The Washington state Administrative Office of the Courts (AOC) has confirmed that attackers leveraged a previously repaired Adobe software bug to access its website and make off with hundreds of thousands of Social Security and driver's license numbers.
Court officials on Thursday revealed that hackers definitively made off with 94 Social Security numbers, but that as many as 160,000 may have been compromised, alongside one million driver's license numbers.
Wendy Ferrell, a spokeswoman for Washington state AOC, told SCMagazine.com that a previously patched vulnerability in Adobe's ColdFusion application server was used to carry out the attack. Adobe fixed the weakness that was exploited in January.
That patch actually addressed four ColdFusion vulnerabilities (CVE-2013-0625, CVE-2013-0629, CVE-2013-0631 and CVE-2013-0632), all of which could permit an unauthorized user to remotely bypass authentication controls to take over the targeted server. Ferrell did not say which of the defects was used.
In a Friday email to SCMagazine.com, Heather Edell, an Adobe spokeswoman, said the company wasn't directly made aware of the breach.
“We do not have any information outside of published reports,” Edell wrote. “That said, we have issued patches for ColdFusion over the past few months. As always, Adobe recommends that users follow security best practices by updating software to the latest version available.”
Coincidentally, a day before the breach was revealed, Adobe disclosed that it was aware of live exploits targeting a yet-unpatched ColdFusion vulnerability, but it's now apparent that that bug wasn't the one on which the attackers relied.
According to a post on the Washington state court site, those affected by the breach either were booked into a city or county jail in the state between September 2011 and December 2012, received driving under the influence (DUI) citations between 1989 through 2011, had traffic cases filed between 2011 and 2012, or had a superior court criminal case filed against them or resolved between 2011 and 2012.
