Report Finds IRS Computer Security Flaws

[HardOCP News]

When a normal website has security flaws, we point and laugh…the joke is on them. When the IRS has security flaws, there is no pointing, no laughing, if something happens the joke is on all of us.

Treasury watchdogs said Monday that poor controls over IRS computers could allow a disgruntled employee, agency contractor or outside hacker to steal taxpayers' confidential information. Indeed, a hacker might even "gain full control of the IRS network," said a report Monday from the office of the Treasury Inspector General for Tax Administration.

 

[mpsmith]

A lot of this stuff seems kind of nit-picky to me. Much of this lacks real context:

In addition, system administrations circumvented authentication controls by setting up 34 unauthorized accounts that appeared to be shared-use accounts, the report found. During the fiscal 2007, some 4.4 million of the 5.2 million accesses to the control system were made by these 34 user accounts.

Those are pretty obviously service accounts that perform some kind of scripted task. They make it sound like half the the IRS shares a few admin accounts. Also:

A review found that the IRS had authorized 374 accounts for employees and contractors that could be used to perform system administration duties. But of those, 141 either had expired authorizations or had never been properly authorized.

It doesn't state what "authorization" involves, but it sounds like those are just admin accounts that were either automatically expired after a certain period (which is GOOD practice, although they should be deleted after a while) or simply had not been used yet. The accounts would have to be re-enabled by an administrator before they could be used. This hardly seems like a major security hole like this article makes it sound.

Despite the findings and proposed solutions, I'd imagine that about 80% of the described situation will be there for the imaginable future.

 

[Exavior]

This really isn't news. We already knew the IRS sucked at security. Not sure if they did it last year or not, but I think it was 05 and 06 when they had somebody from outside the IRS call from a public number that came up on the caller ID as if it was somebody calling from their house and say that his name was something like John Smith and he was a new system admin. They were having trouble with the server and he needed to rebuild the user database so he needed the person to give him their username and password for the system. The first time I think it was something like 85% of the people that actually gave him their info. The second year it was down to about 65% or something like that. Either way they had no trouble telling some random person that called their username and password for logging into the system.

 

[Fharakin]

Social Engineering FTW!

 

[wiseoracle]

Social Engineering FTW!

NO!