Attacks/Breaches
2/5/2013
06:12 PM
50%
50%

U.S. Energy Department Hack Exposes Employee, Contractor Information

No classified data was compromised, but the attack is believed to have affected several hundred people

Hackers hit the U.S. Department of Energy (DOE) in mid-January and accessed personal information belonging to possibly hundreds of employees and contractors, according to an internal DOE email.

The email circulated Friday and was reported Monday after The Washington Free Beacon broke the story. The revelation came on the heels of reports that several news organizations had been targeted in cyber-attacks as part of an espionage campaign reputed to have originated in China. The Chinese government however has denied any connection to the attacks on the media outlets.

It is important to remember that it is difficult to prove who is behind an Internet attack, as hackers can easily "bounce their attacks between multiple compromised computers" across the globe, Graham Cluley, senior technology consultant at Sophos, notes in a blog post.

"And there is a chance that China could become an all-too-convenient bogeyman, that can easily be blamed for any embarrassing security breach," he adds.

The DOE email does not name any specific culprit, but states that an investigation turned up no evidence that classified information was compromised in the attack.

"We believe several hundred DOE employees’ and contractors’ PII (personally-identifiable information) may have been affected," according to the email. "As individual affected employees are identified, they will be notified and offered assistance on steps they can take to protect themselves from potential identity theft."

The email also urges employees to encrypt all files and emails containing PII and sensitive data, including files stored on hard drives or on the shared networks. In addition, employees were told not to store or email non-government related PII on DOE network computers.

Once the full nature and extent of the attack is known, the email continues, the department will "implement a full remediation plan."

"The Department is also leading an aggressive effort to reduce the likelihood of these events occurring again," according to the email. "These efforts include leveraging the combined expertise and capabilities of the Department’s Joint Cybersecurity Coordination Center to address this incident, increasing monitoring across all of the Department’s networks and deploying specialized defense tools to protect sensitive assets."

A remediation plan would be a good step forward to Richard Towle, head of federal markets at FireMon.

“If not for a troubling history preceding this incident, this report could be seen as an opportunity to improve," Towle says. "If classified information was truly not compromised, the organization could use what was taken to inform themselves about risks in the “reach-ability” of critical assets and associated access vulnerabilities."

"However, based on track record – not just of government, but also the industry at large – the typical response is to simply plug the wounds after they have already bled out, and try and defend similar points of entry," he continues. "We need to break the cycle and make security about understanding and addressing risk, as opposed to trying to get better and faster at reaction."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DarkReadingTim
50%
50%
DarkReadingTim,
User Rank: Strategist
2/6/2013 | 5:00:26 PM
re: U.S. Energy Department Hack Exposes Employee, Contractor Information
I love the last quote in this story.- Enterprises and government continue to spend money to plug the holes, and the breaches keep coming.- Seems like time to rethink security, not just from a technology perspective, but from an architectural perspective.
--Tim Wilson, editor, Dark Reading
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9209
Published: 2015-03-30
Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.