Postal Service left vulnerable IT applications unaddressed for years, inspector general finds

The "common, well-known vulnerabilities" could have been exploited by hackers using "publicly available methods,” the report found.

Officials at the U.S. Postal Service let multiple vulnerable applications languish on the agency’s IT network for years — flaws that could have been exploited by hackers to steal sensitive data, an inspector general audit has found.

The inspector general investigation, distributed to Postal Service leadership in July, faults IT officials at the agency for not keeping a slew of applications up to date. Six of the IT applications were left on the Postal Service network for up to seven years with things like incomplete certification and accreditation from technology executives, according to the IG memo.

A dozen vulnerabilities were deemed “catastrophic” by the USPS’s Corporate Information Security Office, the watchdog said, meaning they could have exposed the agency to big financial damages. “These are common, well-known vulnerabilities that have been present for three years that could be exploited by an attacker utilizing publicly available methods,” the memo reads.

“The vulnerabilities identified in this report were found, scoped and addressed by the Postal Service,” an agency spokesperson told CyberScoop. “These applications are now addressed.”

But before they were addressed, the inspector general report concluded, the Postal Service “did not completely evaluate the risks these vulnerable applications posed.”

Postal Service executives agreed with the audit’s findings and pledged to improve the agency’s cybersecurity. CyberScoop has not seen any evidence that the vulnerabilities have been exploited by hackers.

Vice News was first to report on the audit.

It is unclear which IT applications the inspector general’s office studied. That information is redacted in the report.

This is not the first time the Postal Service has struggled with IT security. It took the agency more than a year to fix a vulnerability in its website that allowed anyone with a USPS account to view the personal details of 60 million other users, journalist Brian Krebs reported in November 2018. The agency said at the time there was no indication that the vulnerability had been exploited.

Perhaps the biggest confirmed breach suffered by the Postal Service took place in September 2014, when hackers infiltrated the agency’s computer systems and compromised personal data on some 800,000 employees.

UPDATE, 09/11/20, 1:46 p.m. EDT: This story has been updated with a statement from the USPS. 

SCOTUS tosses one of two injunctions against Trump USPS mail-in ballot rules

The 6-3 decision dismisses one lawsuit brought by states, saying they have no standing to sue because the disputed sections “neither requires nor forbids anything of anyone outside…

Postal Service moves to finalize mail ballot regs before SCOTUS ruling

Open-source security is posing challenges governments can’t easily solve

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems