Pierluigi Paganini
April 06, 2016
According to the results of an internal review of the US State Department, the Consular Consolidated Database (CCD) is vulnerable to cyber attacks.
The State Department considers the CCD as an “unclassified but sensitive system,” it contains more than 290 million passport records, 184 million visa records, and 25 million records on US citizens living abroad.
The CCD is a critical source of information for the US Government because it includes data related to anyone who has applied for a U.S. passport or visa in the past two decades.
Records include personal information, photos, fingerprints, Social Security or other identification numbers.
The experts at the US State Department’s cyber defenses performed the internal audit several months ago.
An official at the US State Department confirmed that many vulnerabilities have been already fixed, but according to information collected by the ABC News many flaws are still in place.
“We are, and have been, working continuously … to detect and close any possible vulnerability,” State Department spokesman John Kirby said in a statement to ABC News.
“Vulnerabilities have not all been fixed,” the source said, and added that “there is no defined timeline for closing [them] out,” revealed an internal congressional anonymous source.
“I know the vulnerabilities discovered deserve a pretty darn quick [remedy],”
The representatives at US State Department considered the vulnerabilities very hard to exploit due to the level of permissions necessary to modify the Consular Consolidated Database.
“CCD allows authorized users to submit notes and recommendations directly into applicants’ files. But to alter visa applications or other visa-related information, hackers would have to obtain “the right level of permissions” within the system -– no easy task, according to State Department officials.” reports the ABC News.
Security experts consider the presence of flaws in the Consular Consolidated Database archive a serious threat because they could be exploited by threat actors to doctor visa applications or exfiltrate sensitive data.
The discovery raised serious concerns about the possible consequences of a cyber attack on the CCD. State-sponsored hackers could use them to provide fake identities on the US soil, but most disconcerting is a possible abuse made by terrorist groups.
“Every visa decision we make is a national security decision,” explained the top State Department official, Michele Thoren Bond, in a recent House panel.
The US State Department and other government sources say that there is no evidence that the database has been breached.
According to ABC News, the audited systems will be overhauled in the coming years.
[adrotate banner=”9″]
(Security Affairs – Consular Consolidated Database, US State Department)
