Government Website Vulnerability Exposes Over 14 Million Customers

Government Website Vulnerability Exposes Over 14 Million Customer Records

U.S. government payment site GovPayNow.com had poor security measures risking data leaks as far back as 2012

A website used by thousands of local governments in the U.S. to accept online payments has been found to contain a security vulnerability which put over 14 million customers at risk of having their data accessed.

GovPayNet, run by the company Government Payment Service Inc., processes customer payments for everything from tax payments and licensing fees to court-ordered fines and restitution payments. A very simple vulnerability caused at least 6 years of customer receipts to be made available to anyone with the keyboard savvy to change a few numbers in the URL bar of a browser.

GovPayNow.com stresses that customers are now safe, and stated there was “no indication that any improperly accessed information was used to harm any customer.” The systems have been updated to close the security gap since the vulnerability was made public by KrebsOnSecurity, a security investigation website.

Web security experts found the vulnerability exasperating. Terry Ray, CTO of the cybersecurity firm Imperva, said security loopholes like this should have been closed over a decade ago.

“I don’t know where the break-down in the process was for Govpaynow.com, but something definitely didn’t happen as it should,” Ray said. “Web site usage or attacks of this type, whichever you prefer to call the situation, are avoidable.”

Chris Olson, CEO of The Media Trust, explained that these vulnerabilities are even more dangerous when found on government websites.

“Hackers target government websites for three reasons,” Olson said. “First they draw thousands, if not millions, of users who enter sensitive, personally identifiable information in order to access services or make payments. Second, they are often poorly defended as a result of limited budgets and the preponderance of legacy systems, machines, and software. Third, their digital third parties also often have inadequate security measures and practices.”

Government Payment Services Inc was acquired by Securus Technologies early in 2018. The Texas-based telecommunications company has already come under fire this year for lax security, when hackers stole the credentials of law enforcement officers off its system, in May.

KrebsOnSecurity noted that, as cybersecurity experts stated above, closing these gaps is remarkably simple.

About the Author

Jordan Lutke is an intern with 1105 Media.

Featured

  • Allegion, Comfort Technologies Implement Mobile Credentials at the Artisan Apartment Homes in Florida

    Artisan Apartment Homes, a luxury apartment complex in Dunedin, Florida, recently transitioned from mechanical keys to electronic locks and centralized system software with support from Allegion US, a leading provider of security solutions, technology and services, and Florida-based Comfort Technologies, which specializes in deploying multifamily access control, IoT devices and software management solutions. Read Now

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events
  • Industry Embraces Mobile Access, Biometrics and AI

    A combination of evolving workplace dynamics, technology innovation and new user expectations is changing how people enter and interact with physical spaces. Access control is at the heart of these changes. Combined with biometrics and AI, mobile access control has become increasingly crucial for deploying entry solutions that are seamless, secure and adaptive to user needs. Read Now

  • Sustainable Video Solution Delivered for Landmark City of London Office Development

    An advanced, end-to-end video solution from IDIS, with a focus on reducing waste and costs, has helped a major office development in the City of London align its security with sustainability objectives. Read Now

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.