DICT: Lapses identified after hacking of disaster response unit

MANILA, Philippines — The Department of Information and Communications Technology is determined to learn the lessons from the successful hack staged on its disaster response unit’s portal and implement improvements in its systems and websites not just in the DICT but also in other national and local government agencies.

Jeffrey Ian Dy, ICT Undersecretary for Infostructure Management, Cybersecurity and Upskilling, said that a review of the hack undertaken on their Disaster Risk Reduction and Management Division (DRRMD) portal the other day had identified the lapses that enabled the hacker to breach the system.

“We have identified the lapses. These are instructive, and these can also be used so that other agencies can also understand,” Dy told The Star in a Viber audio interview.

“Majority of the lapses were in the way the (DRRMD) system was developed,” Dy said.

However, Dy reiterated that the DRRMD was really designed to be easily accessible by outside parties since it was meant to disseminate information during disasters.

Dy said that a lapse found was that the DRRMD portal used an untested encryption algorithm.

“What was used was...an encryption algorithm or protocol that was proprietary, the protocol was developed or invented by a provider,” Dy said.

Another lapse, which he said was also seen as a “critical flaw”, was the use of a password system that was encrypted.

“The password – the username password combination – should not be encrypted, it should be hashed,” Dy said.

Also, Dy said that the DICT had already detected these vulnerability several days earlier.

“ However, it took several days before it was updated. And then, the hacker struck before we can do address the vulnerability,” Dy said.

Dy reiterated that the volume of data compromised by the hacker, whom he earlier identified as “PH1NS,” was just about 200 megabytes.

“Any type of breach, we don’t want to downplay. Even though it’s (DRRMD) a small system, we still take this seriously. We still want to take note of the learnings here,” Dy said.

Dy noted that the DICT’s cybersecurity forces have been spread rather thinly the past weeks with the number of hacks being staged on government agencies and