South Carolina Department of Revenue: Mother of Government Dysfunction

INTRODUCTIONNovember 20, 2012: The Public Incident Response Report about the security breach of the Department of Revenue's (DoR) information system was released to the public. The report identified the type of attack, how it was carried out, and the assessment of the known damage. The security breach perpetrated from an unidentified eastern European country and was the largest cyber theft of data ever from a state information system in the United States (Brown, 2012). SPEAR PHISHING ATTACKThe attack began on August 13, 2012 when the Director, Jim Etter, received an email message from someone he did not know that had an attached file. He opened the attachment which activated embedded code. The code surreptitiously installed a malware program on his office workstation, opened a backdoor port, and beaconed to a command and control web site, suspected to be in Eastern Europe or Russia. Then, the malware sent Etter's username and password (a.k.a., user credentials) to the command and control web site, and downloaded and saved several utility programs to his computer.Two weeks later (August 27), the attacker logged into the DoR's remote access service (Citrix) using Etter's credentials and gained access to his workstation, several DoR servers, and databases. Two days later, the attacker installed a previously downloaded utility program to obtain additional usernames and passwords.September 1, the attacker executed the utility program and attempted to obtain all Windows user credentials on six DoR network servers. Additional utilities were installed and a backdoor port established on a network server for later use.The next day, the attacker interacted with twenty-one servers and performed various reconnaissance activities, including logging on to the application server that handles tax payment and account maintenance information. No data was retrieved, copied or damaged during this intrusion.September 3, the attacker accessed eight servers and performed various reconnaissance activities. Again, the attacker accessed the tax payment application server, but did not accomplish anything malicious. September 4 and 11, the attacker accessed six DoR systems and performed more reconnaissance activities.On September 12, the attacker copied database backup files to a staging directory on the database server. Then, over the next two days, database backup files were compressed into 14 of 15 encrypted 7-Zip archive files. Then, the 7-Zip files copied from the database server to a staging server before being uploaded to an undisclosed Web site. Once the upload transmission completed, the backup files and 7-Zip files were deleted from the staging server. On September 15, the attacker interacted with ten DoR systems and performed more reconnaissance activities.October 10, U.S. Secret Service agents notified the Governor and DoR that credentials of three DoR employees and personally identifying information of South Carolina taxpayers were for sale on the Internet. Good credentials to gain access to a government system can fetch as much as $30,000 on the black market (Westervelt, 2011). The Secret Service began monitoring the DoR system and attempted to collect information about the attacker. The next day, a forensics team from Mandiant Corporation, a global information security company that specializes in cybercrime response and forensics, began working with the Secret Service to investigate the scope of the data breach and to contain it.October 17, the attacker checked the connectivity to the staging server using the backdoor installed on September 1. Two days later, the Mandiant forensics team began remediation activities to remove the attacker's access ports (i.e., backdoors) and to detect further attacks. Between October 21 and November 20, there was no evidence of new activity by the attacker.Full implementation of security monitoring began October 20, ten days after the state first learned about the intrusion and the stolen data, and thirty-eight days after the security breach started (Barr, 2012). …