Travel-Booking Site for Federal Agencies Hacked - Security Fix: Via Washington Post

Govtrip.com, which handles travel reservations for at least a dozen U.S. government agencies, last week was infected with a virus that tried to install malicious software when users visited the site, causing some agencies to block employees from accessing it, Security Fix has learned.

Sometime on Feb. 11, hackers changed the Govtrip.com Web site to redirect visitors to a site that installed malicious software. A number of agencies, including the departments of Agriculture, Energy, Health & Human Services, Interior, Transportation, and Treasury, use the site exclusively to book travel arrangements. Govtrip.com also is used to reimburse workers via direct deposit, which means that many federal employees' checking account information is stored there as well.

On Thursday, Feb. 12, the Federal Aviation Administration began urging employees to avoid visiting the site. Rather, employees seeking to make travel arrangements were given instructions on how to book travel arrangements manually, FAA spokeswoman Laura Brown said.

"When we first realized there was a problem, we blocked access to the site from our end, because people who had contact with it were reporting some kind of virus being downloaded," Brown said.

Govtrip.com is managed by defense contractor Northrop Grumman, which declined to comment for this story. The company referred all inquiries to the General Services Administration.

GSA spokesman Robert Lesino said the agency's ability to comment was limited because the incident was still under investigation. GSA issued the following statement:

[...]

Update, Feb. 21, 2:53 p.m. ET: According to an analysis shared with Washingtonpost.com, the compromise of govtrip.com came from multiple sources and was fairly extensive. From an internal government memo:

[...]

Until those systems are in place, however, Northrop Grumman will have its authority to operate the service on behalf of federal agencies revoked, the memo notes. The GSA said it anticipates restoring government access to govtrip.com on Monday, Feb. 23.

Read Original Article ( Via Washington Post. )