Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Government Security The Military IT

Pentagon Credit Union Database Compromised 108

Posted by samzenpus from the leaking-like-a-sieve dept.
Trailrunner7 writes "The credit union used by members of the US armed forces and their families has admitted that a laptop infected with malware.was used to access a database containing the personal and financial information of customers. The Pentagon Federal Credit Union (PenFed) issued a statement to the New Hampshire Attorney General that said data, including the names, addresses, Social Security Numbers and PenFed banking and credit card account information of its members were accessed by the infected PC."
This discussion has been archived. No new comments can be posted.

Pentagon Credit Union Database Compromised More

Pentagon Credit Union Database Compromised

Comments Filter:

  • Quick... (Score:3)

    by butalearner ( 1235200 ) on Wednesday January 12, 2011 @06:09PM (#34854756)
    Any banks or credit unions not using Windows?

    • Re: (Score:3)

      by kaptink ( 699820 )

      It's sad when your first thoughts on reading this story is 'oh another windows fail' but the sad reality is that I would bet my life that it was. Assuming I am correct, will Microsoft be held accountable?

      • No.

        • Re: (Score:2)

          by Thud457 ( 234763 )
          Wait, I thought one of the justifications against going FOSS was that if something went disastrously wrong with a Windows system, at least you could sue Microsoft.

          ?
          • Nope. The justification is that you can blame Microsoft. You can say to your boss 'we went with the same thing that everyone else is using' and then you don't get blamed personally.

      • It's sad when your first thoughts on reading this story is 'oh another windows fail' but the sad reality is that I would bet my life that it was. Assuming I am correct, will Microsoft be held accountable?

        Of course Microsoft is not responsible, but also consider, had the laptop-toting person responsible been using something other than Windows, it would be highly unlikely that we would be having this discussion. It occurred to me after I posted (and after reading the article) that the laptop could have been an personal one, and it doesn't really matter what the bank is using if the guy loaded up the database on it and the malware quietly sent it elsewhere.

        • Re: (Score:2)

          by TheLink ( 130905 )
          What I find strange is if this statement was really true: "data, including the names, addresses, Social Security Numbers and PenFed banking and credit card account information of its members were accessed by the infected PC."

          Most malware programs don't copy every file and send the data over.

          So either the malware was suspiciously very targeted (looks for such files and sends contents out) or this was just a precautionary measure - they had to assume the data was compromised even if the malware didn't actuall

      • More than likely if the PC was up to date, and safe practices were used, then this issue could have been prevented.

        That said, such safe practices are much more maintenance and unwieldy in the Windows world - no I'm not dissing, it's fact from experience, as many of you may know.

        Technically, Microsoft is accountable. Legally, not.

    • Only Ye Ole Under The Mattress Bank.

      And even then, it's up to the depositor to ensure that the room is windowless...

    • Even if the bank had absolutely NO windows machines, and no Microsoft products anywhere - their database can be compromised by malware loaded on an external, non-bank-owned machine. Anywhere a login/password combination is stored is a potential data breach.

      It is the fact that they allow database access from an external, insecure site that is the issue - not which operating system is in use.

  • The weak link (Score:3)

    by nurb432 ( 527695 ) on Wednesday January 12, 2011 @06:16PM (#34854852) Homepage Journal

    As always, people not following proper procedures.

    • Re: (Score:1)

      by eko3 ( 1975468 )

      As always, people not following proper procedures.

      Is it really people not following procedures? Or is it lack of procedures for people that don't follow procedure?

  • When your security leaks like a sieve?
    And if those data get secretely sold to bad guys, do you think it's better than free publishing all of them?

    • Re: (Score:2)

      by hal2814 ( 725639 )
      What do you mean by "your security?" Are you under the mistaken impression that PenFed is a government entity? It's a credit union like any other. It's charter just happens to define its common bond as those involved in the military. This is not the droid you're looking for.

  • I still find it crazy that... (Score:4, Interesting)

    by Anonymous Coward on Wednesday January 12, 2011 @06:19PM (#34854878)

    I still find it crazy that systems like these don't have dedicated computers for accessing that info. Personally, I *refuse* to enter ANY kind of password into most peoples laptops, let alone access sensitive information belonging to thousands of people. Then again, no one cares about "other peoples information" until that other person is you...

    • Re: (Score:2)

      by gclef ( 96311 )

      This (and several other comments) really boil down to one thing: the price of security. The companies or organizations that get compromised rarely face any actual cost to being compromised, so the costs for doing security right (like, having dedicated computers for accessing financial information) are seen as "not worth the money."

      This will only get better when the cost of being compromised is borne by the group that screwed up, not the customers of that organization.

    • People are selfish.

      News at 11.

    • Geek Tip: It's handy to keep a Live OS on a USB drive on your keyring, for emergency access to sensitive sites, like banking and /.

  • This what they did for me... (Score:2, Interesting)

    by Anonymous Coward

    They gave me a new CC# right away, and offered two years free credit monitoring. Meh, Better than nothing I guess.

  • Members of the U.S. government sure have knack for getting malware.

  • This is a credit union that happens to be used by military personnel. The credit union is not on a military network.

    • Re: (Score:1)

      by ShaunC ( 203807 )

      Where was it stated otherwise?

      • Where was it stated otherwise?

        Everywhere. References to "air gap [slashdot.org]" security, references to Wikileaks [slashdot.org], and of course -- "the pentagon network [slashdot.org]" (as if there is actually such a thing...). And this is only in the first few minutes since the story got posted. Just wait a few hours and there'll be dozens, maybe hundreds...

    • The simple solution is to publish (on wikileaks?) the address of the responsible culprit - and the military and ex-military personnel will probably somehow manage to ensure that the data isn't used for malicious purposes.

  • There needs to be more air-gap security implemented in systems that are as important as banks/credit unions.

    I'm not referring to the air-gap currently between the ears of whoever is in charge of their computer systems.

  • Mainframe only? (Score:1)

    by Anonymous Coward

    What happened to keeping personal information like this to private mainframe computers, with LAN access only? Putting data like this on a laptop is only asking for trouble. We never seem to learn.

  • A case for laws? (Score:3)

    by DoofusOfDeath ( 636671 ) on Wednesday January 12, 2011 @06:22PM (#34854932)

    I wonder if there should be laws that make persons working for banks, utility companies, etc. criminally and civilly liable for violating that organization's IA rules.

    I'm talking about organizations responsible for information systems whose compromize could lead to significant public harm.

    • Only if the infected laptop shared two Justin Bieber songs with the host machine. Then we'd see the correct penalalty.

    • This stuff happens a little less often with credit card numbers because the credit card processors take PCI (Payment Card Industry) standards pretty seriously, audit their big clients yearly, and give the real threat of cutting off companies that don't have enough security. On the other hand, PCI compliance is kind of loose, so I think the real effect of the PCI audits is that they make companies actually _think_ about security. Once you get thinking about security, you can probably do better than PCI req

  • This is incredibly sad. (Score:4, Insightful)

    by jd ( 1658 ) <imipakNO@SPAMyahoo.com> on Wednesday January 12, 2011 @06:32PM (#34855062) Homepage Journal

    Let's look at this.

    In short, infected devices have caused serious problems (and occasionally fatalities). The Pentagon has been subject to malware-related cyber-attacks, including (as noted in the list) serious cases of espionage, in the past. That people are (a) running devices that are open to attack, and (b) are able to connect such devices to any Pentagon network, is seriously pathetic.

    • Re: (Score:2)

      by blueg3 ( 192743 )

      That people are (a) running devices that are open to attack, and (b) are able to connect such devices to any Pentagon network, is seriously pathetic.

      With the current security landscape, this boils down, essentially, to:
      (a) People are using computing devices
      (b) Some computers are able to connect to the Pentagon network

      • Except that Windows is more vulnerable to malware than other OSes by orders of magnitude.

        • Re: (Score:2)

          by blueg3 ( 192743 )

          To meet OP's requirements, number of vulnerabilities doesn't really matter. All systems have some vulnerabilities. With few exceptions, they're not theoretical vulnerabilities, either -- they're actively exploited. So regardless of the device people use, it will be the case that they are using a device that is open to attack.

          • Re: (Score:2)

            by jd ( 1658 )

            Not really. You just require that mobile devices that connect to classified or commercially sensitive networks that relate to defense meet FIPS standards and if they can perform computations are also EAL6 or EAL7 certified.

            Yes, there's not much that's at that level, but if you create a demand for such products you will see the production of such products.

            It's also true that fixed devices internal to the secure networks don't need to be that highly secure, but you've got to bear in mind that mobile devices a

      • Re: (Score:2)

        by c0lo ( 1497653 )

        That people are (a) running devices that are open to attack, and (b) are able to connect such devices to any Pentagon network, is seriously pathetic.

        With the current security landscape, this boils down, essentially, to: (a) People are using computing devices (b) Some computers are able to connect to the Pentagon network

        Best solution... Pentagon to drop the reliance on computers. Errr... wait... and paper too (because the Pentagon papers were... well... on paper).

    • The Pentagon has been subject to malware-related cyber-attacks... To clarify, it's a credit union and not the actual DoD Pentagon.

      • Re: (Score:2)

        by jd ( 1658 )

        The malware-related espionage attack was against the Pentagon. That's an example of something that should not have ever been possible.

        That a cyber-attack was launched years later against the credit union when the DoD has already gained experience in defending against cyber-attacks, and experience in the consequences of failing is the part that bothers me.

        A hypothetical parallel would be one car manufacturer using a vendor's gas tanks that are prone to exploding after an affiliated manufacturer has already d

    • Re: (Score:2)

      by Jeian ( 409916 )

      PenFed is not affiliated with the Pentagon, except that the majority of their members are Pentagon employees.

      • Re: (Score:2)

        by hal2814 ( 725639 )
        You could probably argue that the majority of Pentagon employees are members but with one million members I highly doubt the majority of PenFed members are Pentagon employees.

        I think the only reason Pentagon is in the title is for the prestige. It's wicked cool when you pull out your credit card with a huge Pentagon on it to pay your bar tab. It's also cool when the lady at the tag office looks over your new car paperwork and asks you wide-eyed, "Do you work for the Pentagon?" (To which I have a canned

    • Well said!

  • Summary is misleading "The credit union used by members of the U.S. armed forces and their families" made me think it was referring to my credit union (USAA, open to federal employees and families, not just armed forces). It had me worried for a moment there.

    • Re: (Score:1)

      by Anonymous Coward

      USAA isn't a credit union.

  • Because let's face it, the US government can't even keep ANYTHING secret or secure. Apparently not even their darn bank accounts.
  • That information should have been encrypted within the database. Why, just the other day SQLServerCentral.com posted a tutorial on creating a transparent database encryption layer [sqlservercentral.com]. When managing critical information like SSN's or embassy cables, clear text is just asking for a compromise.

    Oh, and I am not saying Windows is anything at all good to have in anyone's life. In fact, the insecure nature of laptops and malware demands that security be increased closer to the sensitive data.

    Seth

    • When managing critical information like SSN's or embassy cables, clear text is just asking for a compromise.

      Both of those things are run by people who think that it's their job to compromise...

  • Either Microsoft fixes the problems (yeah, not going to happen) with its Windows OS or banking and other institutions must ban the use of MS Windows machines for handling sensitive information such as this.

    At the very least, requirements that such machines can NEVER have been used to connect to the internet or process email that might originate from the internet must be issued. These lax security policies are making victims of their customers and good luck getting your SSN changed after it has been used fo

  • The pentagon, which is renowned for being anal about security, let someone plug their unsecure laptop unto their network and just start accessing data at the tip of a hat.....i do not believe it, they probably are not sure of where this breach came from, and this is their cover story....so in case we see conf. info showing up only they had in public domains, now they can save their *sses, as they let us know about it.

  • PenFed is one credit union used by members of the armed forces, but it is not the big player -- that's Navy Federal Credit Union [navyfederal.org] (NFCU). It has three times the members (3M vs. 1M) and assets ($43M vs. $15M) that PenFed has. Not to minimize the impact, but the article reads as if all military personnel who join a credit union are affected, and this is not the case.

Slashdot Top Deals

"Buy land. They've stopped making it." -- Mark Twain

Close