthright communication about the breach. Some questioned whether agency officials are covering up the full extent of the breach.

The July breach marked the second time this year that DOE employee information was compromised in a cyberattack, following a January intrusion.

The memo distributed on Aug. 29 stated "The Office of Cyber Security is working with organizations at DOE to obtain verifiable information and direction," presumably referring to the agency's participation in the breach investigation, which also involves federal law enforcement agencies. "As information becomes available, we will inform employees through e-mail and updates to the article," it continued, referring to a copy of the Thursday data breach notification that was also posted to an agency intranet.

According to a spokeswoman, the DOE has offered a year's worth of free credit monitoring services to affected employees.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
builder7
50%
50%
builder7,
User Rank: Apprentice
9/2/2013 | 4:50:06 AM
re: Energy Dept. Hack Details Emerge
It is just that they lack of the tools necessary to know what to do, like knowledge - but of course they have been hired because of who they know!
builder7
50%
50%
builder7,
User Rank: Apprentice
9/2/2013 | 4:48:36 AM
re: Energy Dept. Hack Details Emerge
So, these are the people who do security checks on educated individuals who work for them when they cannot even buy the proper software so that they can do their job? How can one trust the people that do these security checks on people when they themselves cannot even support a modicum of security? It seems to me that it is another case of the good old boys running the show without having the smarts to actually do that. What are we going to do if we get attacked and our nuclear plants and electrical grid are targeted - trust the DOE?
erlrodd
50%
50%
erlrodd,
User Rank: Apprentice
8/31/2013 | 1:37:08 PM
re: Energy Dept. Hack Details Emerge
When they say they "don't have funds to update", this is a political statement meant for outside consumption. In the "real" world, it means "other things are higher priorities than security." Maybe so. However, I fear that government bureaucrats are so used to an unlimited funds environment that the concept of priorities becomes foreign to them!
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
8/30/2013 | 7:29:52 PM
re: Energy Dept. Hack Details Emerge
"Taking Charge"? The FTC pamphlet should really be called "Surrendering To The Inevitable." Taking Charge would be avoiding this sort of thing in the first place.
WKash
50%
50%
WKash,
User Rank: Apprentice
8/30/2013 | 7:19:11 PM
re: Energy Dept. Hack Details Emerge
Thanks for sharing the details on why this happened. It offers yet another example of why agency leaders can't just shrug their shoulders about legacy software, especially for the web.
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10055
PUBLISHED: 2019-04-24
Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.
CVE-2018-7577
PUBLISHED: 2019-04-24
Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.
CVE-2019-10691
PUBLISHED: 2019-04-24
The JSON encoder in Dovecot before 2.3.5.2 allows attackers to repeatedly crash the authentication service by attempting to authenticate with an invalid UTF-8 sequence as the username.
CVE-2019-9635
PUBLISHED: 2019-04-24
NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file.
CVE-2019-3789
PUBLISHED: 2019-04-24
Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that ro...