Tests show hackers could access resident registry network

[InfoSec News <isn () c4i org>]

http://mdn.mainichi.co.jp/news/20031002p2a00m0dm021003c.html

Mainichi Shimbun
Japan, Oct. 2, 2003

NAGANO -- Hackers could easily obtain private information kept in the
controversial resident registry network, a test has found.

The Nagano Prefectural Government has been trying to hack into the Big
Brother system in an apparent bid to use the results as the basis for
justifying its withdrawal from the network.

"I have been informed that experts are analyzing the results," Nagano
Gov. Yasuo Tanaka. "We are carefully handling the results because the
test involves private information."

Sources from the prefectural government said they would announce the
test results after experts have finished their analysis.

After hearing the results of Nagano's experiments, local governments
also voiced fears of leakages.

Hiroshi Yamada, mayor of Tokyo's Suginami-ku who has said citizens
would only be asked to join the network on a voluntary basis, quickly
reacted to Nagano's test.

"We will confirm the results of the Nagano experiment and take
counter-measures as soon as possible," Yamada said. Suginami-ku is
planning to send the registration procedures for the network to all
residents, but officials said they now may possibly postpone the plan
or even give it up.

Hiroshi Nakada, mayor of Yokohama, which also allows citizens to join
on a voluntary basis, said either the national government or local
municipalities had to think about anti-hacking measures.

"I now know that residents' information cannot be kept inside the
Yokohama Municipal Government," Nakada said.

Nagano officials began the hacking test on Sept. 22 after obtaining
the approval of three local municipalities such as Achi to avoid
violating the law banning illegal access to online networks.

During the test to hack into the three municipal resident registry
host computers, they learned that hackers could have conditional
access to registered citizens' information.

Hackers can even alter information kept in the host computers, the
sources said.

About 800 municipalities connect their resident registry system to the
Internet through this local online network.

An official of the Ministry of Public Management that supervises the
nationwide resident registry system tried to calm uncertainty over the
controversial results.

"I think only some vulnerable access routes have been found," the
official said. "Municipalities have different types of firewalls
(designed to protect the online network from hacking). I don't think
the test results will threaten the safety of the entire resident
registry network."

Hiroko Uehara, mayor of Kunitachi in the suburbs of Tokyo that refuses
to be part of the system, said that just one vulnerable point could
collapse an online network.

"I think Nagano did a good test. The results helped people understand
that the system is not safe," Uehara said.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.