{"id":24814,"date":"2022-12-20T18:36:00","date_gmt":"2022-12-20T18:36:00","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/20\/fbi-private-sector-cyberthreat-reporting-database-hacked-by-apparently-unreported-cyberthreat\/"},"modified":"2022-12-20T18:36:00","modified_gmt":"2022-12-20T18:36:00","slug":"fbi-private-sector-cyberthreat-reporting-database-hacked-by-apparently-unreported-cyberthreat","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/20\/fbi-private-sector-cyberthreat-reporting-database-hacked-by-apparently-unreported-cyberthreat\/","title":{"rendered":"FBI Private Sector Cyberthreat Reporting Database Hacked By Apparently Unreported Cyberthreat"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

from the target-rich-environment-unsurprisingly-targeted<\/i> dept<\/h3>\n

Is this irony? It kind of seems like it is. Maybe it isn\u2019t. It could just be a coincidence. An extremely unfortunate, ironic coincidence.<\/p>\n

Whatever it is, it doesn\u2019t look good for the FBI, which encouraged pretty much every private company to register as reporting entities so the FBI could (theoretically, it appears) respond to reported security threats.<\/p>\n

The FBI wants to be part of the cyber Pearl Harbor<\/a> discussion. Here\u2019s its latest contribution to that conversation, as first reported by Brian Krebs<\/a>.<\/p>\n

\n

InfraGard, a program run by the\u00a0U.S. Federal Bureau of Investigation\u00a0(FBI) to build cyber and physical threat information sharing partnerships with the private sector, this week saw its database of contact information on more than 80,000 members go up for sale on an English-language cybercrime forum. Meanwhile, the hackers responsible are communicating directly with members through the InfraGard portal online \u2014 using a new account under the assumed identity of a financial industry CEO that was vetted by the FBI itself.<\/em><\/p>\n<\/blockquote>\n

Trust, but don\u2019t even bother verifying, I guess. That\u2019s how they \u2014 and by \u201cthey,\u201d I mean the hacker referring to themselves as \u201cUSDoD\u201d \u2014 get you. A portal for private companies to report threats has been compromised using nothing more than credentials that have likely been floating around the web (dark or otherwise) for some time now. <\/p>\n

\n

USDoD said they gained access to the FBI\u2019s InfraGard system by applying for a new account using the name, Social Security Number, date of birth\u00a0 and other personal details of a chief executive officer at a company that was highly likely to be granted InfraGard membership<\/em>.<\/p>\n

The CEO in question \u2014 currently the head of a major U.S. financial corporation that has a direct impact on the creditworthiness of most Americans \u2014 told KrebsOnSecurity they were never contacted by the FBI seeking to vet an InfraGard application.<\/em><\/p>\n<\/blockquote>\n

With access obtained, the breach began. USDoD \u201casked a friend\u201d to create a script that would pull all available user data from the database, which apparently had no defensive methods in place to thwart the script, or any siloing in place to ensure one user\u2019s approved access wouldn\u2019t allow them to obtain other users\u2019 information.<\/p>\n

In an effort to increase collaboration between private sector contributors (if not the FBI itself, although there doesn\u2019t appear to be any actual FBI data\/communications included in the hacking haul), InfraGard acted as a quasi-social media hub to allow private companies to share info with each other. That connectivity apparently contributed to the easy exfiltration of data, albeit data of disputable value.<\/p>\n

\n

USDoD acknowledged that their $50,000 asking price for the InfraGard database may be a tad high, given that it is a fairly basic list of people who are already very security-conscious. Also, only about half of the user accounts contain an email address, and most of the other database fields \u2014 like Social Security Number and Date of Birth \u2014 are completely empty.<\/em><\/p>\n<\/blockquote>\n

While the eventual sale of this data will put USDoD in the black, the ultimate end game may not be the easily-absconded-with user data. The hacker is taking full advantage of this impersonation to contact private sector participants in hopes of securing additional data and\/or credentials usable for bigger and better data heists.<\/p>\n

The FBI has responded to these reports with a no comment. <\/p>\n

\n

\u201cThis is an ongoing situation, and we are not able to provide any additional information at this time,\u201d the FBI said in a written statement.<\/em><\/p>\n<\/blockquote>\n

It\u2019s a shame the FBI wasn\u2019t aware of this before being contacted by people who don\u2019t work for the FBI. If the agency wants the private sector to trust it with its threat reports and data, it needs to be ahead of things like this, rather than simply refusing to talk about incidents it should have been more proactive about. <\/p>\n

But spending tax dollars on \u201ccyber security furniture<\/a>\u201d only buys so much competence. While it\u2019s essential private sector contributors are able to share information easily with each other, a breach like this will only encourage them to cut the FBI out of the loop. There are obviously more secure channels for communication about these issues. Allowing a hacker to make off with critical data suggests the FBI is not only failing to fully vet contributors to its cyber security marketplace of ideas, but failing to ensure the private companies it hires to provide solutions are capable of meeting the demands of the job. <\/p>\n

\nFiled Under: cyberthreat reportingg<\/a>, fbi<\/a>, hacker<\/a>, infragard<\/a>
\n<\/p>\n<\/div>\n