Blue Lance InfoSec Blog

Update: Carrell Clinic Ex-Security Guard Indicted

Jesse William McGraw was indicted by a Dallas federal grand jury yesterday on 2 counts of transmitting malicious code.  These felony charges were pressed back in June, when McGraw allegedly transferred malicious code into the hospital’s computer network, including an HVAC server that controlled heating and cooling for the entire hospital.  McGraw, also known by his hacker alias “GhostExodus”, has been held in custody since his arrest late last month on related charges.

McGraw’s actions compromised the hospital’s system in such a way as patient records, diagnoses, medical treatment, and care could have been compromised for any individuals being treated by the Carrell Clinic.  His actions on the clinic’s HVAC server could have compromised the integrity of temperature-sensitive medicines in the onsite pharmacy as well.

Plans had been made by McGraw to quit his job as the night security guard at the clinic the day before an intended Distributed Denial of Service, or DDoS, attack caused by the malicious code he uploaded onto the network.  He planned to call the day of the attack, July 4^th, “Devil’s Day”.  McGraw had been an employee of Dallas security company United Protections Services, and worked the 11:00 p.m. to 7:00 a.m. shift at the clinic.

Should McGraw be found guilty, for each count of transmitting malicious code he faces a maximum penalty of 10 years in prison, a $250,000 fine and restitution.

10 of the most embarrassing data breaches

Doug Cornelius writes for Compliance Building on the 10 most embarrassing data breaches of late.  Spanning the globe, the list varies in technique used to perform the data breaches, and resulting scope of damage.  Take a look and see for yourself if you agree with this top ten.

Royal Navy

Imagine losing information on everyone who had applied to join the armed forces including passport numbers, medical histories, and bank details. Of course, it was not encrypted. It was just sitting in a laptop in the back of a car. That’s what happened Jan. 9, 2008, in Birmingham, U.K., when a Royal Navy Officer left the laptop in his car and it was promptly stolen.

Read about all ten incidents here.

L.A. County coroner’s staff illegally accessed Michael Jackson’s death certificate and investigator’s reports

Michael Jackson’s death certificate has been viewed illegally hundreds of times, by at least 6 L.A. County coroner’s staff members.  Investigation into the security breaches resulting from Jackson’s death revealed weaknesses in two other systems where sensitive and private data regarding Jackson’s case was stored.

Death certificates are stored in the Electronic Death Registration System (EDRS), which is accessible by coroner’s employees with the proper access credentials, but is only to be used for job based duties.  Though the accused may have had proper credentials to access the system, they did not have work related reasons to view the death certificate.

The staff members who accessed the death certificate also printed out several copies, according to the L.A. Times.  Chief coroner investigator Craig Harvey said to the Times:

“There's only one person in the investigation of Mr. Jackson who needed to have a copy of the death certificate, and that was the investigator.”

Read the L.A. Times article here.

Former New York City Employee Charged with Stealing Bank Account Information

Zena Johnson, a former Quality Control Coordinator at the New York City Department of Buildings, has been charged with bank fraud and conspiracy to commit bank fraud for her role in a scheme to steal bank account information provided to the Department of Buildings by individuals submitting permit renewals and alteration repair applications.

Some of stolen information was used by Johnson's co-conspirators to create and cash more than $50,000 in counterfeit checks.

Read the criminal complaint.

American Express Employee Arrested for Stealing 300 Credit Card Numbers

An ex-AmEx employee and 4 others have been arrested in Ohio after stealing 300 credit card numbers and going on a $25,000 spending spree.  Unfortunately, the group was not smart enough to know they would be caught by having pizzas purchased with the cards sent to their homes.

Read more at the Office of Inadequate Security

Woman Sentenced for Deleting Patients from Houston Organ Bank

Houstonian Danielle Duann, 51, was indicted back in June 2008 on charges of illegally accessing and damaging LifeGift Organ Donation Center’s database.  Duann had been LifeGift’s director of internet operations until November 7, 2005, when she was terminated.  That night and into the next day, she repeatedly gained access to the LifeGift network by a remote connection.  She deleted patient files, software applications and backups related to LifeGift’s organ and tissue recovery operations. 

Also admitted were acts intended to cover Duann’s trail.  She deleted system logs that would have told of her remote access to the computers through which the harm was done, and disabled logging functions on several servers.

Duann was sentenced today to a 2-year prison term and 3 years of supervised release, in addition to $94,222 in restitution fees to LifeGift.  The maximum sentence she could have incurred was 10 years imprisonment and a $250,000 fine.

QTP Ex-Employee Sentenced for Computer Fraud

Lesmany Nunez, 30, of Miami, FL, was sentenced to 3 years in prison and fined $31,560 for charges of computer fraud brought against him by ex-employer Quantum Technology Partners (QTP) located in Miami-Dade County.  QTP is a service provider of email communication, data storage, and scheduling for their clients.  Nunez had worked for QTP as a customer support technician.

According to the FBI press release, Nunez used an administrator account and password to access QTP’s network one Friday night without authorization.  He proceeded to change the passwords of all IT system administrators, delete files that would have aided in reinstalling backed up data more easily, and shut down almost all of the servers.  His actions caused business as usual at QTP to cease for several days.

Because of Nunez’s activity, QTP accrued over $30,000 in damage and mitigation costs.  He was identified as the perpetrator by tracing the actions performed at QTP back to his home computer.  Upon search of Nunez’s computer, additional evidence was found.

10 Dumbest Mistakes Network Managers Make

Leaving passwords set to default, failing to find sql coding errors, not following PCI-DSS standards; all among the 10 dumbest mistakes network managers make, according to Network World’s article citing data from last year’s Verizon Business study of data breaches. The article states:

“What's astonishing is how often these security breaches were the result of network managers forgetting to take obvious steps to secure their systems, particularly non-critical servers… ‘We're just not doing the basics,’ says Peter Tippett, vice president of innovation and technology at Verizon Business, who has been auditing security breaches for 18 years.

Tippett helped us put together a list of the simplest steps that a network manager can take to eliminate the majority of security breaches. Not to follow the items on this list would be, quite simply, stupid. “

Read about all 10 mistakes here.

Temp at AT&T Arrested for Stealing Personal Info on 2,100 Coworkers

A temp at AT&T, Cassandra Walls of Chicago has been indicted on charges that she stole the personal information on 2,100 fellow employees, then used the information to acquire more than $70,000 in short-term payday loans in the names of 130 of them.

Walls allegedly stole co-workers' personal information, including Social Security numbers and dates of birth, and then took out numerous payday loans in their names online.

Jermaine Jones, 27, who lives with Walls, and Walls' sister, Deedra Massey, 40, of Naperville were also indicted. All three were taken into custody this morning and then released on $4,500 bond each following appearances in federal court.

According to the indictment, the fraudulently obtained loans were wired to bank accounts controlled by the trio.

Read the article.

Maintaining Security without Increasing the Operational Load on IT Staff

If you have to support more users, devices, and applications, your IT workload has increased, likely without an increase in resources.  How do you keep your network secure through these changes? Joe Golden answers the following question for Computerworld:

”I continually have to support more users, devices and applications on my network, but I get no new staff to handle the increased load. I know a lot of these users and services are important to helping our company keep up with changes, but I'm wondering what I can do to keep my network, and the data we have on it, safe. Any tips for how to maintain control in this changing environment, without increasing the operational load on my staff?”

To see his answers and up your security without upping your budget, click here.