|
Invasion continues . . .
Arizona DPS: LulzSec hacking started with officers' e-mails
10 comments by Ginger Rough - Jun. 24, 2011 01:51 PM
The Arizona Republic
.
The Arizona Department of Public Safety said Friday that an international group of hackers appeared to have breached a vulnerable spot in its network by accessing the e-mail of seven of its officers stationed in "remote areas" of the state.
Those seven officers were part of a separate e-mail system that did not require users to update their passwords on a regular basis, nor require a more complex combination of capital and lowercase letters and numbers as their entry code.
Hackers group claims breach of DPS computer system
"Because we have people stationed all over the state, not everyone is on the same password requirements," DPS spokesman Steve Harrison said Friday. "We were in the process of changing that system over already. Obviously, this will make us go a little faster."
The hacking group LulzSec, which has taken responsibility for breaching the websites of the CIA and the U.S. Senate, said in a bulletin Thursday afternoon that it targeted the DPS because it opposes Senate Bill 1070, a tough immigration law passed in 2010 by the Arizona Legislature. The law is largely on hold pending a review by the U.S. Supreme Court.
Harrison said the more than 700 DPS files, posted on the LulzSec website, appear to either be attachments to the e-mails themselves or stored on the hard drives of the computers the officers used to access their accounts.
"Obviously there are some training issues related to this," Harrison said of the simplistic passwords used by the hacked officers. "They need to use a little more robust system."
Harrison declined to discuss specifically what measures the department was taking to contain the breach and ensure it doesn't happen again. But he did say the department's information technology team immediately changed the officers' passwords after confirming the breach Thursday afternoon.
They also blocked external access to the DPS servers Thursday evening in response to the attack. The servers were brought online again shortly after noon Friday, he said.
The stolen DPS files include personal information about officers and numerous documents, ranging from routine alerts from out-of-state police agencies to videos and photos about the hazards of police work and operations of drug gangs.
DPS is handling both the internal investigation into the breach and the criminal investigation resulting from the hack, Harrison said. At this point, it appears that LulzSec violated both federal and state laws, and DPS anticipates bringing in the U.S. Federal Bureau of Investigation to help with the criminal probe.
"I anticipate we will ask for and receive assistance from the FBI," Harrison said. "I suspect this will be a joint investigation, and we will work to bring charges at both the state and federal level."
Manuel Johnson, a spokesman for the Phoenix FBI, said Friday that his office was aware of the attack, but he referred all questions to DPS.
It's not clear who would process the case, if a suspect is identified.
State Attorney General Tom Horne said DPS would have the discretion to send the criminal probe either to his office or to the U.S. Attorney for Arizona, given the apparent violations of both federal and state statutes.
"If the people could be found, we would certainly prosecute them," Horne said.
Gov. Jan Brewer has been briefed on the security breach, but her office is referring all questions to DPS.
House Speaker Andy Tobin, R-Paulden, said Friday that he is "outraged" by the attack, for reasons that include its apparent motivation over SB 1070.
"This extremist group has now put hundreds of Arizona's finest in danger," Tobin said in a statement. "These cyber terrorists should be prosecuted to the full extent possible. Their actions have compromised the safety of our brave law-enforcement officers and their families."
__________________
__________________
Phewy!
|
Linear Mode
