eBay Hacked Through Old Code
eBay was hacked last week, according to Ars Techncia, and the attacker took advantage of some old code that was left on a server:
A hacker infiltrated an eBay server and disabled accounts of several members on Friday. Representatives of eBay say that the hacker used vestigial components of an old eBay administrative system that has long been unused. The code exploited by the hacker has since been taken down, and eBay claims that no financial information was exposed.
Having a process for decommissioning software is just as important as having one for hardware as this incident shows. The problem is, how many companies do it well enough to avoid this kind of breach?
It's one thing to decommission hardware, you can trip over a server or a workstation. Software isn't so obvious. (A decommissioned 1U server in a rack in a room filled with racks isn't so obvious either but that's another story).
Full software life cycle management helps here as do controls like COBIT. This is one of those cases where security isn't so much about "security" as it is about housekeeping.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
