Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Energy Dept. Hack Details Emerge

Exclusive: Unpatched ColdFusion server containing employee information was hacked; agency claims lack of budget to put proper fixes in place.

The Department of Energy has disclosed new information concerning a recent cyberattack that compromised employees' personally identifying information (PII).

The sensitive PII data compromised was limited to names, dates of birth and social security numbers, according to an internal DOE memo distributed on Aug. 29. It said the stored information did not include banking, credit card or clearance information.

A spokesman for the DOE wasn't immediately available to confirm that it sent the memo, but an agency source confirmed its authenticity. Agency officials have so far declined to respond to all requests for comment on the breach.

[ What can we learn from the DOE breach? Read Department Of Energy Cyberattack: 5 Takeaways. ]

The data breach was first disclosed to employees in an Aug. 14 email, which said that no confidential DOE information had been stolen, and that data on 14,000 employees was compromised. The agency promised to notify all affected employees individually by the end of August.

The Aug. 29 memo revealed that the system hacked by attackers is called "DOEInfo." The system is owned and maintained by the agency's Office of the Chief Financial Officer.

According to agency sources, who spoke on condition of anonymity, the hacked application was Internet-accessible and written in ColdFusion, a rapid Web application development platform -- developed by Allaire, then purchased by Adobe in 2005 -- that was originally designed to allow HTML pages to be connected to databases. But the version of ColdFusion being used for DOEInfo remained outdated and vulnerable to known exploits.

According to DOE sources, the problem of insecure systems that contain PII is widely known at the agency but difficult to change since more than 1,000 systems tap DOEInfo, which maintains a single user ID for each employee, tied to employee access permissions. "Our logins still use our initials and parts of our SSN (duh), who would think that was good enough in the first place?" one source said in an email message. "Complaining doesn't help. The answer is always, it costs too much to redo our PII."

The breach notification was also published on a DOE intranet, where some employees complained about a lack of timely, forthright communication about the breach. Some questioned whether agency officials are covering up the full extent of the breach.

The July breach marked the second time this year that DOE employee information was compromised in a cyberattack, following a January intrusion.

The memo distributed on Aug. 29 stated "The Office of Cyber Security is working with organizations at DOE to obtain verifiable information and direction," presumably referring to the agency's participation in the breach investigation, which also involves federal law enforcement agencies. "As information becomes available, we will inform employees through e-mail and updates to the article," it continued, referring to a copy of the Thursday data breach notification that was also posted to an agency intranet.

According to a spokeswoman, the DOE has offered a year's worth of free credit monitoring services to affected employees.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
builder7
50%
50%
builder7,
User Rank: Apprentice
9/2/2013 | 4:50:06 AM
re: Energy Dept. Hack Details Emerge
It is just that they lack of the tools necessary to know what to do, like knowledge - but of course they have been hired because of who they know!
builder7
50%
50%
builder7,
User Rank: Apprentice
9/2/2013 | 4:48:36 AM
re: Energy Dept. Hack Details Emerge
So, these are the people who do security checks on educated individuals who work for them when they cannot even buy the proper software so that they can do their job? How can one trust the people that do these security checks on people when they themselves cannot even support a modicum of security? It seems to me that it is another case of the good old boys running the show without having the smarts to actually do that. What are we going to do if we get attacked and our nuclear plants and electrical grid are targeted - trust the DOE?
erlrodd
50%
50%
erlrodd,
User Rank: Apprentice
8/31/2013 | 1:37:08 PM
re: Energy Dept. Hack Details Emerge
When they say they "don't have funds to update", this is a political statement meant for outside consumption. In the "real" world, it means "other things are higher priorities than security." Maybe so. However, I fear that government bureaucrats are so used to an unlimited funds environment that the concept of priorities becomes foreign to them!
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
8/30/2013 | 7:29:52 PM
re: Energy Dept. Hack Details Emerge
"Taking Charge"? The FTC pamphlet should really be called "Surrendering To The Inevitable." Taking Charge would be avoiding this sort of thing in the first place.
WKash
50%
50%
WKash,
User Rank: Apprentice
8/30/2013 | 7:19:11 PM
re: Energy Dept. Hack Details Emerge
Thanks for sharing the details on why this happened. It offers yet another example of why agency leaders can't just shrug their shoulders about legacy software, especially for the web.
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19071
PUBLISHED: 2019-11-18
A memory leak in the rsi_send_beacon() function in drivers/net/wireless/rsi/rsi_91x_mgmt.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering rsi_prepare_beacon() failures, aka CID-d563131ef23c.
CVE-2019-19072
PUBLISHED: 2019-11-18
A memory leak in the predicate_parse() function in kernel/trace/trace_events_filter.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-96c5c6e6a5b6.
CVE-2019-19073
PUBLISHED: 2019-11-18
Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering wait_for_completion_timeout() failures. This affects the htc_config_pipe_credits() function, the htc_setup_complete() function, ...
CVE-2019-19074
PUBLISHED: 2019-11-18
A memory leak in the ath9k_wmi_cmd() function in drivers/net/wireless/ath/ath9k/wmi.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption), aka CID-728c1e2a05e4.
CVE-2019-19075
PUBLISHED: 2019-11-18
A memory leak in the ca8210_probe() function in drivers/net/ieee802154/ca8210.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering ca8210_get_platform_data() failures, aka CID-6402939ec86e.