IRS Employees Fall For Hackers 279
linuxwrangler writes "Treasury department auditors recently posed as network technicians and attempted to get IRS employees to reveal their usernames and passwords and/or change the password to one suggested by the "technician". The result: over one-third shared their passwords. If there is any good news in the story it is that the 35% figure represents a substantial reduction from the 71% who fell for the ruse in 2001."
Social Engineering is the biggest problem (Score:5, Insightful)
Re:Social Engineering is the biggest problem (Score:5, Insightful)
No matter how good an encryption system is, its obviously going to fail if the person breaking in has the right information.
Re:Social Engineering is the biggest problem (Score:5, Insightful)
I was however pleasantly surprised recently when going to a gas station, paying at the pump, the receipt didn't print out and when I went inside the cashier actually asked me for the last name on the card instead of just handing me the receipt. I almost offered him a job.
Re:Social Engineering is the biggest problem (Score:5, Insightful)
That's an excellent point. I'd say perhaps that instead of being least worried about, its more likely the most over looked. When you think of stopping hackers, most people picture a firewall program and router. Not their telephone and a random IT department problem.
Re:Social Engineering is the biggest problem (Score:5, Interesting)
The problem with social engineering is that before the users can be given a clue, management has to get one.
And they can't just buy it in a shrinkwrapped package from $VENDOR, they'd have to admit (to the entire company) they don't know something and be educated. But they're not going to do that, nor will they defer to the experts they (should have) employed to handle it without managerial fiddling. Therefore the problem doesn't exist, mmkay?
Re:Social Engineering is the biggest problem (Score:5, Interesting)
Our receptionist will buzz anybody into the office if they ask. After work one day, she admitted she felt bad not knowing anybody's name because she's new, and didn't want anybody to realise she didn't know them, so she buzzes everybody in.
So, any random person could compromise my whole network by knowing only a few words of english. "Can you buzz me in?" and it doesn't matter what they say for the second part, because you can trust anybody in the building because you "need key card access," and the users will volunteer their password to anybody they think they can trust.
Re:Social Engineering is the biggest problem (Score:4, Insightful)
Get rid of the buzzer on the door, get rid of the keycards. Get rid of anything that creates a false sense of security, or an idea that you are somehow within a "trusted" environment.
Re:Social Engineering is the biggest problem (Score:2)
SB
public passwords (Score:5, Interesting)
One thing that windows lacks is for an Admin user to be able to impersonate anyone ala su under unix. It would make fixing problems for other people so much easier as you could log into their computer as them using your/admin credentials.
Re:public passwords (Score:4, Informative)
Write up a quick VB/C++/C#/Whatever app, make up a login prompt, get it to login, impersonate the user, and start explorer (obviously, you'll need to shut down explorer first).
You could do the same and spawn cmd as well, if that's all that is needed.
Re:public passwords (Score:4, Funny)
Re:Social Engineering is the biggest problem (Score:5, Interesting)
Re:Social Engineering is the biggest problem (Score:3, Informative)
Re:Social Engineering is the biggest problem (Score:5, Insightful)
People are willing to pay a huge price for convenience. Social engineering attacks exploit that, but obviously, it hasn't been enough to make people cynical or stringent on rules.
My first inclination was to make the process of buying and receiving the food fast and convenient. Many people don't bring out their IDs with their credit cards and sometimes have to dig through purses for them. So it makes it slower and inconveniences them. Obviously, I understand that security is important enough, but it's not something people are taught. And even if you are, when you have rushes of people and some can be a pain, you just want to get them through.
But even then, you have to wonder what balance to reach. Do you always reject people if they don't have their IDs? On campus, some places take your ID if you check something out or whatever. How trusting can you be? And "never" just doesn't work in regards to customer service because you want the people to feel as they're treated well and come back (without angering those that care about security).
Social engineering will always work into the future because people are willing to take certain losses (billions of dollars each year) for convenience, values such as courtesy and (as in the secretary case the other guy mentioned) save face.
Then, you have issues of people that rebel due to overly strict rules or disagreement with them. I know that many universities have had to deal with theft. The Engineering department at MSU locks the doors on the buildings around midnight (though the hours say until 2am) and since so many people come in and go out of the buildling later than that, the students keep a trash can to prop the door open. And if I'm going out of the building, I wouldn't hesitate to keep it open for someone who's trying to get in.
With software it's the same things. Writing passwords down or whatever. Given the option between security and convenience, most likely, it'll be the latter.
Re:Social Engineering is the biggest problem (Score:3, Informative)
Are you aware that Visa does allow you to check any id other than the signature on the back of the card? See id not valid [infinitydatacorp.com]
Re:Social Engineering is the biggest problem (Score:2, Insightful)
Re:Social Engineering is the biggest problem (Score:4, Funny)
Security Breach Traced To Hole in Head of Admin [bbspot.com]
Re:Social Engineering is the biggest problem (Score:2, Insightful)
*not that said degrees are/are not useful, just that lots of people need to learn a lot about computers and scams like this. Now.
Re:Social Engineering is the biggest problem (Score:2)
Did they not think that there was a potential security risk here?
Re:Social Engineering is the biggest problem (Score:3, Funny)
Re:Social Engineering is the biggest problem (Score:5, Insightful)
I think there should be a memo at every single person's desk: "Never give out your password or credit card number in a phone call." (Quick play on MSN's security warning..)
Besides, any admin worth his salt will reset a user's password and tell him to change it instead of telling him to change it to what the admin wants.
I hate stupid poeple...
Re:Social Engineering is the biggest problem (Score:5, Informative)
There's a good scam I read about in a book, I think it might have been the one written by Mitnick. Here's how it works:
You pretend to be the network administrator testing some new security procedures and you phone up your target user. Introduce yourself and say that you're running some security testing on the networks and you need five minutes of their time to do some testing. Remind them that never, under any circumstances, should the user tell anybody else their password. Even reinforce that they shouldn't even tell you, as you don't need to know.
Now here's the trick. Ask them to logoff. Once they've done that, tell them that you're doing some monitoring and that they should now login with their password... "and remember, don't tell me what it is!" Great, now we need to test the change password function. Get them to change their user account password to something which is known, such as "abacus". Once they've changed their password, ask them to logoff again. You, the intruder, can now login to their account as you know the password. If it's unix-based, you can setup some kind of daemon to run and accept connections, grab random files, login to the corporate VPN, whatever. Stall them for a little bit while you pillage their network... get them to login, letting them know you can't see their login come through, etc. Whatever buys you the time you need.
Then get them to login once more and change their password back to what it was. Remind them yet again not to tell you that password as they should never tell anybody what their password is. Thank them for their time and for helping you test the security system [and for allowing you to preview tomorrow's result of whether or not the FDA will be accepting or rejecting their new drug therapy, thereby allowing you to take out appropriate options on the stock].
Re:Social Engineering is the biggest problem (Score:3, Interesting)
So while I agree with you that absolutely draconian measures are called for, and people should be fired for not being as smart as you (even though they were hired for jobs in which computer expertise is not a prerequisite), I'm curious about the potential disaster you proclaim.
What sort of disaster would this be exactly? Every
Quit lying! (Score:4, Funny)
Oh please. You have never ever said that before. Just yesterday you were saying the shrinkrap on new DVDs was the biggest problem. I can hear it now, "Damn it! I can't get open up my new Steel Magnolia Director's Cut DVD!!! This damn wrapper is the biggest problem! There should be a law!".
Re:Quit lying! (Score:2)
Re:Social Engineering is the biggest problem (Score:5, Interesting)
Re:Social Engineering is the biggest problem (Score:2)
You think? Of course, the more "sophisticated the ruse" is, the more people will fall for it. That's what worries me. If 30% fall for this, then what about the key employee who will be tricked by a deceptive criminal who is focusing all his attention on tricking that one person?
Re:Social Engineering is the biggest problem (Score:3, Insightful)
It's been proved time and time again that it is so much easier to just walk up and ask for a password than to try and crack it.
1024-bit encryption doesn't prevent a helpful secretary with her password on a post-it note stuck to the front of her monitor.
Well, I'm glad choicepoint has competition.. (Score:5, Funny)
Re:Well, I'm glad choicepoint has competition.. (Score:2)
(although I could have Taco's spelling audited for the next 3 years!)
Fool me once... (Score:5, Funny)
You know, there's an old saying in Tennessee - I know it's in Texas, it's probably in Tennessee...
Re:Fool me once... (Score:2, Funny)
I would be happy.. (Score:5, Insightful)
Re:I would be happy.. (Score:4, Insightful)
I like your goal, its actually feasible. I think it would be pretty much impossible to make social engineering ineffective in any large business or agency.
Better training to recognizing attempts at social engineering I think would make a world of difference.
Re:I would be happy.. (Score:4, Insightful)
Not to detract from the observation this is a vast improvement, but I should think you could do one hella lot of mischief with even a 10% rate of success. Especially at the IRS. And almost anyplace else, come to think of it.
Re:I would be happy.. (Score:2, Interesting)
Re: (Score:3, Interesting)
Re:I would be happy.. (Score:2, Insightful)
Re: (Score:2)
Re:I would be happy.. (Score:2)
Afterall, the campaign should be simple.
"If ANYONE, EVER asks for a personal password, report it to I.T. and building security immediately."
Hang posters above the urinals, on the walls, in every cubicle... just to drive it home.
Re:I would be happy.. (Score:2)
Re:I would be happy.. (Score:3, Insightful)
Re:I would be happy.. (Score:3, Insightful)
The only measure of security is:
It would make an effective deterrent to all but the most dedicated intruder.
That's all that matters. Increasing the dedication needed to break in is what security is all about.
Hopefully they got the following email: (Score:2)
From: Myself
Subject: Meet with auditing team 10:30
Something about stupid passwords.
Don't miss it!
--
Can you be fired from the IRS for brazen stupidity?
Re:I would be happy.. (Score:2, Funny)
you know what they say.. (Score:3, Funny)
Re:you know what they say.. (Score:5, Funny)
sure about the former." Albert Einstein
No matter what OS you're running... (Score:5, Informative)
Re:No matter what OS you're running... (Score:3, Funny)
Where have all the BOFHs gone? In my day, that candy bar would be 6o grams or so of C4 nougat with 3 remote detonator almonds all covered in a delicious chocolatey coating.
Kids - no sense of history [xnet.com].
Soko
No Surprise here (Score:3, Interesting)
Re:No Surprise here (Score:5, Informative)
A few notes from someone who works at the subject TLA.
Flat wrong. Essentially every IRS employee gets a computer when they come on board.
Wrong. All the 386s have been gone for years. The slowest machines in common use are 800Mhz Dell C600s and they're being replaced this year.
Demonstrably wrong. Look at the history of LCD fabs for one example. Specifically, IRS demand for larger LCDs drove much of the that industrys momentum a couple of decades ago. Look up the screen specs for the old Zenith 171 lunchbox computer.
You want more current examples? Linux deployment, our VPN implementations, and plenty of other things we do have been at the leading edge of what's workable for a long time.
Where in the hell did you get that idea? Holy smoke, our work processes are so tied to technology it's ridiculous. That's why people freak out when computers don't work and they're willing to do anything, even, sometimes, give out their passwords, to get things working again. I really don't know where you're getting this crap.
Ad hominem and not worth responding to. Wrong, to boot.
The Civil Service system is almost dead. If you didn't get on board over 20 years ago, you're probably not even a member. Almost everyone is a Federal Employee Retirement System member now, so the old "stay there a lifetime and ossify in your chair because you're bound to the retirement system" motivation no longer exists. As for the more general use of the term, as in "Civil Service protections," they've been under unrelenting attack for so long there's little left. Yes, it's different from private industry but the old image of "Civil Service," which is what you're evoking, is simply no longer anywhere close to accurate.
I would never flame someone for ignorance. Ignorance is curable.
Finally, something insightful. Thank you. The IRS dedication to computer training is pitiful and if that condition were corrected, much of these problems would go away.
As an aside, the IRS was on the verge of making huge inroads on this in 2001. We had set up a new-hire training model that shipped all new employees to a central location for training. The advantages were absolutely huge. This successfully addressed complaints from tax professionals about disparate enforcement of tax law in different jurisidictions because everyone was going to be trained to do things the same way. In addition, since everyone was in one place at the same time, the IT folks had managed to get time slots to provide real, quality training to everyone. Things were good.
We were in class on 9/11. We dealt with getting people home during the full ground stop. We dealt with people who saw massive numbers of their coworkers dying on television and simply collapsed under the emotional assault. (Not our people, but some of the folks working in the same facility were HQ'd in the WTC.) We dealt with people having an unreasonable fear of flying for a long time. (I spent a half day printing maps and plotting routes for shaky employees who had chosen to rent cars and drive home, even if that drive was a thousand miles.)
The bottom line, though, was that centralized (read: high quality, consistent) training was then deemed too cumbersome and the program canceled. Big mistake. I hope we find a better way to do things before I retire.
Apologies in advance... (Score:5, Funny)
I'm sure that all this bad press for the IRS must be really taxing.
Sorry.
Re:Apologies in advance... (Score:2)
I'm sorry I don't have any mod points to counter the unfair Troll moderation you've been given.
Re:Apologies in advance... (Score:3, Funny)
Re:Apologies in advance... (Score:2)
Sorry.
No problem.
We now return you to your regularlly scheduled discussion.
Soko
Re:Apologies in advance... (Score:2)
Hmmm (Score:5, Funny)
Re:Hmmm (Score:2)
fire them (Score:5, Insightful)
Fingerprints (Score:3, Interesting)
Re:Fingerprints (Score:2)
Re:Fingerprints (Score:4, Insightful)
Giving out passwords (Score:5, Informative)
Scary.
Call me silly, but I think people should know that ANYONE in a position to legitimately be messing around with your account already has the ability to do what they need without giving you a call. There should be a simple policy (and maybe there even is, but obviously even some managers don't know): DON'T give out your password or userid to anyone. Period. And start telling that to the managers!
Re:Giving out passwords (Score:2)
Comment removed (Score:4, Interesting)
slashdot_story= yahoo_story_delay(2hrs); (Score:5, Funny)
H.
Re:slashdot_story= yahoo_story_delay(2hrs); (Score:2)
Not isolated to software (Score:5, Funny)
Does this mean IRS employees are slow learners (Score:3, Interesting)
IRS employs [house.gov] 100,013 employees in 2001.
36,000 employees got wise. What about the remaining 35,000 employees?
No wonder, the quality of our audit is getting better! I just hope not to get audit at all, but if I do, I'd like to know which employee passed this social engineering test so I can avoid them...
What better ways to railroad them with unmarked receipts and explaination of multiple exemptions?
Defence Against Social Engineering (Score:5, Informative)
"Some said they were not aware of the hacking technique and did not suspect foul play, or they wanted to be as helpful as possible to the computer technicians. Some were having network problems at the time, so the call seemed logical."
It all appears to come from these people naturally wanting help those who ask for assistance and claim to be trying to help them. It also can be the result of ignorance, with their lack of knowledge of this technique, and thinking that it would be logical to give that kind of information. But here's what I find most interesting:
"Other employees could not find the caller's name on a global IRS employee directory but gave their information anyway. Some hesitated but got approval from their managers to cooperate."
It was managers that gave this approval? Aren't they the ones who should be informing the employees of social engineering attacks? I think this may be the problem right here.
"IRS Employees Fall For Hackers" (Score:5, Funny)
Re:"IRS Employees Fall For Hackers" (Score:4, Funny)
SB
Re:"IRS Employees Fall For Hackers" (Score:2, Funny)
Never, never dump one.
Wasted time..but at least I made money (Score:5, Interesting)
We spent 4 hours discussing spyware, attachment best practices, viruses, adaware, malicious sites and policys on installing web apps.
Shortly afterwards, using the ClickAware site, we send out fake e-mail with ( my personal favorite ) the "Install this Microsoft Patch" message with a phantom 241K attachment.
I can then view the click rate and then match the click's to the internal IP browsing logs to see who's been a bad boy/girl/it.
I'm stunned most of the time when not but 3 days after a rather lengthy, yet energetic, discussion, some 70% of the people ( of 122 e-mails ) actually clicked on the phantom attachment and saw the "If this was real you would be in trouble" message.
As the subject says, I feel like I am wasting my time in performing these security meetings but hell, I'm getting paid for it.
I know there will be the obligatory ( you must suck as a teacher then ) comments but it would be good to see if anyone else has experienced the same thing after doing security discussions with their employees.
Government and Computers - Just say No! (Score:4, Interesting)
Re:Government and Computers - Just say No! (Score:2)
SB
Re:Government and Computers - Just say No! (Score:2)
Or do you suggest private companies are so much better at security?
Geesh, this is a human issue. Notice the word "social"!
Company upgrade snafu (Score:5, Interesting)
Re:Company upgrade snafu (Score:5, Insightful)
Moderation? (Score:5, Funny)
You must be new here...
Re:Company upgrade snafu (Score:2)
Re:Company upgrade snafu (Score:2)
HOW ABOUT TESTING? Just set up a dozen workstations, log a bunch of people on to them in the old system, perform your automatic upgrade, log those people back in and see if it works. If it doesn't, fix it. When you have a 95% success rate, or 99% if you're picky, roll the upgrade out.
8 Years ago there were no automatic upgrades. Most of this stuff is fairly new. The sysadmin was stating that even though he knows the trade a hell of alot better know, there weren't all the tools available back then and wou
blame the manager... (Score:2, Interesting)
Just goes to show that you don't promote based on brains.
but then again, it doesn't show too much brains on the part of the employees either. They cave as soon as a "higher up" says it's okay.
RTFA (Score:5, Funny)
Since few have read the fucking article, I'll quote the relevant portions here:
With this news, I'll probably be calling my credit card company to see about helping a few customer service representatives with their account problems.
Probably my health & car insurance companies too. It'd be great if I could save 15% on my car insurance.
Re:RTFA (Score:5, Funny)
Probably my health & car insurance companies too. It'd be great if I could save 15% on my car insurance.
You could always just call Geico.
Homeland Security (Score:2, Funny)
What about employees of more sensitive agencies? (Score:3, Interesting)
It would appear that they are more savvy, and receive more training, but who knows?
Re:What about employees of more sensitive agencies (Score:2)
The answer is, "it depends."
It depends A LOT on the individual security people at each site. Some are idiots. Some are competent. Anecdotally, the higher up the DSS management chain you go, the more likely they are to be idiots because they are further and further divorced from the technical details and thus prone to more and more "hand-waving" like "it only takes a simple script to do the firewalling" and "no open sour
Change your passwords! (Score:4, Funny)
there's worse (Score:3, Interesting)
Re:there's worse (Score:5, Informative)
Not any US bank, I wouldn't think. You see (and I work for a bank, so I know a thing or two..), every year, we have a couple of audits. In addition to the SEC stuff, which really doesn't touch much here, FDIC makes sure our procedures are solid. The bigger audit is OCC (Office of the Currency Comptroller). Typically, we have several auditors on-site for a week or a week and a half, poring over standards, guidelines, and procedures. If, and this is a big if, we had anything like a single password for all users, we would be dinged most severely.
Then there's the whold GLBA (Graham Leach Bliley Act) morass. GLBA governs a lot of things for banks, but most importantly for this discussion, that any customer sensitive or confidential data must be protected, access audited, etc. A single password for every user is neither protected nor auditable. Any financial institution found doing such things would be socked with a rather nasty five figure fine, more than likely. That alone is incentive enough not to cut corners on security.
A book about social engineering (Score:3, Informative)
Ladies and gentlemen (Score:2, Funny)
No wonder... (Score:3, Insightful)
The american public has been educated by the media into BELIEVING scams, rather than distrusting them. No wonder it's the country with the greatest incidence of religious cults (as in "brainwashing" cults).
So is it a mystery that people fall for sharing their passwords?
Mod parent insightful, please (Score:2, Insightful)
HUMAN SOFTWARE UPGRADE!! (Score:2, Funny)
Been There Done That (Score:2, Insightful)
It's a darn shame... (Score:3, Funny)
Other reasons it's failing (Score:3, Insightful)
Re:"Hackers"? (Score:4, Insightful)