Hackers Issue Bogus Amber Alert

Over the weekend Iowa's Amber Alert and Accident Report websites were hacked through use of offshore computers. Investigators are looking into the attack, but it currently does not look like any sensitive data such as Social Security Numbers were compromised. The attack was not particularly disruptive, and merely re-issued an Alert from February 2009. However, the websites have been down for four days in order to do the investigation. Although the Amber Alert website was down, alerts still could be released through the National Weather Service, the Emergency Alert Service, and the media. The interesting point is that this is not the first time that the Amber Alert website has been attacked. In 2009 they were the victim of a flood of fake Alerts. Representatives refused to comment if other applications from the same service were also attacked, an e-government service provider known as NIC. There is no word when the websites will be restored, but the service is working to get them running again and to fix problems that could lead to future problems.

The vulnerability that lead to the attack was found in a Web-based application built by Iowa Interactive, a subsidiary of NIC. The state server that hosted the application, however, was not compromised in the attack. The scale of the problem is able to grow if other similar NIC applications were or could also be attacked. NIC counts more that 3,000 state, local, and federal government agencies as clients, and in the last year they processed more than $11.4 billion in secure payments. The cause of the problem may have been in this one web application, but if there were problems in others the problem could grow even larger.

First of all, I believe that NIC and Iowa Interactive need to go through and check every system they provide. They need to check for the hole that caused the problem as well as double checking for other holes that could cause problems. Second, I believe the state of Iowa needs to go through it's systems for failures. Lastly, it fall on the systems that were compromised. This was not the first time that the Amber Alert had been victim of an attack. This fact proves that the systems have flaws. The systems and application must be check and double checked to insure that everything is in working order and secure. Perhaps, issues from the first attack were never fixed or perhaps new ones had been exploited. The role of all the groups involved, NIC, the state, and the Amber Alert and Accident Alert systems, is to check everything for security. This attack was relatively innocent, but it could have been much worse. It is the job of these groups to protect against something worse occurring next.