An unpatched flaw in a “widely used security program” wasexploited by an unknown hacker to gain access to a GeorgiaTechnology Authority (GTA) database containing confidentialinformation on more than 570,000 members of the state’s pensionplans.
The intrusion occurred sometime between Feb. 21 and Feb. 23 andinvolved a hacker who used “sophisticated hacking tools” to breakthrough several layers of security after accessing the serverhosting the database via the software flaw, said Joyce Goldberg, aGTA spokeswoman.
Goldberg refused to name the security vendor whose software wasexploited, citing an ongoing investigation. She added, however,that the vulnerability exploited by the hacker had already beenpublicly disclosed by the vendor.
“We were in the midst of fixing the flaw that the softwarevendor had identified. But the hacker got in before we were able todo that,” she said. “Shortly after the breach, we saw some unusualactivity, and in looking at that, we discovered the breach.”
Goldberg declined to elaborate on what that unusual activitywas.
The breached server contained information on a total of eightpension plans administered by the state. The core database itselfwas managed by the state Employees Retirement System, though theserver it was hosted on was administered by the GTA.
At this point, there is no evidence that confidentialinformation, including names, Social Security numbers andbank-account details, have been misused, Goldberg said.
Even so, the GTA is sending out letters to 180,000 affectedemployees for whom it has contact information, she said. The statedoes not have current addresses for the remaining 373,000individuals affected and is relying on media reports and its ownoutreach efforts to inform them of the potential compromise ofdata, Goldberg said.
The Georgia Bureau of Investigation is investigating theincident. The GTA is also bringing in outside security advisers todo a security assessment, the agency said in a note posted on itssite.
This is the second major breach involving the GTA in the pastyear. In April 2005, the GTA disclosed that a state employee haddownloaded confidential information belonging to more than 450,000members of the state’s health benefit plan onto a homecomputer.
Since that breach, the GTA has implemented several measures totighten security, including stricter password controls, more timelyreviews of logs and alerts, more extensive employee backgroundchecks and stricter control of access confidential data, accordingto the GTA’s Web site.
Incidents such as this highlight the dangers companies face whenthe software they rely on to protect their data itself turns bad,said Lloyd Hession, vice president and chief technology officer atBT Radianz, a New York-based provider of telecommunicationsservices to financial companies.
“The most important point to remember [from such incidents] isthat you don’t want to be overly dependent on a single vendor’sproduct” for security, Hession said.
Earlier this month, a faulty antivirus update from McAfee Inc.mistakenly identified hundreds of legitimate programs as a Windowsvirus, resulting in the accidental deletion of significant amountsof data from company computers that had the faulty softwareinstalled on them.
Two years ago, the Witty worm, which was reported to havedamaged 15,000 to 20,000 computers worldwide, took advantage of aflaw involving the BlackIce and RealSecure intrusion-preventionproducts from Atlanta-based Internet Security Systems Inc. The wormwrote random data onto the hard disks of vulnerable systems,causing the drives to fail and making it impossible for users tostart up the systems.
Such incidents highlight quality lapses that sometimes occurwhen security vendors try to rush out products to keep up withsecurity threats, Hession said. “Security vendors have to adaptvery quickly to new threats,” resulting in very short developmentand testing cycles, he said.
With security products, “the perception is that it should bemore reliable than other software,” which is not always the case,said Ken Dunham, director of the rapid response team at VeriSignInc.’s iDefense Labs unit. IT managers need to remember that allsoftware is susceptible to errors that pose security risks, hesaid.