Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Security In General >> Security >> Rogue employees sell passport data of World Cup fa
        
(Message started by: Pete Finnigan on Sep 11^th, 2010, 1:11pm)

Title: Rogue employees sell passport data of World Cup fa
Post by Pete Finnigan on Sep 11^th, 2010, 1:11pm

Passport details of more than 35000 English fans who visited the 2006 World Cup in Germany have been sold to the black market:
http://www.net-security.org/secworld.php?id=9855

Some quotes:
"Although this was clearly illegal, it also calls into question the internal security practices within football's international governing body whose IT managers who really should know better. It confirms something we've been saying for some time, namely that most organizations defend their digital assets against external attack, but they ignore the internal threat at their peril,"

"The employees did not hack into the database, it was an internal attack where they abused normal functionality and privileges granted to them. This was probably a case of over privileged users as these low level employees probably should not have been granted access to that data in the first place."