Add to del.icio.us     Digg this

Jun. 11, 2009

Regarding the posting of a potential security breach on insecure.org a few days ago, T-Mobile USA says it has found no evidence of any security hole, contradicting hackers’ claims to have successfully accessed the company’s servers, compromising some extremely critical data.

The wireless carrier also added that it was conducting a full-scale investigation into the matter and found no evidence that customer information or other company information has been compromised.

But T-Mobile also said it was taking precautionary measures to protect its systems and customer information.

On the evening of June 6, hackers posted a long list of T-Mobile server names on insecure.org, claiming “we have everything, their databases, confidential documents, scripts and programs from their servers, financial documents from 2006 up to 2009.”

The hackers also claimed T-Mobile’s competitors weren’t interested in buying the data and it was now being offered to the highest bidder.

Although T-Mobile could not be reached for comment about the veracity of server names by press time, the company previously said it had identified the document from which information was copied, and believed “possession of this alone is not enough to cause harm to our customers.”

Some disagree.

Although the string of code appears to be from an old system, Mike Logan, president of data security and consulting firm Axis Technology, said the break-in is a “wake-up call” for wireless carriers, stressing that T-Mobile isn't the only carrier at risk for potential security breaches.

Logan added that sensitive personal information such as social security numbers and birth dates carried in some older IT systems and legacy databases are a prime target for hackers.

“While thieves are no longer stealing data to use it for themselves, they're selling it to organized crime rings. At a dollar a record multiplied by a million plus records, that's quite a good day for a hacker,” Logan said.

“Additional details are emerging today that suggest the breach was made possible by insecure legacy systems. Wireless carriers and telcos have multiple types of legacy systems that are difficult to secure properly. Companies feel that they are safe if they upgrade and secure some new areas, but it’s okay to leave the others as is," said Logan.

"And since data is at rest on most of these older systems, they feel it's not a target for thieves anymore. I totally disagree with that mode of thinking and that is precidely where they can really get into trouble in terms of data security,” commented Logan.

Add to del.icio.us     Digg this

    This article was featured on Business 5.0 and on Tech Blog.

Source: insecure.org.