Ministry of Social Development security woes

Forums › IT Pro and developers › Ministry of Social Development security woes

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9

1514 posts

Uber Geek
+1 received by user: 315

#701458 15-Oct-2012 13:43

Mark: Just to satisfy my own curiosity about whether my own ethics/morals are "normal" ...

Thumbs up or down if you think the blogger acted illegally or not.

Blogger has admitted that he specifically went looking for files he was not intended to have.

He claims he did so in a manner which required him to "break in" by mapping a drive (ok wasn't hard but the average joe isn't going to know).

He opened files he found, and he took files home (physically or over the internet, doesn't matter).

He has also admitted that he knew when he did so that these files were of a private confidential nature and that they were not intended for him.

He has also admitted that he did not stop at the first instance but continued on, apparantly looking at thousands of files.

So yes, I believe he has acted in at least some ways illegally.

---
James Sleeman
I sell lots of stuff for electronic enthusiasts...

ajobbins

5053 posts

Uber Geek
+1 received by user: 1279

Trusted

#701463 15-Oct-2012 13:49

There have already been claims this has been raised (In a non public) way with MSD and nothing was done.

In which case, going public (as well as having the proof it was possible - something he couldn't do without copying the information) was what was needed to get this the appropriate attention.

Twitter: ajobbins

amanzi

Amanzi
1354 posts

Uber Geek
+1 received by user: 332

ID Verified

Trusted

Lifetime subscriber

#701465 15-Oct-2012 13:54

KiwiNZ: Contact Mr Boyles executive assistant

I think you are grossly underestimating the seriousness of this issue.

davidcole

6099 posts

Uber Geek
+1 received by user: 1465

Trusted

#701470 15-Oct-2012 13:59

So from the press release (on now), they said that staff do not have access to all the information the kiosk did.

So that seems to point to elevated permissions of the kiosk user/group. Rather than guess/everyone access on all shares/file systems.

Previously known as psycik

Home Assistant: Gigabyte AMD A8 Brix, Home Assistant with Aeotech ZWave Controller, Raspberry PI, Wemos D1 Mini, Zwave, Shelly Humidity and Temperature sensors
Media:Chromecast v2, ATV4 4k, ATV4, HDHomeRun Dual
Server Host Plex Server 3x3TB, 4x4TB using MergerFS, Samsung 850 evo 512 GB SSD, Proxmox Server with 1xW10, 2xUbuntu 22.04 LTS, Backblaze Backups, usenetprime.com fastmail.com Sharesies Trakt.TV Sharesight

ubergeeknz

3344 posts

Uber Geek
+1 received by user: 1041

Trusted

Vocus

#701483 15-Oct-2012 14:19

KiwiNZ:To me it is like entering a home to show that is is insecure and then ransacking that home etc.

Again not saying that it was legal but: MSD is a Government Department. This is a service that we all pay for and expect them to protect the privacy of citizens.

What the reporter has done is not the same as breaking into a private citizen's house in any way, shape or form. Nor is it the same as ransacking that house, he did not delete or corrupt any data.

freitasm

BDFL - Memuneh
80653 posts

Uber Geek
+1 received by user: 41045

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#701484 15-Oct-2012 14:23

KiwiNZ:
ajobbins: There have already been claims this has been raised (In a non public) way with MSD and nothing was done.

In which case, going public (as well as having the proof it was possible - something he couldn't do without copying the information) was what was needed to get this the appropriate attention.

And you know for sure that nothing was being done in the back ground in order to lessen disruption to the users of the service?

If anything was being done in the background then either

Kiosks would have turned off before this became public or
Permissions would have been changed before this became public.

I have the impression there's an underestimating of the seriousness of the situation, perhaps even ignoring the Privacy Act and its implications.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

Dell

Shop now for Dell laptops and other devices (affiliate link).

macuser

2120 posts

Uber Geek
+1 received by user: 506

#701492 15-Oct-2012 14:28

This whole thing is WOW.

The guy shouldn't be charged but I'm very curious about how he knew about the security flaw if he is not a beneficiary or someone who has receiving assistance.

I remember in high school typing directories into word to open a file explorer in off access drives. Could never get to anything personal though, only games and UI settings

amanzi

Amanzi
1354 posts

Uber Geek
+1 received by user: 332

ID Verified

Trusted

Lifetime subscriber

#701504 15-Oct-2012 14:42

KiwiNZ: You need to understand the Server permissions structure, Applications access and authorisation regimes. Auditing and checking.

It's a fair assumption that most people reading this thread in the IT Pro forum will have a reasonable understanding of server permissions.

KiwiNZ: Turning off the Kiosks would cause considerable issues to the customer base and this persons actions have now ensured that.

Thankfully those kiosks have now been turned off. Sure a small number of people have been inconvenienced by this, but that's nothing compared to the tens or hundreds of thousands of people that have had their private and sensitive information exposed to anyone with a bit of computer knowledge.

KiwiNZ: I can assure you I am fully aware of the seriousness and consequences of what is happening probably more so than anyone currently involved with this thread.

No, I really don't think you realise the seriousness of the situation.

Mark

1653 posts

Uber Geek
+1 received by user: 555

#701510 15-Oct-2012 14:51

I'm also wondering that if he viewed all those thousands of files .... did he edit any ?

freitasm

BDFL - Memuneh
80653 posts

Uber Geek
+1 received by user: 41045

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#701517 15-Oct-2012 15:00

Because some of the comments in this thread. For example "Turning off the Kiosks would cause considerable issues to the customer base and this persons actions have now ensured that."

Turning off the kiosks would impact some people, sure. But immediately cut off access to any information to external parties. Then let the witch hunt begin.

If this is a problem that was known for some time then there's no excuses for the kiosks to still be available as it were.

Defending the option of leaving the kiosks on while access to this information was available is simply unbelievable.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

amanzi

Amanzi
1354 posts

Uber Geek
+1 received by user: 332

ID Verified

Trusted

Lifetime subscriber

#701519 15-Oct-2012 15:01

What he said.

Dell

Shop now for Dell laptops and other devices (affiliate link).

ajobbins

5053 posts

Uber Geek
+1 received by user: 1279

Trusted

#701520 15-Oct-2012 15:01

KiwiNZ: [Removed on request]

If this is true, yet the kiosks can access all of this and more, they must be running on some kind of elevated permissions account. But why? Assumably they are running some pretty basic apps (Web browser, Office) and are linked to a printer and the internet. I can't see why they would need elevated permissions. In fact, I see no reason why they need to be on the corporate network at all. They should be segregated off totally.

As mentioned before, it seems that this security flaw has been raised with MSD quietly in the past, and nothing was done. Obviously you have inside knowledge, so one can assume you are employed directly or indirectly by the MSD - which could explain why (IMHO) you come across as biased towards defending them.

While Mr Ng may have technically broken the law, he seems to have done so 'for the greater good', has done so I an open, transparent and co-operative way and seemingly without malicious intent. If they decided to sue him over this I think any court would have to consider the context in which this has happened.

Twitter: ajobbins

DoggNZ

437 posts

Ultimate Geek
+1 received by user: 9
Inactive user

#701532 15-Oct-2012 15:19

KiwiNZ: With all due respect I believe that most here are basing their statements on what the press, of course they are the source of ALL fact, are saying.

That sentence makes no sense. Same as your argument really.

ajobbins

5053 posts

Uber Geek
+1 received by user: 1279

Trusted

#701533 15-Oct-2012 15:19

KiwiNZ: With all due respect I believe that most here are basing their?statements?on what?the?press, of course they are the source of ALL fact, are saying.

Until MSD come out and publicly say otherwise, what is in the media is all we have to go on.

The actions of the MSD since this story broke only seem to back up and provide credibility to what is currently being reported

Twitter: ajobbins

amanzi

Amanzi
1354 posts

Uber Geek
+1 received by user: 332

ID Verified

Trusted

Lifetime subscriber

#701537 15-Oct-2012 15:24

KiwiNZ: With all due respect I believe that most here are basing their statements on what the press, of course they are the source of ALL fact, are saying.

Well I watched the press conference today and neither Brendan Boyle nor Paula Bennett denied anything that had been reported. So unless you're saying that the reporter did not get access to all that private data, then I'm quite happy going with the facts as reported.

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9