8 ms·

900 social insurance numbers stolen from Revenue Canada via Heartbleed

119 points by rpledge 13y ago

stygiansonic 13y ago
Oops, I submitted a duplicate of this. (Upvoted yours) Vulnerability was disclosed on Monday, April 7th. CRA website was shutdown on Wednesday, April 9th. Didn't take long for the baddies to take PoCs and point them at vulnerable sites. Any other high-value sites that took more than a day to patch should take this as a warning.
PeterWhittaker 13y ago
tl;dr: "We are currently going through the painstaking process of analyzing other fragments of data, some that may relate to businesses, that were also removed." The agency says those affected will be contacted via registered letters, and that any attempts to contact a taxpayer via email or telephone are fraudulent.
- deleted 13y ago
  [deleted]
personZ 13y ago
How would they know this? Presumably they would have to log the entirety of IP communications with their services.
- loceng 13y ago
  You'd imagine that this is probably a place that you'd want to track all communications.
- tacoman 13y ago
  They were likely doing full packet capture and in my experience it's not as rare or difficult are you might think. At my place of employment we're doing it on much more mundane and less sensitive services with up to 4 weeks of buffer in some places. Even at a previous job back in the late 90's we were doing full pcap of our gov't department's T1 to the internet. Products from companies like Netscout and VSS make this pretty straightforward.
  - personZ 13y ago
    The rareness assumption comes about given that the general response to the exploit is a complete blindness to the possibility that it was exploited before it gained public awareness: There seems to be a complete lack of ability by almost all players to "go back in time" and detect exploits. I imagine a government agency, particularly dealing with revenue, might be a primary user of such a tool, though.
- 3pt14159 13y ago
  The CRA is the most competent organization in all of Canada, public or private. They probably log every packet. Worst case scenario they are looking into streams of suspicious behavior, like Russian IPs attempting to validate the SINs somewhere else, like at a bank.
  - tlrobinson 13y ago
    General question: the leaked data in the heartbeat packets is encrypted, correct? If the service doesn't use perfect forward secrecy they would definitely be able to decrypt those packets to see what was leaked. What if they did use PFS?
    - 3pt14159 13y ago
      That is a really good question! I would only be guessing at whether or not they have PFS or not. On the one hand, it leaves the past vulnerable in case a breach happened, but on the other it makes diagnosing what much harder in cases like this.
      - tlrobinson 13y ago
        Actually now I'm not sure if heartbeats are encrypted: "It is irrelevant whether your system can even support some of the cipher suites in the list, because the Heartbeat request that triggers the vulnerability is sent before any encryption takes place." http://www.hut3.net/blog/cns---networks-security/2014/04/14/bugs-in-heartbleed-detection-scripts- http://www.hut3.net/blog/cns---networks-security/2014/04/14/...
        3pt14159 13y ago
        Interesting. So this leads me to believe that they do record every packet.
    - mschuster91 13y ago
      Easy: check the access logs for all those people who logged in in a given timeframe and assume these are pwnd.
- cones688 13y ago
  Most enterprise security tools could pick this up the night it became a CVE, or IBM QRadar could.... http://securityintelligence.com/heartbleed-vulnerability-security-intelligence-tool/ http://securityintelligence.com/heartbleed-vulnerability-sec...
- deleted 13y ago
  [deleted]
- richardlblair 13y ago
  I have had friends who work at the CRA. Apparently they are pretty good at monitoring activity. For instance, one guy looked up the information attached to his SIN. Something like an hour later RCMP showed up, and escorted the fellow out of the building.
  - tomcorrigan 13y ago
    If they were that good they would have patched heartbleed a lot sooner.
    - igrekel 13y ago
      Actually they did close the web services quite early. It is likely they are not the only ones with a similar problem, only they did notice the bug was being exploited and did act and communicate on it. And you don't really expect them to blindly patch things right away do you?
- dobbsbob 13y ago
  I'm going to assume they calculated this by simply counting the amounts of returns filed/logins done during the time the exploit was announced to being patched and wrote them off as compromised. Maybe the Canadian government should walk down to the CSEC offices and ask them hey can you guys stop conspiring with the rest of the 5 Eyes Alliance to sabotage IETF standards
scrabble 13y ago
I wonder if the data was stolen after or before the vulnerability was disclosed. On the other side of it, I think it's really great that they've been able to determine exactly what was stolen from this so that they can attempt to repair any damages.
jwr 13y ago
How can you steal a number? Here's a number: 147334572. Have I stolen it? This is yet another alarming signal that the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. We need to work on fixing this. At the very least, we should stop talking about "stolen numbers". And even if the breach in question resulted in attackers gaining access to names + numbers (unclear from the article), it should not cause any serious consequences.
- rlpb 13y ago
  > How can you steal a number? The same way someone might "steal" your password. All data can be encoded as a number. > the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. I don't disagree, but "how can you steal a number?" isn't a valid argument for your assertion.
- yukichan 13y ago
  > This is yet another alarming signal that the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. Secret information is required for practical authentication. Some examples: Private keys (ssh, gpg, SSL/TLS certs, bitcoin wallets) passwords session ids api secrets auth tokens
  - jwr 13y ago
    I believe you don't often write down your private keys, passwords, api secrets or auth tokens on paper forms that you then submit to various institutions you have no control over, right? As a comparison, your SSN is used all over the place, you will need to disclose it regularly (rent an apartment and your landlord is likely to request a credit check, you'll give him your SSN). A number of people and institutions will have access to it. It is not a secret. It should not be used for authentication and no one should assume it somehow secret, because it is not.
- leoedin 13y ago
  I agree that the short and commonly used numbers that are often considered to be proof of ID are no longer suitable. When a computer can easily guess every possible combination of numbers in a set in seconds, it's not really sensible to use it for validation. However, even if we all had a unique 4096 bit private key with which we identified ourselves, it would still essentially be a number and it would certainly be able to be stolen. Stealing a number is more or less the same as stealing a private key or stealing a classified electronic document - it's the unauthorised access and copying of information. Society has broadly come to accept that this is considered stealing.
Pxtl 13y ago
Wonderful timing that this vulnerability popped up smack in the middle of tax time, eh?
neil_s 13y ago
Is this the only reported case of malicious use of Heartbleed so far? (Besides US government agencies allegedly) If so, is it safe to say that this crisis was dealt with rather well? Or is it just too early to know how many sites were actually attacked?
- brandon272 13y ago
  It seems that a typical website doesn't have the capability to know if the exploit was used against them, unless they are logging and able to analyze all IP communications to and from their servers.
increment_i 13y ago
Considering the significance of the vulnerability, the only thing I can say is the government is extremely lucky that the number is only 900. For Canadians, SIN numbers are about as critical as it gets.
scosman 13y ago
For those who don't know, SIN = social insurance number. Similar to US SSN.
- hackbinary 13y ago
  Or the UK NIN / National Insurance Number.
- redspark 13y ago
  I was about to make a call to Jesus, and see how this could happen.
JoeAltmaier 13y ago
Presumably the numbers were stolen along with associated identity information. The numbers can be easily guessed; they are created with a simple algorithm.
godgod 13y ago
900? That's small time. The NSA has been stealing creds for years.

119 points by rpledge 13y ago

Oops, I submitted a duplicate of this. (Upvoted yours) Vulnerability was disclosed on Monday, April 7th. CRA website was shutdown on Wednesday, April 9th. Didn't take long for the baddies to take PoCs and point them at vulnerable sites. Any other high-value sites that took more than a day to patch should take this as a warning.

PeterWhittaker 13y ago

tl;dr: "We are currently going through the painstaking process of analyzing other fragments of data, some that may relate to businesses, that were also removed." The agency says those affected will be contacted via registered letters, and that any attempts to contact a taxpayer via email or telephone are fraudulent.

deleted 13y ago
[deleted]

personZ 13y ago

How would they know this? Presumably they would have to log the entirety of IP communications with their services.

loceng 13y ago
You'd imagine that this is probably a place that you'd want to track all communications.
tacoman 13y ago
They were likely doing full packet capture and in my experience it's not as rare or difficult are you might think. At my place of employment we're doing it on much more mundane and less sensitive services with up to 4 weeks of buffer in some places. Even at a previous job back in the late 90's we were doing full pcap of our gov't department's T1 to the internet. Products from companies like Netscout and VSS make this pretty straightforward.
- personZ 13y ago
  The rareness assumption comes about given that the general response to the exploit is a complete blindness to the possibility that it was exploited before it gained public awareness: There seems to be a complete lack of ability by almost all players to "go back in time" and detect exploits. I imagine a government agency, particularly dealing with revenue, might be a primary user of such a tool, though.
3pt14159 13y ago
The CRA is the most competent organization in all of Canada, public or private. They probably log every packet. Worst case scenario they are looking into streams of suspicious behavior, like Russian IPs attempting to validate the SINs somewhere else, like at a bank.
- tlrobinson 13y ago
  General question: the leaked data in the heartbeat packets is encrypted, correct? If the service doesn't use perfect forward secrecy they would definitely be able to decrypt those packets to see what was leaked. What if they did use PFS?
  - 3pt14159 13y ago
    That is a really good question! I would only be guessing at whether or not they have PFS or not. On the one hand, it leaves the past vulnerable in case a breach happened, but on the other it makes diagnosing what much harder in cases like this.
    - tlrobinson 13y ago
      Actually now I'm not sure if heartbeats are encrypted: "It is irrelevant whether your system can even support some of the cipher suites in the list, because the Heartbeat request that triggers the vulnerability is sent before any encryption takes place." http://www.hut3.net/blog/cns---networks-security/2014/04/14/bugs-in-heartbleed-detection-scripts- http://www.hut3.net/blog/cns---networks-security/2014/04/14/...
      - 3pt14159 13y ago
        Interesting. So this leads me to believe that they do record every packet.
  - mschuster91 13y ago
    Easy: check the access logs for all those people who logged in in a given timeframe and assume these are pwnd.
cones688 13y ago
Most enterprise security tools could pick this up the night it became a CVE, or IBM QRadar could.... http://securityintelligence.com/heartbleed-vulnerability-security-intelligence-tool/ http://securityintelligence.com/heartbleed-vulnerability-sec...
deleted 13y ago
[deleted]
richardlblair 13y ago
I have had friends who work at the CRA. Apparently they are pretty good at monitoring activity. For instance, one guy looked up the information attached to his SIN. Something like an hour later RCMP showed up, and escorted the fellow out of the building.
- tomcorrigan 13y ago
  If they were that good they would have patched heartbleed a lot sooner.
  - igrekel 13y ago
    Actually they did close the web services quite early. It is likely they are not the only ones with a similar problem, only they did notice the bug was being exploited and did act and communicate on it. And you don't really expect them to blindly patch things right away do you?
dobbsbob 13y ago
I'm going to assume they calculated this by simply counting the amounts of returns filed/logins done during the time the exploit was announced to being patched and wrote them off as compromised. Maybe the Canadian government should walk down to the CSEC offices and ask them hey can you guys stop conspiring with the rest of the 5 Eyes Alliance to sabotage IETF standards

scrabble 13y ago

I wonder if the data was stolen after or before the vulnerability was disclosed. On the other side of it, I think it's really great that they've been able to determine exactly what was stolen from this so that they can attempt to repair any damages.

jwr 13y ago

How can you steal a number? Here's a number: 147334572. Have I stolen it? This is yet another alarming signal that the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. We need to work on fixing this. At the very least, we should stop talking about "stolen numbers". And even if the breach in question resulted in attackers gaining access to names + numbers (unclear from the article), it should not cause any serious consequences.

rlpb 13y ago
> How can you steal a number? The same way someone might "steal" your password. All data can be encoded as a number. > the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. I don't disagree, but "how can you steal a number?" isn't a valid argument for your assertion.
yukichan 13y ago
> This is yet another alarming signal that the whole idea that your SSN/SIN or credit card number is somehow secret and can be used for authentication is flawed. Secret information is required for practical authentication. Some examples: Private keys (ssh, gpg, SSL/TLS certs, bitcoin wallets) passwords session ids api secrets auth tokens
- jwr 13y ago
  I believe you don't often write down your private keys, passwords, api secrets or auth tokens on paper forms that you then submit to various institutions you have no control over, right? As a comparison, your SSN is used all over the place, you will need to disclose it regularly (rent an apartment and your landlord is likely to request a credit check, you'll give him your SSN). A number of people and institutions will have access to it. It is not a secret. It should not be used for authentication and no one should assume it somehow secret, because it is not.
leoedin 13y ago
I agree that the short and commonly used numbers that are often considered to be proof of ID are no longer suitable. When a computer can easily guess every possible combination of numbers in a set in seconds, it's not really sensible to use it for validation. However, even if we all had a unique 4096 bit private key with which we identified ourselves, it would still essentially be a number and it would certainly be able to be stolen. Stealing a number is more or less the same as stealing a private key or stealing a classified electronic document - it's the unauthorised access and copying of information. Society has broadly come to accept that this is considered stealing.

Pxtl 13y ago

Wonderful timing that this vulnerability popped up smack in the middle of tax time, eh?

neil_s 13y ago

Is this the only reported case of malicious use of Heartbleed so far? (Besides US government agencies allegedly) If so, is it safe to say that this crisis was dealt with rather well? Or is it just too early to know how many sites were actually attacked?

brandon272 13y ago
It seems that a typical website doesn't have the capability to know if the exploit was used against them, unless they are logging and able to analyze all IP communications to and from their servers.

increment_i 13y ago

Considering the significance of the vulnerability, the only thing I can say is the government is extremely lucky that the number is only 900. For Canadians, SIN numbers are about as critical as it gets.

scosman 13y ago

For those who don't know, SIN = social insurance number. Similar to US SSN.

hackbinary 13y ago
Or the UK NIN / National Insurance Number.
redspark 13y ago
I was about to make a call to Jesus, and see how this could happen.

JoeAltmaier 13y ago

Presumably the numbers were stolen along with associated identity information. The numbers can be easily guessed; they are created with a simple algorithm.

godgod 13y ago

900? That's small time. The NSA has been stealing creds for years.