Full Breakdown
Government Contractor’s Firewall Change Exposed 50 Million Immigration Records
By Drooid · · How we work
Core Incident
In the early 2010s, developers at a U.S. government contractor altered a firewall rule that linked a low-security commercial datacenter to a classified production environment. The change allowed the provisioning server used for code deployment to reach servers that stored immigration data classified at the top-secret level. While the contractor’s security researcher Joe Brinkley warned the Change Review Board that the modification “creates a very glaring issue…,” the developers bypassed his objection by obtaining approval from the Change Acceptance Board during a week Brinkley was on vacation. After returning, Brinkley demonstrated that, using the same VPN connection, he could log into the production server and control it.
Background & Context
The contractor operated two separate datacenters: a commercial facility shared with tenants such as Microsoft and Oracle, and a classified facility that housed the production servers for a government immigration program. Access to the classified environment was intended to be limited to a small group of authorized personnel, protected by a VPN, usernames, and passwords. Developers sought to simplify code deployment by allowing the provisioning server in the low-security zone to communicate directly with the high-security servers, thereby eliminating a hard firewall barrier.
Data & Statistics
- The production servers contained approximately 50 million immigration records detailing arrivals, stays, and related information.
- Thousands of users could connect to the commercial datacenter’s VPN, whereas only dozens were supposed to have VPN access to the classified environment.
- The servers required only a username and password; multi-factor authentication was absent and password standards were low at the time.
Official Statements & Responses
He demonstrated the vulnerability to supervisors, after which the contractor immediately restored the original firewall configuration. No further official comment from the government representative was recorded in the sources.
Verbatim Quotes
- “It creates a very glaring issue that we are going from a low-level secured datacenter all the way up to a high-level, top secret secured datacenter for production, and you guys are opening up a firewall rule that would allow anybody from that low level datacenter to have access into, at a minimum, into the high level datacenter,” — Joe Brinkley, of security researcher