An unpatched flaw in a "widely used security program" was
exploited by an unknown hacker to gain access to a Georgia
Technology Authority (GTA) database containing confidential
information on more than 570,000 members of the state's pension
plans.
The intrusion occurred sometime between Feb. 21 and Feb. 23 and
involved a hacker who used "sophisticated hacking tools" to break
through several layers of security after accessing the server
hosting the database via the software flaw, said Joyce Goldberg, a
GTA spokeswoman.
Goldberg refused to name the security vendor whose software was
exploited, citing an ongoing investigation. She added, however,
that the vulnerability exploited by the hacker had already been
publicly disclosed by the vendor.
"We were in the midst of fixing the flaw that the software
vendor had identified. But the hacker got in before we were able to
do that," she said. "Shortly after the breach, we saw some unusual
activity, and in looking at that, we discovered the breach."
Goldberg declined to elaborate on what that unusual activity
was.
The breached server contained information on a total of eight
pension plans administered by the state. The core database itself
was managed by the state Employees Retirement System, though the
server it was hosted on was administered by the GTA.
At this point, there is no evidence that confidential
information, including names, Social Security numbers and
bank-account details, have been misused, Goldberg said.
Even so, the GTA is sending out letters to 180,000 affected
employees for whom it has contact information, she said. The state
does not have current addresses for the remaining 373,000
individuals affected and is relying on media reports and its own
outreach efforts to inform them of the potential compromise of
data, Goldberg said.
The Georgia Bureau of Investigation is investigating the
incident. The GTA is also bringing in outside security advisers to
do a security assessment, the agency said in a note posted on its
site.
This is the second major breach involving the GTA in the past
year. In April 2005, the GTA disclosed that a state employee had
downloaded confidential information belonging to more than 450,000
members of the stateb s health benefit plan onto a home
computer.
Since that breach, the GTA has implemented several measures to
tighten security, including stricter password controls, more timely
reviews of logs and alerts, more extensive employee background
checks and stricter control of access confidential data, according
to the GTA's Web site.
Incidents such as this highlight the dangers companies face when
the software they rely on to protect their data itself turns bad,
said Lloyd Hession, vice president and chief technology officer at
BT Radianz, a New York-based provider of telecommunications
services to financial companies.
"The most important point to remember [from such incidents] is
that you donb t want to be overly dependent on a single vendor's
product" for security, Hession said.
Earlier this month, a faulty antivirus update from McAfee Inc.
mistakenly identified hundreds of legitimate programs as a Windows
virus, resulting in the accidental deletion of significant amounts
of data from company computers that had the faulty software
installed on them.
Two years ago, the Witty worm, which was reported to have
damaged 15,000 to 20,000 computers worldwide, took advantage of a
flaw involving the BlackIce and RealSecure intrusion-prevention
products from Atlanta-based Internet Security Systems Inc. The worm
wrote random data onto the hard disks of vulnerable systems,
causing the drives to fail and making it impossible for users to
start up the systems.
Such incidents highlight quality lapses that sometimes occur
when security vendors try to rush out products to keep up with
security threats, Hession said. "Security vendors have to adapt
very quickly to new threats," resulting in very short development
and testing cycles, he said.
With security products, "the perception is that it should be
more reliable than other software," which is not always the case,
said Ken Dunham, director of the rapid response team at VeriSign
Inc.'s iDefense Labs unit. IT managers need to remember that all
software is susceptible to errors that pose security risks, he
said.
icon.
