A Reply All to a daily news roundup emailed by the U.S. Department of Homeland Security was sent to around 7,500 people which overwhelmed government and business mail servers with over 2 million messages today.
Marcus Sachs, the director of the SANS Institute's Internet Storm Center (ISC), discovered that the DHS was not using a mail list manager, or listserv, such as the open-source Mailman or the free Majordomo, but instead was transmitting the daily report from an e-mail address on a Lotus Domino Release 7.0.2FP1 server hosted by a government contractor.
You can't imagine who would like to have access to American confidential information.
The disclosure issue is illustrated painfully when email recipients received this message: "Subject: Is this being a joke? why are so many messages today? Amir Ferdosi Sazeman-e Sana'et-e Defa' Qom Iran" In a follow-up message, Ferdosi identified himself as a researcher with Iran's Ministry of Defense.
The DHS snafu revealed sensitive contact data to `undesirables.'
Now all that needs to be done is for some nefarious ne'er do well to send a zero-day PDF or Word attachment to the names now available and blast gullible security professionals.
Hackers, phishers and other cybercriminals could not have done any better than revealing the kind of information that was disclosed by the DHS list.
Posts
