US security blunder exposes residents' data

By

The names, addresses and social security numbers of tens of thousands of Oklahoma residents were exposed to the general public for a period of at least three years.


The information was made available via a badly coded page linked to Oklahoma's Department of Corrections Sexual and Violent Offender Registry.

Anyone with a basic knowledge of SQL could view the list of sexual offenders, and query the database to bring up a host of other information on the residents.

Fredrick Lee, a software security researcher at Fortify Software, said that the problem was down to poor coding.

"This is a classic SQL injection vulnerability," he said, adding that the security lapse could easily have been caught with a simple code review.

The incident could have been avoided, according to Lee, by using some form of automated analysis during the release procedure for the website.

"The sad thing is that vulnerabilities like these indicate to attackers that other related applications and organisations are probably vulnerable as well," he said.

In this case, anyone with a basic knowledge of SQL programming could interpret the URL and other data returned by the Oklahoma site.

By the simple process of amending the long URLs returned by the site, they could retrieve tens of thousands of social security numbers and allied data.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?