Print
Discuss
Send to friend
RSS feedsThe names, addresses and social security numbers of tens of thousands of Oklahoma residents were exposed to the general public for a period of at least three years.
The information was made available via a badly coded page linked to Oklahoma's Department of Corrections Sexual and Violent Offender Registry.
Anyone with a basic knowledge of SQL could view the list of sexual offenders, and query the database to bring up a host of other information on the residents.
Fredrick Lee, a software security researcher at Fortify Software, said that the problem was down to poor coding.
"This is a classic SQL injection vulnerability," he said, adding that the security lapse could easily have been caught with a simple code review.
The incident could have been avoided, according to Lee, by using some form of automated analysis during the release procedure for the website.
"The sad thing is that vulnerabilities like these indicate to attackers that other related applications and organisations are probably vulnerable as well," he said.
In this case, anyone with a basic knowledge of SQL programming could interpret the URL and other data returned by the Oklahoma site.
By the simple process of amending the long URLs returned by the site, they could retrieve tens of thousands of social security numbers and allied data.
See also:
UK organisations need to face up to £1.5bn ID fraud problem 22 Apr 2008
It's the only way they'll listen to us, say security experts 08 Apr 2008All Enterprise Security TechnologyTags: Data Loss, Security
del.icio.us
Digg this
reddit!
