SafeUM
Home Blog Services Download Help About Recharge

Axarhöfði 14, 110 Reykjavik, Iceland

Iceland - 2015
SafeUM
Blog
Services
Download
Help
About
Recharge
Menu
Archive
TOP Security!
5 Nov 2014

Hacker attack on federal security contractor not noticed for months

A cyberattack on federal security clearance contractor USIS, was unnoticed for months before it was revealed by the company and government agencies earlier this year.

Officials and others familiar with an FBI investigation and related official inquiries told that the breach, similar to previous hacker intrusions from China, compromised the private records of at least 25,000 employees at the Homeland Security Department and cost the company hundreds of millions of dollars in lost government contracts.

In addition to trying to identify the perpetrators and evaluate the scale of the stolen material, the government inquiries have prompted concerns about why computer detection alarms inside the company failed to quickly notice the hackers and whether federal agencies that hired the company should have monitored its practices more closely.

Former employees of the firm, whose full name is U.S. Investigations Services LLC, also have raised questions about why the company and the government failed to ensure that outdated background reports containing personal data weren't regularly purged from the company's computers. A computer forensics analysis by consultants hired by the company's lawyers defended USIS' handling of the breach, noting it was the firm that reported the incident.

The analysis said government agencies regularly reviewed and approved the firm's early warning system. In the analysis, submitted to federal officials in September and obtained by the AP, the consultants criticized the government's decision in August to indefinitely halt the firm's background investigations.

USIS reported the cyberattack to federal authorities on June 5, more than two months before acknowledging it publicly. The attack had hallmarks similar to past intrusions by Chinese hackers, according to people familiar with the investigation. Last March, hackers traced to China were reported to have penetrated computers at the Office of Personnel Management, the federal agency that oversees most background investigations of government workers and has contracted extensively with USIS.

In a brief interview, Joseph Demarest, assistant director of the FBI's cyber division, described the hack against USIS as "sophisticated" but said "we're still working through that as well." He added, "There is some attribution" as to who was responsible, but he declined to comment further.

For many people, the impact of the USIS break-in is dwarfed by recent intrusions that exposed credit and private records of millions of customers at JPMorgan Chase & Co., Target Corp. and Home Depot Inc. But it's significant because the government relies heavily on contractors to vet U.S. workers in sensitive jobs. The possibility that national security background investigations are vulnerable to cyber-espionage could undermine the integrity of the verification system used to review more than 5 million government workers and contract employees.

"The information gathered in the security clearance process is a treasure chest for cyber hackers. If the contractors and the agencies that hire them can't safeguard their material, the whole system becomes unreliable," said Alan Paller, head of SANS, a cybersecurity training school, and former co-chair of DHS' task force on cyber skills.

Last month, the leaders of the Senate Homeland Security and Governmental Affairs Committee, Tom Carper, D-Del., and Tom Coburn, R-Okla., pressed OPM and DHS about their oversight of contractors and USIS' performance before and during the cyberattack.

Another committee member, Sen. Jon Tester, D-Mont., said he worried about the security of background check data, telling the AP that contractors and federal agencies need to "maintain a modern, adaptable and secure IT infrastructure system that stays ahead of those who would attack our national interests."

The Office of Personnel Management and the Homeland Security Department indefinitely halted all USIS work on background investigations in August. OPM, which paid the company $320 million for investigative and support services in 2013, later decided not to renew its background check contracts with the firm. The move prompted USIS to lay off its entire force of 2,500 investigators.

A company spokesperson complained that the agency has not explained its decision. Representatives from OPM and DHS declined comment. Last month, the federal Government Accounting Office ruled that Homeland Security should re-evaluate a $200 million support contract award to USIS. The GAO advised the department to consider shifting the contract to FCi Federal, a rival firm, prompting protests from USIS.

In the private analysis prepared for USIS by Stroz Friedberg, a digital risk management firm, managing director Bret A. Padres said the company's computers had government-approved "perimeter protection, antivirus, user authentication and intrusion-detection technologies." But Padres said his firm did not evaluate the strength of USIS' cybersecurity measures before the intrusion.

Federal officials familiar with the government inquiries said those assessments raised concerns that USIS' computer system and its managers were not primed to rapidly detect the breach quickly once hackers got inside. The computer system was probably penetrated months before the government was notified in June, officials said.

Cybersecurity experts say attacks on corporate targets often occur up to 18 months before they are discovered and are usually detected by the government or outside security specialists. Still, USIS noted its own security preparations "enabled us to self-detect this unlawful attack." Padres said the hackers attacked a vulnerable computer server in "a connected but separate network, managed by a third party not affiliated with USIS." He did not identify the outside company.

Former USIS workers told the AP that company investigators sometimes stored old or duplicate background reports that should have been purged from their laptops. The reports contained sensitive financial and personal data that could be used for blackmail or to harm government workers' credit ratings, the former workers said.

Former USIS employees who worked with the federal personnel office said the system they used directed users to purge old reports. But the workers said USIS and OPM rarely followed up with spot checks. Employees who worked on systems with the Homeland Security Department said these had no similar automatic warning function and spot checks were rare. The company insisted spot checks were regularly performed.

Several former USIS workers said they were told nothing by the company about the cyberattack for two months after the breach was exposed. In emails obtained by the AP, company workers were ordered to change their passwords without explanation. The USIS spokesperson said the government directed the company's decision to keep silent about the breach. Experts said companies often withhold such information for both security and management reasons. "Employees may not like it," Paller said, "but from a business perspective, that's what companies do." 

Tags:
USA China information leaks USIS hackers FBI
Source:
Fox News
2123
Other NEWS
3 Jul 2020 safeum news imgage An encrypted messaging service has been infiltrated by police
4 May 2020 safeum news imgage Two-Factor Authentication ​What Is It and Why You Should Use It
12 Dec 2019 safeum news imgage Encryption is under threat - this is how it affects you
4 Nov 2019 safeum news imgage Should Big Decisions Be Based on Data or Your Intuition?
7 Jun 2018 safeum news imgage VPNFilter malware infecting 500,000 devices is worse than we thought
4 Jun 2018 safeum news imgage Hackers target Booking.com in criminal bid to steal hundreds of thousands from customers
1 Jun 2018 safeum news imgage Operator of World's Top Internet Hub Sues German Spy Agency
30 May 2018 safeum news imgage US says North Korea behind malware attacks
29 May 2018 safeum news imgage Facebook and Google targeted as first GDPR complaints filed
25 May 2018 safeum news imgage A new reason to not buy these cheap Android devices
24 May 2018 safeum news imgage Flaws in smart pet devices, apps could come back to bite owners
23 May 2018 safeum news imgage Google sued for 'clandestine tracking' of 4.4m UK iPhone users' browsing data
21 May 2018 safeum news imgage LocationSmart reportedly leaked phone location data onto the web
18 May 2018 safeum news imgage The SEC created its own scammy ICO to teach investors a lesson
17 May 2018 safeum news imgage Thieves suck millions out of Mexican banks in transfer heist
All news
SafeUM
Confidential Terms of Use Our technologies Company
Follow us
Download
SafeUM © Safe Universal Messenger

Axarhöfði 14,
110 Reykjavik, Iceland

Iceland - 2015