Every Louisiana driver's license holder exposed in cyberattack

https://www.theguardian.com/us-news/2023/jun/16/louisiana-drivers-license-hack-cyber-attack

by anigbrowl • 3 years ago

215 103 3 years ago

theguardian.com

briffle• 3 years ago

Oregon too:

https://www.oregonlive.com/commuting/2023/06/massive-hack-of...

jmclnx• 3 years ago

Lets hope these States and others that may be keeping these MOVEit breaches hidden issues new Licenses for free.

My State use to use your SSN for its License ID, but they changed moved away from that over 20 years ago. Glad they did. BTW, as noted Oregon too, I am sure there are others.

Glad we are all on Real ID, that sure helped out the Russians a lot. But Real ID did nothing useful for me.

edit: spelling

no_wizard2• 3 years ago

What should someone do? I can't imagine for many people this isn't the first, and certainly won't be the last time this happens.

Should we just default freeze our credit? Is it time to finally get some ID monitoring service w/ insurance?

ceejayoz• 3 years ago

Give up. Assume your driver's license and SSN are compromised. Everyone's either is already or will be soon.

jen20• 3 years ago

"Giving up" is not really an option until it is illegal with substantial penalties to use these trivially discoverable reference numbers for anything.

midasuni4• 3 years ago

My UK equivalent (NI number), and usual things like DoB, Address etc leaked a couple of weeks ago thanks to my company outsourcing to layers of companies who seem to have transferred PI by sending to pastebin or something. (Same moveit thing)

My company just cries “it’s not our fault” when it clearly is. The larger problem here is that this bit of unchangale data can be used not just to open lines of credit but do things like take student loans out.

Those loans are then automatically deducted from your salary and they won’t stop doing that even after you flag it. a private company can steal money from you after they cock up.

no_wizard2• 3 years ago

I do assume this, but I'm checking with the wider community here, how do you insulate the negative affects?

Monitoring + insurance? We did the freeze, but is that sufficient enough?

Seems like I'm gonna have to get some kind of insurance + monitoring in case something goes really south, no?

EvanAnderson• 3 years ago

I can give up. Since so many third-parties continue to act as if these are "secret" (relying on them for "authentication") giving up does me no good.

I guess I can try to avoid doing business with companies who insist on using these "secrets". Sometimes I don't have a choice, though.

It would be wonderful to have ubiquitous PKI for every citizen in the United States. I don't trust private companies to do it. A large segment of the electorate would never trust the government to do it. (I like the idea of the USPS leveraging their tremendous physical presence and delivery infrastructure to do it, personally, but I think that would meet about the same level of opposition as the government doing it.)

I guess we'll just continue with this ridiculous charade of "secret" numbers, the silly idea of "identity theft", and most of the consequences applying to the individual.

2023throwawayy• 3 years ago

You should have frozen your credit after the breeches of the credit agencies in years past.

bombcar2• 3 years ago

The law needs to be changed so that loans can be unpaid with no penalties if there is no signed and notarized proof it was you.

That'll fix it real fast.

phpisthebest• 3 years ago

100%...

The entire premise of "identity theft" is backwards. No one stole my identity, no they committed fraud against the bank.

In any other context fraud costs are born by the victim of the fraud, i.e it should be the bank. Only in "identity theft" do we allow a 3rd party of the fraud to be liable for the damages.

I am not sure how that even happened

flangola7• 3 years ago

Will this make fake IDs more viable?

seanw4442• 3 years ago

Thank goodness for the government requiring ID for everything. There wouldn't be anything with life-altering consequences to leak.

landemva• 3 years ago

Thinking of my interactions with government, I can't recall when government last required me to show ID.

Showing ID for TSA is voluntary, like their full body scans. I can file court cases without ID. I can quit claim (transfer) land without ID.

seanw4442• 3 years ago

You need ID to purchase alcohol and firearms, drive, police are obnoxious about asking for ID in any situation even if it's an unconstitutional request (that most people don't have the resources or even knowledge to deny/fight).

buildbot2• 3 years ago

Something I have not seen mentioned much is Qualys affected by this hack - leaking vulnerability scans on over 19000 companies.

Edit - I was wrong and that happened in 2021 by the same group.

mdaniel• 3 years ago

Well, even in your "mention" there is no "mention" of your sourcing for this claim. Because they published a write up for the actual vuln, a simple web search does not cough up any such reports

buildbot2• 3 years ago

I think I may he conflating an early hack of them, which is my bad: https://www.cybersecurity-insiders.com/major-cyber-attack-on...

There was not date and given it was the same group, I made a bad assumption.

midasuni4• 3 years ago

My company used to use move it but got rid of it in 2017 because of security concerns. Allas our crappy outsourced Hr company didn’t.

My understanding of this attack is that the company

1) didn’t have IP access controls to limit machines that can talk to the moveit manager

2) didn’t have SSL client certificates to prevent a machine from connecting without a valid certificate

Now a sql injection really isn’t good, it’s not hard to protect against, both by sanitising inputs and using prepared statements, but that’s why we have defence in depth

ronsor2• 3 years ago

To be fair, does any company know how to use SSL client certificates? I rarely ever see them used, especially compared to IP access controls.

tru3_power• 3 years ago

It’s also not consistently an option on all enterprise software from what I’ve seen

midasuni4• 3 years ago

My company certainly does. We use signiant to shift large files around, api is bound on a non routed network segment client certificate proxy to reach it.

Which is what makes it even more annoying when someone decides “oh I can save a few bob by giving our employees private information to the lowest bidder as the cost won’t fall on my departments budget”

KirillPanov• 3 years ago

Gemini uses them extensively; it's the only mechanism for authentication and cookie-like behavior:

https://gemini.circumlunar.space/docs/specification.gmi

LargeDiggerNick• 3 years ago

Unbelieveable

selimthegrim2• 3 years ago

Well that explains why my address was changed to an old out-of-state one at my credit agency and I had to change it back

DemiGuru• 3 years ago

I strongly recommend that you freeze your credit. It’s not the end all be all but it’s a good way to keep entities from applying for loans, credit cards or open accounts in your name. I don’t know what is the equivalent measure one can take outside of the US.

pjot• 3 years ago

I’m currently going through process of freezing my credit. The real kicker here is all three bureaus freeze processing services are down… Imagine that

shortcake272• 3 years ago

I don’t know about other countries, but freezing credit in Australia doesn’t really work.

To freeze your credit, you first have to produce your ID to companies such as Equifax which have been responsible for many data leaks. So you’re putting yourself at additional risk.

Secondly, anyone with a copy of your ID can just unfreeze your credit. So it’s basically useless.

BenjiWiebe• 3 years ago

Can they? I have to use a password, but I guess I've never tried the "forgot password" option.

As far as giving my ID to Equifax; they already have my details whether I give it to them or not.

xyst• 3 years ago

In my opinion, freezing your credit is more of a nuclear option. It’s a bit of a pain to unfreeze your credit for valid credit applications or simple credit limit increase requests.

Also I think freezing also prevents soft credit pulls so automatic credit limit increases won’t be given or add an extra hassle of “unfreezing” to get the increase.

What I do is use those “free” credit monitoring services (ie, credit karma, credit sesame) and monitoring provided by some of my credit cards to get full coverage across all credit bureaus.

If any unrecognized application for credit comes through using my information, then I will immediately get notifications.

Otherwise, I just continue as normal. Request CLIs for my current cards and grow my available credit.

toast0• 3 years ago

It is a giant pain. But freezing doesn't seem to prevent soft pulls, at least, I still see them on my reports.

However, in the past month, despite having frozen credit, someone managed to get a BofA checking account opened enough that I got emails about it, and had to spend a ton of time trying to get to the fraud department (I do have BofA credit cards, which I guess I should have gone through to get to fraud). They had already denied it, but sent me emails, I guess because of the existing accounts with that social.

Additionally, my spouse recently got a Square debit card mailed to her, in the (inaccurate) name of a local business. Again, very difficult to get ahold of the fraud department. Of course, someone rented a luxury apartment in her name in Oakland a couple years ago, and Oakland PD still hasn't called back, and literally nobody else cares; the management was responsive, but said they weren't even sure that they could evict, given COVID; I just hope the rooftop espresso bar is nice for the fraudster.

xerxesaa• 3 years ago

What exactly is the pain of unfreezing? I was able to do it all online in a couple of minutes on each of the three major credit bureau sites.

mindslight• 3 years ago

Why should I do a bunch of work jumping through corporate hoops, including having to assent to a heap of unconscionable legalese bullshit and whatnot, to help these organizations and their conspirators to not libel and attempt to defraud me?

I protect myself per what's legally obligated. For established accounts, that means checking transactions within the regulation E timeframes. For companies that I have no relationship with, that means responding to any notices I actually receive that falsely claim I'm doing business with them or the like. Beyond that, it is not my responsibility to help this terrible financial surveillance industry, which wouldn't even exist if it were up to me.

costco• 3 years ago

Don't states already sell this info to private investigators? I guess this breach would include social security numbers but half the country as already had theirs leaked anyways.

https://www.vice.com/en/article/43kxzq/dmvs-selling-data-pri...

StrangeATractor• 3 years ago

This is ridiculous and really only happens because the cost of securing your customer (or citizen) data is higher than the cost of losing control of it. If the cost of losing data to hacks was, say three times higher than the cost estimated to secure it, the problem would become much less common very quickly.

As it is, states and corporations externalize the costs of hacks to the victims of their incompetence. They have no reason to take opsec seriously because they aren't held liable in even the most egrigious cases. Data should be a liability.

nyc_data_geek12• 3 years ago

> Data should be a liability.

This is the crux of it, methinks. "Data is the new oil" has been a common refrain and as long as the externalities of poor security posture hygiene can be completely outsourced while these companies make mountains of cash by monetizing your every scrap of behavior, attention and information, this will only get worse as every entity seeks to hoard more information on you.

Keeping more data than absolutely necessary for critical business operations should be an existential threat for any entity. Those businesses built on this data ought to take Fort Knox level pains to secure it. Anything short of that and we will continue to exist in a society of deteriorating trust and social contract.

ronsor2• 3 years ago

"Data is the new oil"

The common usage of this phrase isn't too inaccurate. Keep in mind what oil does to the environment, not just during spills but even in normal refining!

cco• 3 years ago

A framing I often use is, "Data is like holding uranium". It can be incredibly valuable, but also very dangerous. You should be very sure that the data you're holding is worth the cost of safely protecting it (a high cost), and if it is not, get rid of it.

Stripe is a good mental model here, I don't want a person's credit card data, I want to charge them for my product. I love storing a Stripe customer ID, if a hacker were to grab that table, I wouldn't lose (a lot) of sleep, they couldn't do much with it. If that table held credit card data...I would.

That farms out a lot of responsibility to Stripe, but for a side project, I don't have the time necessary to do as good of a job at it relative to Stripe.

SoftTalker2• 3 years ago

We also need changes so that posession of identifying information is not sufficient to establish identity. That sounds like a tall order but clearly this information is leaking all over the place and just because someone has my identifying numbers and date of birth and mother's maiden name and signature and fingerprints and whatever else, should not be adequate to gain access to bank accounts or execute contracts and other legal agreements.

zoom6628• 3 years ago

Would be good to get a value on this liability onto a company’s balance sheet. This could be done as a value of risk, or a cost of insuring against data exposure (should be govt mandated to have insurance). If Lloyds can insure against weather and piracy then someone should be able to underwrite insurance against data breaches.

jfengel• 3 years ago

The cost benefit calculation also includes the odds of being hacked. Enormous numbers of organizations are at risk but most survive by security by obscurity. Most are content to hope to remain obscure.

Especially since the cost of actual security is very high. You have to build it into every aspect of the system. It makes development cost an order of magnitude more and constrains usability... and you'll still never really be certain

When you take employees into account the cost becomes almost insurmountable. Keeping bank style security means tightly limiting access, making even simple operations more work.

That's not an excuse. That's a warning. We are at grave risk, and we need to completely reconsider how almost every piece of software is written. Competence is hard and expensive.

wmf2• 3 years ago

For government IT in particular, the cost of security is basically infinite because they aren't organizationally mature enough to do anything right. There's no way to make the cost of being hacked infinite; no court or legislature is going to order the DMV to be disbanded.

AnthonyMouse• 3 years ago

In 1995 the California State Police were disbanded and their role was given to the California Highway Patrol.

The part of the DMV that performs driver testing isn't the part that loses all your data. It wouldn't be impossible to disband their IT department and give the role to some other government agency.

They could also just, you know, stop collecting it. Print your height and hair color etc. on your driver's license and don't store it anywhere else. Instead store a hash of it at the DMV with the salt stored on the license itself, so you can revalidate the license without being able to reconstitute it.

dragonwriter2• 3 years ago

There's no way to make the cost of being hacked infinite; no court or legislature is going to order the DMV to be disbanded

Disbanding the DMV doesn’t make the cost to any actor infinite (“DMV” is an abstraction, and state agencies are routinely created amd destroyed, sometimes as political damage control due to IT scandals [0], but that’s not an infinite cost on anyone.)

[0] e.g., the California Department of Information Technology in 2002: https://www.google.com/amp/s/www.computerworld.com/article/2...

vlan0• 3 years ago

State government is tricky. Pay sucks and doesn’t attract a lot of talent. Same with the education sector.

wmf2• 3 years ago

Government IT is outsourced at prices that could pay top salaries (think Palantir). They just don't.

l33t233372• 3 years ago

If the cost of losing data to hacks was, say three times higher than the cost estimated to secure it

I’d estimate that if this happened, the cost to secure data would grow by about a factor of 3.

AndrewKemendo• 3 years ago

Data should be a liability.

Exactly. Mandate financial compensation for any and all value derived from data that an individual creates, whether they opted in or not.

If YC ran banner ads and my comment is viewed on the same page as an ad, then I should receive some significant percentage of that ad revenue. If an ad is targeted to a customer on IG through an ad campaign, based on the user's data, then the user should get a significant percentage of that ad.

That should clear everything up.

badrabbit4• 3 years ago

You have a lot of opinion here but this was a zero day attack. Would love to hear your opinion on how Louisiana could have safeguarded against that.

fsflover4• 3 years ago

On Qubes OS even a zero-day would likely not be sufficient. It relies on hardware virtualization and runs everything in VMs. My daily driver, can't recommend it enough.

malwarebytess• 3 years ago

This is bigger than DMVs.

MoveIT Automation / Transfer are used throughout many sensitive industries, such as banking.

zaroth• 3 years ago

I know nothing about “MOVEit” but somehow I already know that they suck at the teat of government RFPs to the tune of hundreds of millions of dollars, using an awe inspiring host of buzzwords, to deliver a total cesspool of close-sourced software which is somehow entrusted to the most sensitive data the government handles.

And besides, why wouldn’t an unencrypted backup of the entire DMV database for the State or Louisiana be getting tossed around using such a program?

Good grief.

rfrec0n• 3 years ago

From my brief experience working at a similar company, calling the software they use closed-sourced is a bit of a reach. When I worked there, we almost exclusively used rebranded and slightly modified open source/freeware CMS systems. Actually the only software we sold that was completely developed in-house were testing/configuration tools or extremely simple and basically worthless LDAP auth based reporting programs that could only be used on-premise.

Brybry• 3 years ago

Just to note, MOVEit is (was?) used by banks, non-profits, healthcare companies, oil companies, airlines, etc. [1]

So this hit a wide spectrum of services both public and private.

[1] https://techcrunch.com/2023/06/15/moveit-clop-mass-hacks-ban...

raverbashing• 3 years ago

Sounds like the perfect Corporate Crapware.

Progress Software, which develops the MOVEit software, patched the vulnerability — but not before hackers compromised a number of its customers.

nerdchum• 3 years ago

I can just imagine the buzzword filled sales pitch from one MBA with no tech experience to another MBA with no tech experience and them shaking hands afterwards and saying "excited to do business with you"

And they got promoted and now my private info is public and theyll never see an ounce of accountability.

Good old corporate and governmental America.

dopidopHN2• 3 years ago

It’s part of the Louisiana suite of online service. There is Also “HIreIT” for unemployment and some similar catchy names for housing.

They are all peculiar system with weird UX.

kevin_thibedeau• 3 years ago

The thing that irritates me is that New York sells its DMV data to the foreign company operating the private toll highway in Toronto. Giving even less data protection than some Canadian provinces that refuse data sharing.

asynchronous• 3 years ago

To clarify this was a supply chain compromise attack - several states and other governments were hit, not that it excuses blame from Louisiana but if anything is a testament to the issue of centralization.

mike503• 3 years ago

Just happened in Oregon too.

predictabl3• 3 years ago

Hope those in "minimal government" red states are looking forward to their porn-watcher registries eventually leaking. (No, this isn't hyperbole, go look it up)

Edit: no really, enjoy it. Apologies for the AMP link but you know, gotta find something quick for those conservatives here unable to accept the reality they've welcomed. https://www.google.com/amp/s/arstechnica.com/tech-policy/202...

It's already in effect for multiple states. Downvotes alleviate the cognitive dissonance. Go go go !!

velavar2• 3 years ago

Too many finance companies depend on National ID number, date-of-birth and Driver's License numbers to verify the identities of applicants for bank accounts, loans, credit cards etc. At this point, assume that all your personal information is out there. There are some steps you can take to make it a little more secure for yourself. In an ideal world, the fintechs and banks would protect you better, but we do not live in that world.

* If you are in the US, go to one of the credit bureau sites (Transunion/Experian/Equifax) and sign up for a fraud alert. You'll need to provide your current phone number and what this does is this: no fintech/bank is supposed to create an account or issue credit in your name unless they have verified the activity with this phone number.

* If you have previously been a victim of fraud, sign up on one of the aforementioned bureaus for an Extended Fraud Alert.

* Isolate your email tied to your finance accounts from regular email that you give out on website signups, doctors' offices, etc. Only your bank/brokerage needs to know that this email exists

* If you can afford to, pay to track leakage of this information on the dark web or password sharing forums

* Use a password manager

* Use 2FA on all your accounts and use an authenticator app if possible. It's not ideal but it's better than the SMS/email 2FA

* If your telecom provider supports it, ask them about how you can protect yourself from sim-swapping and porting. Add a PIN to your phone provider account if you can.

vkou2• 3 years ago

Wait, why should I take steps to prevent some random asshole defrauding a bank?

I am not the victim, nor a participant in fraud in that situation, the bank is. Maybe they should follow some steps and not give out money to randos that walk in and ask for it?

velavar2• 3 years ago

I get what you mean but sometimes it's really difficult for a bank to tell if it's really you or someone pretending to be you. Funnily enough, if we all "walked in" physically to a bank, it would be much easier for them to tell :). But now, they have to rely on phone numbers and emails and SSNs to tell them if it's really you. They don't have much of a choice - would you have any suggestions on what they could use?

Going to a branch physically is impractical these days - how many of us have even been to a branch that houses our brokerage or 401k accounts for instance? And so many mainstream Fintech apps like Stripe and Robinhood don't even have branches.

sneak• 3 years ago

Because of credit reporting agencies subsequently telling lies about you and affecting your ability to obtain credit in the future.

But you already knew the answer.

roody15• 3 years ago

Too many eggs in the same basket. Why did so many agencies rely on Moveit?

conductr• 3 years ago

Seems like an outsourcing of compliance/security likely to avoid this exact thing

Animats• 3 years ago

What's the big deal? You can buy that data online from the state of Alabama for $5.95 each.[1] Many states have bulk pricing and sell to marketers.[2]

[1] https://www.alea.gov/dps/driver-license/driver-records-crash...

[2] https://www.caranddriver.com/features/a32035408/dmv-selling-...

tyingq• 3 years ago

I would guess the hack included data that's not included in those services. Licenses, for example, often come with an audit/validation number that allows for things like online change of address, useful for identity theft. And probably other data elements that are also sensitive (SSN, etc).

dopidopHN2• 3 years ago

Why does the SSN has to be secret? Is that a legacy thing ? Or maybe a product of not everyone having id ? Would the combo name + DOB + county of birth be equivalent as unique identifier ?

Just trying to get context, I also lived in place where SSN are not a big deal because they are not used to prouve anything

zelse• 3 years ago

The very same Louisiana that insists that age verification on websites is completely safe and reasonable? Shocking. Sadly, probably not the first such breach we'll see, though perhaps the least embarrassing.

selimthegrim2• 3 years ago

The digital drivers license app LA Wallet that can be used to satisfy this has an ownership interest by/connections with the senator who passed that law

jrochkind12• 3 years ago

They didn't mention if the attackers got photos too. If not this time, next time.

I believe the "identification by digital photograph" that is being rolled out at US airports (no longer need to show ID at some security checkpoints) is based on photographs shared by state-level driver's license/id card.

Increased roll-out of facial recognition technology probably increases the value of stealing headshots associated with other identity information.

I believe federal "RealID" requires states to maintain a database of digital photographs from identification documents. I think almost all states do that now.

bfuller• 3 years ago

IRS.gov requires facial recognition to log in. I know because I tried yesterday and it wouldn't accept me (presumably because i had no beard in my ID photo)

CubsFan1060• 3 years ago

I think the “photograph” at airports is more than that. You need to load your id onto your phone, take pictures of yourself, have them reviewed (not sure if this is automated or by a human), and be approved.

After that it’s a combination of your phone/watch plus your photo.

It’s not perfect, but it’s more than just comparing your photo to your drivers license photo.

Edit: looks like there may be a second program that does just what you say: https://www.tsa.gov/biometrics-technology/evaluating-facial-...

This is the program that I am aware of: https://support.apple.com/en-us/HT213329

jrochkind12• 3 years ago

The last time I flew, it was not all lines, but just one "experimental" line, and it was not something I opted in to or signed up for or supplied a photo or anything else for voluntarily -- everyone in this one line (which was just a "standard" line, not tsa-pre or what have you), you didn't have to show ID, you just had to show your boarding pass and then look into a camera until the guy said "good".

Probably that second link you found.

fuzzfactor• 3 years ago

Since when have government agencies been trustworthy anyway?

Every Louisiana driver's license holder exposed in cyberattack

Related Stories