US security blunder exposes residents' data

By

The names, addresses and social security numbers of tens of thousands of Oklahoma residents were exposed to the general public for a period of at least three years.


The information was made available via a badly coded page linked to Oklahoma's Department of Corrections Sexual and Violent Offender Registry.

Anyone with a basic knowledge of SQL could view the list of sexual offenders, and query the database to bring up a host of other information on the residents.

Fredrick Lee, a software security researcher at Fortify Software, said that the problem was down to poor coding.

"This is a classic SQL injection vulnerability," he said, adding that the security lapse could easily have been caught with a simple code review.

The incident could have been avoided, according to Lee, by using some form of automated analysis during the release procedure for the website.

"The sad thing is that vulnerabilities like these indicate to attackers that other related applications and organisations are probably vulnerable as well," he said.

In this case, anyone with a basic knowledge of SQL programming could interpret the URL and other data returned by the Oklahoma site.

By the simple process of amending the long URLs returned by the site, they could retrieve tens of thousands of social security numbers and allied data.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

First npm worm "Shai-Hulud" released in supply chain attack

First npm worm "Shai-Hulud" released in supply chain attack

"VoidProxy" PhishKit targets Google and Microsoft users

"VoidProxy" PhishKit targets Google and Microsoft users

Apple adds "mercenary spyware" protection to new A19 chip

Apple adds "mercenary spyware" protection to new A19 chip

Phishing attack nets enormous npm supply chain compromise

Phishing attack nets enormous npm supply chain compromise

Log In

  |  Forgot your password?