Uncle Sam's Travel Site Grounded By Breach 67
McGruber writes "Northrop Grumman's Govtrip.com website has been shut down following a security breach, according to a report by 'Security Fix' blogger Brian Krebs. Being a federal employee and frequent work traveler, I am (was?) a Govtrip user. My agency required me to use Govtrip to book all of my trips, including my airfare, car rentals, and hotel reservations, so Northrop Grumman's Govtrip databases contain my frequent flier numbers, Avis & Budget car rental numbers and frequent hotel guest (Choice Privileges, Marriott Rewards, Priority Club, etc.) numbers. Northrup-Grumman also stored all of my trip itineraries, including destinations, dates & modes of travel and the particular vendors (airline, hotel, rental car brand, etc.) used on a particular trip. Also stored on the website were my work travel credit-card (it has a $15,000 charge limit), personal checking account where my travel reimbursements were deposited, my home address, and emergency contacts ... just imagine what an accomplished social engineer can do with that combination of information!"
Accounts need 2 access no's: In & Out #'s (Score:5, Interesting)
If having another's check book account number means that one can withdraw from it, here's an easy fix:
Each account gets (at least) 2 numbers:
1. to deposit INTO it,
2. another to write cheques to get $$$ OUT of it, &
3. maybe a 3rd to let vendors & banks (with a cheque in-hand) to check that the balance covers the cheque.
It would - with that structure - not matter that this web site's security is breached (at least for -that- particular account).
Re:Accounts need 2 access no's: In & Out #'s (Score:1, Interesting)
details of hack .. (Score:2, Interesting)
'was this breach [databreaches.net] similar to what happened in the FISERV/CheckFree incident, or did something else happen?'
You're an idiot. (Score:1, Interesting)
The securest system is in a locked room, not connected to anything, and switched off. It's just not very useful.
You don't travel much, do you? Sure, I suppose I could call all the travel suppliers, and they could keep paper records. But that's massively inefficient.
Sorry, I WANT to be able to make travel arrangements quickly and easily. I want to have a profile with my favorite hotels and frequent traveler information so I don't need to type it in every time. I want to be able to see my upcoming reservations, so I know when my flight to Atlanta leaves this week, or so I can verify that I booked travel through the end of the month for a recurring reservation. I want to be able to update my trip from my iPhone when a flight gets canceled or a customer reschedules a site visit. And, yes, to the extent hotels require a credit card to hold a reservation, I want them to have that information available.
The great promise of the internet is in making life convenient. The above things all make my life as a frequent traveler more convenient. I don't think I'm unreasonable, or naive about security. I want companies to provide the services above, and to do that securely and well. This is not an impossible task. It's merely a difficult one.
Calling for people to remove any information that could be useful to identify thieves from any machine connected to the internet is the only thing that's atrociously stupid.
Re:Governments... (Score:5, Interesting)
They are also the company that is basically taking over all of the IT functions for the Commonwealth of Virginia. It's working about as smoothly as you would expect. [timesdispatch.com]
I'm sure once all the agencies have turned over all their equipment, applications, and network services to Northrop-Grumman to be run from their new high-efficiency data center, that It service will improve, security will be rock-solid, and costs will drop like a stone.
Re:Accounts need 2 access no's: In & Out #'s (Score:3, Interesting)
You may be right about which one is secure. (Answer: neither.)
But, if you use American Express they will really help you with purchase problems/charge back. (Had em rape a camera vendor once.) And other credit cards will help to varying degrees. And if you are renting a car you usually get free insurance. Then there are frequent flyer miles you get with purchases.
Do checking accounts offer any of these? If so I would really like to know.
And in the end I carry a piece of thin plastic vs a rather thick bundle of paper.
With a few credit/bank cards, about $20-$60 in cash, IDs, I use a mini-wallet and have space to spare.
Mine is similar to this one:
http://www.hotref.com/Wenger-Leather-Card-Wallet-p-3643.html [hotref.com]
My whole wallet ends up being 1/2 to 1/3 what others carry.
I used to work for Northrop... (Score:2, Interesting)
The company has been claiming to be "...expanding their monitoring capabilities to include additional network and host based intrusion monitoring technologies" for years. The problem is that no one is willing to pay for it, because Northrop's customers correctly assert it should be a part of any IT infrastructure implementation contract. Since no one is willing to pay Northrop additional money to competently manage their networks, Northrop doesn't.
Making the problem worse, Northrop's sysadmins routinely delete or trim logs to which they have access because the company's information security will not tell the sysadmins what events are considered "reportable", so they log everything, which results in log files so large they can't be stored, or even reviewed daily.
And some of Northrop's server infrastructure won't support the current revision of the vendor's anti-virus software, so various divisions of the company request waivers to those requirements. Those waivers are a violation of company policy, even if compliance is impossible to achieve, but no one wants to re-write the policy to recognize the cold, hard reality that Northrop's infrastructure is so complicated that the "one size fits all" approach is the path to failure.
And, to top it all off, Northrop's information systems auditors are incompetent. They routinely refuse to document known deficiencies because it would make the company look bad, and the company's external auditor, Deloitte, sends softball auditors to Northrop that have no knowledge or expertise in the information systems they're auditing. Because Northrop has a documented "system of control", it's considered "mature", even if most of the controls are fiction.
So this doesn't surprise me in the least.
I was working at CSC in 2001 - 2002, and CSC had the contract for the Navy's civilian personnel timekeeping system. CSC had similar problems, with similar causes. Then, as with Northrop, the real problem is the utter lack of customer oversight and accountability.
Re:Accounts need 2 access no's: In & Out #'s (Score:3, Interesting)
You wouldn't give the Kwik-E-Mart your checking account number. You use a credit card (if not cash) because it has fraud monitoring and the ability to dispute charges.
What you were missing in your GP comment is that in this particular scenario, the OP only needs to give govtrip.com access to his account for deposit reasons. Therefore, if someone were to steal his information under the multiple-account-number system, all they would have is the ability to deposit more money into his account. He's not using his checking account to pay for anything on that site.
Re:Accounts need 2 access no's: In & Out #'s (Score:3, Interesting)
A credit card is ideal because it places risk at the credit card company instead of at the bank, where your money is. A fraudulent credit card charge is far easier to deal with than a fraudulent withdrawl. Good luck paying your bills when your checking account is empty.