Ministry of Social Development security woes

Forums › IT Pro and developers › Ministry of Social Development security woes

1 | 2 | 3 | 4 | 5 | 6 | 7 | ... | 9

BDFL - Memuneh
76328 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#701248 15-Oct-2012 09:17

I don't know that, but my guess would be each Ministry has its own IT group instead of a consolidated one across the government. Does anyone know how it works?

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

Sharesies

Trade NZ and US shares and funds with Sharesies (affiliate link).

vexxxboy

4085 posts

Uber Geek

#701250 15-Oct-2012 09:20

i remember going into the winz office to wait for my wife about 8 months ago and trying out the kiosks and found that if you clicked on the herald job page you could then access the full herald and from there the full internet by clicking on links, so even then they were not secure.

Common sense is not as common as you think.

gjm

787 posts

Ultimate Geek

#701251 15-Oct-2012 09:20

I know there is definitely not just one across the govt so suspect they would have their own internal IT dept. Maybe the work experience guy set it up?

[Amstrad CPC 6128: 128k Memory: 3 inch floppy drive: Colour Screen]

freitasm

BDFL - Memuneh
76328 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#701252 15-Oct-2012 09:22

I'm asking because I know a couple of folks working for the MBIE and I know they'd be terrified if that happened under their guardianship.

Please support Geekzone by subscribing, or using one of our referral links: Dosh referral: 00001283 | Sharesies | Goodsync | Mighty Ape | Backblaze

freitasm on Keybase | My technology disclosure

Mark

1615 posts

Uber Geek

#701254 15-Oct-2012 09:28

Why has the blogger not been arrested yet ? It's not like he did it accidently, he deliberatly went and accessed the confidential files after being told how to do it.

The shoddy setup on the kiosks is a seperate issue.

eXDee

4029 posts

Uber Geek

Trusted

#701262 15-Oct-2012 09:33

Because of the likely public outcry against someone who has exposed a serious problem, it would only make it worse for them.

davidcole

5807 posts

Uber Geek

Trusted

#701263 15-Oct-2012 09:37

For all the facepalms, headdesks etc issues brought up here, what NZBen says here: http://www.ben.geek.nz/2012/10/how-it-works/ is probably so close to the truth it's not funny.

There's always a correct way, and a fast and cheap way. And even with risks attached, the bean counters deadline based project managers (as opposed to technically trained ones) will go for the quick and dirty.

Previously known as psycik

OpenHAB: Gigabyte AMD A8 Brix, OpenHAB with Aeotech ZWave Controller, Raspberry PI, Wemos D1 Mini, Zwave, Xiaomi Humidity and Temperature sensors
Media:Chromecast v2, ATV4 4k, ATV4, HDHomeRun Dual
Windows 10 Host Plex Server 3x3TB, 4x4TB using DriveBender, Samsung 850 evo 512 GB SSD, Hyper-V Server with 1xW10, 2xUbuntu 20.04 LTS, Backblaze Backups, usenetprime.com

amanzi

Amanzi
1148 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#701271 15-Oct-2012 09:52

Here are my initial thoughts copied and pasted from my blog...

If I get time later today, I'd love to write more on this topic, especially since I've spent the last 10 years working in various government IT departments, and have also spent a considerable amount of time securing and testing various kiosk computers.

But for now I'll just say that this is a failure on so many levels it's difficult to know where to start. And while some are keen to jump to conclusions about the MSD security, we don't yet know the exact cause of the apparent open permissions - perhaps all file shares were readable to all users (I doubt it), or perhaps the account the kiosk computer logged in with was a member of a group that gave it way too many rights.

I'm still picking that Keith Ng was tipped off by either a current or ex employee that had worked in or with the MSD IT department. In Keith's article, he confidently says that this exploit was available from any WINZ branch around NZ - he wouldn't know that for sure unless he had been told by someone knowledgable.

Regardless, I believe he's done the right thing but publishing the details - this ensures that he'll get maximum effect.

gzt

15190 posts

Uber Geek

Lifetime subscriber

#701279 15-Oct-2012 10:15

It is unclear exactly how the exposure occurred. In the one case imaginable the kiosk user is running as some kind of network admin user. In others the kiosk user may have network backup permissions for some obscure and bad reason. There are many possibilities in that area. Sometimes a user (or all users) are granted something during troubleshooting or to get a 'misbehaving' application or service to work then it accidentally gets left that way forever or worse it is then written into the standard configuration.

The case where the 'user' group has read and write access to a lot including call logs is just horrible and hard to imagine. A public kiosk user should never be a member of the 'user' group at all, but see above.

In combination another common case is a culture where many users and network staff have been putting files and service outputs in 'user' accessible locations for network convenience reasons - like because staff could not find an admin to create a proper service user or some other self defeating network policy reason so a culture develops where this is accepted (it should never be) just to get anything done.

I have seen comment that the journalist could be exposed to charges under the Crimes Act Amendment 2003. IMHO this is incorrect in this particular case. Ng is clearly acting as a journalist in the public interest and did not use his access of the system for personal gain. Add to this - it is likely he stayed close to responsible disclosure and communicated the issue to the party concerned a reasonable time before publication and/or before the issue could be exploited by a member of the public.

A full audit is required to determine how much information was accessed by members of the public during this time.

A wider and separate audit of ministry AD security and AD maintenance policy is also required.

http://www.nbr.co.nz/article/msd-opens-investigation-after-ng-exposes-massive-security-hole-ck-130658

GregV

917 posts

Ultimate Geek

#701281 15-Oct-2012 10:17

Does anyone know what they have done to "close the kiosks" while they investigate this? Hopefully more than just power them down, or unplug the network cable...

ajobbins

5050 posts

Uber Geek

Trusted

#701294 15-Oct-2012 10:23

Don't MSD outsource at least some of their IT to Datacom?

Twitter: ajobbins

Mark

1615 posts

Uber Geek

#701308 15-Oct-2012 10:34

eXDee: Because of the likely public outcry against someone who has exposed a serious problem, it would only make it worse for them.

It's still an illegal access of a computer system .. doesn't matter if it was a peice of cake to achieve or really hard. Say for example it was not a simple thing to achieve and he had to "hack" his way in to the files and then he bragged about it on his blog ... they'd arrest him straight away, how can this be different ?

To my mind it is two different things :

1) He got told how to access files, he made the decision to go off and access those files ... that is where he went wrong he should never ever ever ever gone and done it. (I can tell you how to get into my neighbours house without the key ... would you go do it ? And then go through the undies drawer ?)

2) Security for the kiosks at MSD is crap and someone needs dragging over the coals to explain why they were not fully tested out.

Sorry ... people doing stupid things and then getting praised for it erks me ... then I get more erked when stupider (I'm sure that is a word :-) people get all scared about enforcing the law.

allan

1892 posts

Uber Geek

ID Verified

Lifetime subscriber

#701317 15-Oct-2012 10:38

It's still an illegal access of a computer system .. doesn't matter if it was a peice of cake to achieve or really hard. Say for example it was not a simple thing to achieve and he had to "hack" his way in to the files and then he bragged about it on his blog ... they'd arrest him straight away, how can this be different ?

To my mind it is two different things :

1) He got told how to access files, he made the decision to go off and access those files ... that is where he went wrong he should never ever ever ever gone and done it. (I can tell you how to get into my neighbours house without the key ... would you go do it ? And then go through the undies drawer ?)

2) Security for the kiosks at MSD is crap and someone needs dragging over the coals to explain why they were not fully tested out.

Sorry ... people doing stupid things and then getting praised for it erks me ... then I get more erked when stupider (I'm sure that is a word :-) people get all scared about enforcing the law.

And this issue would have been addressed how exactly without this sort of exposure?

eXDee

4029 posts

Uber Geek

Trusted

#701322 15-Oct-2012 10:41

From December 2011:

A national review of Work and Income security has been triggered after the ''appalling'' breaches of privacy, which could result in prosecutions.

Right, so we know one of two things
a) This system was set up since then
b) This claim they did a review of security is a pile of BS.

http://www.stuff.co.nz/national/6187390/WINZ-staff-under-fire

amanzi

Amanzi
1148 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#701325 15-Oct-2012 10:43

This is not looking good for MSD...

http://www.radionz.co.nz/national/programmes/morningreport/audio/2535528/msd-told-about-security-problem-a-year-ago-advocate

1 | 2 | 3 | 4 | 5 | 6 | 7 | ... | 9