
Time to update those passwords, guys
According to a statement released by Gannett and posted
on militarytimes.com, the attack took place on June 7, and resulted in the
compromise of personal subscriber information such as "first and last name,
userID, password, email address, the internal number we assigned to the
account, and, if provided, ZIP code, duty status, paygrade, and branch of
service."
Hackers, who have never been shy about taking their shots at
Pentagon-controlled computer systems, apparently decided to gain personal
information of service members not by targeting military servers but rather the
servers of sites members are known to frequent. Sites targeted in the attack
include DefenseNews, the Military Times, the Federal Times, the Army Times, the
Intelligence, Surveillance and Reconnaissance Journal, the Armed Forces
Journal, the Navy Times, the Air Force Times, the Marine Corps Times. When looking at that list one doesn't have to think too hard about the intended victims of such an attack.
In their statement Gannett says that they are currently
investigating the attack via an "outside computer forensics company." The
company also urges effected users to "to take this opportunity to reset or
strengthen your passwords" on accounts that may have been compromised.
While this attack may ultimately yield little in the way of
actual damage to the service members who were victims, the fact that such
sensitive government information like duty status and paygrade were stored on
privately run servers which were then compromised surely raises some serious
concerns.
As more and more government agencies are looking towards
cloud computing and other private ventures as a means of storing sensitive
material, the Gannett attack serves as a reminder that "security" on the
internet is a relative concept at best.