Attacks/Breaches
2/6/2013
11:41 AM
50%
50%

Fed Breach: Attackers Exploited Website Product Vulnerability

Federal Reserve confirms breach of database with banking executive contact information for use in a natural disaster.

The Federal Reserve confirmed that it suffered a successful hack attack, but said attackers didn't breach critical systems.

The confirmation from the country's central banking system appeared to validate assertions made by the hacktivist group Anonymous, which claimed credit for the Sunday breach and subsequent data dump of what it described as "over 4,000 U.S. bank executive credentials."

Despite confirming the breach had occurred, however, the Fed offered scant additional details, except to note that attackers exploited a vulnerability in one of its products. "The Federal Reserve System is aware that information was obtained by exploiting a temporary vulnerability in a website vendor product," a spokeswoman from the Federal Reserve Bank of Richmond said in an emailed statement.

"The exposure was fixed shortly after discovery and is no longer an issue. This incident did not affect critical operations of the Federal Reserve System," according to the statement.

[ How do you define cyberwarfare? Read Uncertain State Of Cyberwar. ]

A Fed spokeswoman didn't immediately respond to an emailed request for more detailed information about the breach. But the Anonymous-delivered data dump, a.k.a. dox, included about 4,600 records, including people's names, email addresses, IP addresses, login IDs, salted and hashed -- not plain text -- passwords, as well password salts.

Reuters reported that the hacked database included contact information for banking personnel, and was designed to be used in the event of natural disaster. In particular, it allows banks that have been affected by tornados or flooding to alert the Fed, which can assess the potential impact to the country's banking system.

According to a message distributed by the Fed to its employees, the breached database was part of its Emergency Communication System (ECS), and warned that personal information, including mailing addresses, business and cellphone numbers, as well as business email addresses and fax numbers, were contained in the database. "Some registrants also included optional information consisting of home phone and personal email. Despite claims to the contrary, passwords were not compromised," according to the Fed's message, a copy of which was obtained by Reuters. It reported that the Fed later verified the authenticity of the message to ECS members.

Claims that no passwords were compromised suggests that officials at the Fed don't believe that the salted and hashed passwords included in the data dump could be decrypted by attackers.

The Fed data was leaked by Anonymous as part of its Operation Last Resort, which seeks "reform of computer crime laws, and the overzealous prosecutors." The campaign was launched last month after Internet activist Aaron Swartz committed suicide. He faced significant jail time after prosecutors indicted him on 13 felony counts, including violating the Computer Fraud and Abuse Act (CFAA), for downloading millions of academic journal articles without authorization.

But prosecutors' application of CFAA in the case has been widely criticized for being too heavy handed. It also sparked questions from the House Oversight and Government Reform Committee's chairman Darrell Issa (R-Calif.), and ranking member Elijah Cummings (D-Md.), who wrote to attorney general Eric Holder requesting that he brief Congress on the case, as well as the use of CFAA by prosecutors. The legislators gave Holder a Monday deadline for scheduling the briefing.

According to Anonymous, its "Federal Reserve minidrop" -- referring to the dox -- was meant to focus attention on the Monday deadline, as well as broader efforts to reform CFAA.

Anonymous appeared to be keeping a close eye on the Justice Department's response: "6pm: tick tock, tick tock on the Holder clock. Really think you can brush off the House Oversight Committee AND Anonymous?!" read a Monday tweet posted by the Operation Last Resort account on Twitter.

A Department of Justice spokeswoman Wednesday, however, confirmed via email that "the department has been in contact with the committee and plans to brief them on the matter," although she didn't specify when the briefing was set to occur.

Likewise, a tweet from Rep. Issa said, "For those who missed my earlier #AaronSwartz update: @TheJusticeDept has agreed to brief @GOPoversight @OversightDems on Swartz case." A spokesman for Rep. Issa, reached by phone, wasn't immediately able to confirm when the briefing was scheduled to take place.

In this all-day InformationWeek and Dark Reading Virtual Event, experts and vendors will offer a detailed look at how enterprises can detect the latest malware, analyze the most current cyber attacks, and even identify and take action against the attackers. Attendees of the Hackers Unmasked event will also get a look at how cybercriminals operate, how they are motivated -- and what your business can do to stop them. It happens Feb. 7. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2208
Published: 2014-12-28
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.

CVE-2014-2209
Published: 2014-12-28
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.

CVE-2014-5386
Published: 2014-12-28
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initial...

CVE-2014-6228
Published: 2014-12-28
Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted arguments to the chunk_split ...

CVE-2014-6229
Published: 2014-12-28
The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string,...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.