News
Avecto says T-Mobile USA Web server hack could have been prevented by a multi-layered IT security strategy
January 2012 by Avecto
Commenting on reports that the T-Mobile USA Web server has been hacked by the TeaMp0isoN hacktivist group, Avecto says that a multi-layered security strategy could have helped to prevent the crack, as well as saving the troubled US cellular carrier considerable embarrassment.
According to Paul Kenyon, Chief Operating Officer with the Windows privilege management specialist, while T-Mobile USA almost certainly had IT security defences protecting the Web server hosting the main T-Mobile.com portal - and newsroom subset of the site - it is clear that these defences have been found wanting.
“As well as being publicly hacked by the Anonymous-linked hacktivist group, T-Mobile has just exited sales negotiation with AT&T and is on the lookout for a suitor that will acquire its US operations. To have its Web server data so publicly hacked could not have come at a worse time,” he said.
“While early reports suggest that only a superficial level of data – including low-grade passwords – has been posted on Pastebin by the hacktivist group, this is a classic case of corporate embarrassment over financial loss,” he added.
The Avecto COO went on to say that, while there has been no direct financial loss to the US telco, there is still the danger of the reputational fallout dissuading a potential suitor from opening acquisition talks.
The underlying attack vector – which appears to centre on SQL injection vulnerability exploitation – may be of passing interest to technical analysts and reporters. However, Kenyon argues, the reputational damage could result in the partial or complete closure of T-Mobile USA’s network, which has not reached profitability targets.
And this, he says, is why AT&T has been courting T-Mobile US for some time, although discussions reportedly fell apart quite recently.
“The big question that technology historians will likely ask if T-Mobile US does not find an acquisition partner, is whether this incident scuppered discussions with further potential suitors. Our observation is that the use of application security – allied with privilege identity management – may well have helped stop this embarrassing hack,” he said.
“Would it have definitely stopped the hack? Without knowing the precise details of the US cellco’s IT security systems, that’s a question that no-one outside of the company could answer, What I do know is that this the security risk profile of the cellular carrier could have been reduced had they used a multi-layered IT security strategy” he added.
