Computer security experts believe that the attacks that hit the federal government could have been prevented if basic cybersecurity mechanisms had been put in place.
• Read also: Thousands of online government service accounts hacked
“If I were a minister, I would have some really serious questions to ask. », Says Eric Parent, president of cybersecurity firm EVA Technologies. He believes heads should fall as a result of these incidents.
On Saturday, the Treasury Board Secretariat announced that 9,000 taxpayer accounts had been affected by computer attacks.
The hackers wanted to log in through the federal government’s identification system, GCKey. This key is used to access some thirty federal departments and should allow citizens to communicate “securely with government services”, we write on the web.
Authorities say the hackers used valid usernames and passwords already compromised by previous data leaks to attempt to access these services in an automated fashion. About 5,000 accounts of the Canada Revenue Agency, which manages the granting of the Canada Emergency Benefit (ECP), were notably affected.
Like thieves
Steve Waterhouse
IT security expert
–
–
–
Steve Waterhouse, an information security professional, has trouble explaining how the system did not detect successive attempts by bandits to log in via GCKey earlier. It’s as if a thief had found a bunch of keys on the ground and was systematically trying every door on the same street, he explains. “As for me, it’s a basic attack. “
For its part, the Canadian Center for Cyber Security insists that the GCKey service per se has not been compromised. The government and the RCMP are investigating to determine whether there has been any breach of privacy, it is added.
Those affected will receive a letter from the CRA explaining how to restore access to their account, which has been suspended since the attacks.
It is impossible, for the moment, to know what the impact of this attack will be on the taxpayers affected.
Open Sesame
In recent years, the personal data of thousands of Quebecers has been circulating online after data breaches such as those that affected Desjardins, CapitalOne, Revenu Québec or the Ministry of Education. Their information is then sold by hackers, on the Dark Web or elsewhere.
This time, the fraudsters took advantage of the fact that some Internet users always use the same information to connect to different services, a practice that is greatly discouraged.
–
Related
/i/2003631384.png?resize=150%2C150&ssl=1)