Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
BDFL - Memuneh
65321 posts

Uber Geek

Administrator
Trusted
Geekzone
Lifetime subscriber

  # 701248 15-Oct-2012 09:17
Send private message

I don't know that, but my guess would be each Ministry has its own IT group instead of a consolidated one across the government. Does anyone know how it works?





2987 posts

Uber Geek


  # 701250 15-Oct-2012 09:20
Send private message

i remember going into the winz office to wait for my wife about 8 months ago and trying out the kiosks and found that if you clicked on the herald job page you could then access the full herald and from there the full internet by clicking on links, so even then they were not secure.




Common sense is not as common as you think.


 
 
 
 


gjm

755 posts

Ultimate Geek


  # 701251 15-Oct-2012 09:20
Send private message

I know there is definitely not just one across the govt so suspect they would have their own internal IT dept. Maybe the work experience guy set it up?




[Amstrad CPC 6128: 128k Memory: 3 inch floppy drive: Colour Screen]

BDFL - Memuneh
65321 posts

Uber Geek

Administrator
Trusted
Geekzone
Lifetime subscriber

  # 701252 15-Oct-2012 09:22
Send private message

I'm asking because I know a couple of folks working for the MBIE and I know they'd be terrified if that happened under their guardianship.





1498 posts

Uber Geek


  # 701254 15-Oct-2012 09:28
Send private message

Why has the blogger not been arrested yet ?   It's not like he did it accidently, he deliberatly went and accessed the confidential files after being told how to do it.

The shoddy setup on the kiosks is a seperate issue.



4025 posts

Uber Geek

Trusted

  # 701262 15-Oct-2012 09:33
Send private message

Because of the likely public outcry against someone who has exposed a serious problem, it would only make it worse for them.

4671 posts

Uber Geek

Trusted

  # 701263 15-Oct-2012 09:37
Send private message

For all the facepalms, headdesks etc issues brought up here, what NZBen says here: http://www.ben.geek.nz/2012/10/how-it-works/  is probably so close to the truth it's not funny.

There's always a correct way, and a fast and cheap way.  And even with risks attached, the bean counters deadline based project managers (as opposed to technically trained ones) will go for the quick and dirty.





Previously known as psycik

OpenHAB: Gigabyte AMD A8 BrixOpenHAB with Aeotech ZWave Controller, Raspberry PI, Wemos D1 Mini, Zwave, Xiaomi Humidity and Temperature sensors and Bluetooth LE Sensors
Media:Chromecast v2, ATV4, Roku3, HDHomeRun Dual
Windows 10
Host (Plex Server/Crashplan): 2x2TB, 2x3TB, 1x4TB using DriveBender, Samsung 850 evo 512 GB SSD, Hyper-V Server with 1xW10, 1xW2k8, 2xUbuntu 16.04 LTS, Crashplan, NextPVR channel for Plex,NextPVR Metadata Agent and Scanner for Plex


 
 
 
 


932 posts

Ultimate Geek

Trusted

  # 701271 15-Oct-2012 09:52
Send private message

Here are my initial thoughts copied and pasted from my blog...

If I get time later today, I'd love to write more on this topic, especially since I've spent the last 10 years working in various government IT departments, and have also spent a considerable amount of time securing and testing various kiosk computers.

But for now I'll just say that this is a failure on so many levels it's difficult to know where to start. And while some are keen to jump to conclusions about the MSD security, we don't yet know the exact cause of the apparent open permissions - perhaps all file shares were readable to all users (I doubt it), or perhaps the account the kiosk computer logged in with was a member of a group that gave it way too many rights.

I'm still picking that Keith Ng was tipped off by either a current or ex employee that had worked in or with the MSD IT department. In Keith's article, he confidently says that this exploit was available from any WINZ branch around NZ - he wouldn't know that for sure unless he had been told by someone knowledgable.

Regardless, I believe he's done the right thing but publishing the details - this ensures that he'll get maximum effect.

gzt

11026 posts

Uber Geek


  # 701279 15-Oct-2012 10:15
Send private message

It is unclear exactly how the exposure occurred. In the one case imaginable the kiosk user is running as some kind of network admin user. In others the kiosk user may have network backup permissions for some obscure and bad reason. There are many possibilities in that area. Sometimes a user (or all users) are granted something during troubleshooting or to get a 'misbehaving' application or service to work then it accidentally gets left that way forever or worse it is then written into the standard configuration.

The case where the 'user' group has read and write access to a lot including call logs is just horrible and hard to imagine. A public kiosk user should never be a member of the 'user' group at all, but see above.

In combination another common case is a culture where many users and network staff have been putting files and service outputs in 'user' accessible locations for network convenience reasons - like because staff could not find an admin to create a proper service user or some other self defeating network policy reason so a culture develops where this is accepted (it should never be) just to get anything done.

I have seen comment that the journalist could be exposed to charges under the Crimes Act Amendment 2003. IMHO this is incorrect in this particular case. Ng is clearly acting as a journalist in the public interest and did not use his access of the system for personal gain. Add to this - it is likely he stayed close to responsible disclosure and communicated the issue to the party concerned a reasonable time before publication and/or before the issue could be exploited by a member of the public.

A full audit is required to determine how much information was accessed by members of the public during this time.

A wider and separate audit of ministry AD security and AD maintenance policy is also required.

http://www.nbr.co.nz/article/msd-opens-investigation-after-ng-exposes-massive-security-hole-ck-130658

803 posts

Ultimate Geek


  # 701281 15-Oct-2012 10:17
Send private message

Does anyone know what they have done to "close the kiosks" while they investigate this? Hopefully more than just power them down, or unplug the network cable...

Awesome
4871 posts

Uber Geek

Trusted
Subscriber

  # 701294 15-Oct-2012 10:23
Send private message

Don't MSD outsource at least some of their IT to Datacom?




Twitter: ajobbins


1498 posts

Uber Geek


  # 701308 15-Oct-2012 10:34
Send private message

eXDee: Because of the likely public outcry against someone who has exposed a serious problem, it would only make it worse for them.


It's still an illegal access of a computer system .. doesn't matter if it was a peice of cake to achieve or really hard.  Say for example it was not a simple thing to achieve and he had to "hack" his way in to the files and then he bragged about it on his blog ... they'd arrest him straight away, how can this be different ?

To my mind it is two different things :

1) He got told how to access files, he made the decision to go off and access those files ... that is where he went wrong he should never ever ever ever gone and done it.  (I can tell you how to get into my neighbours house without the key ... would you go do it ?  And then go through the undies drawer ?)

2) Security for the kiosks at MSD is crap and someone needs dragging over the coals to explain why they were not fully tested out.

Sorry ... people doing stupid things and then getting praised for it erks me ... then I get more erked when stupider (I'm sure that is a word :-) people get all scared about enforcing the law.

1205 posts

Uber Geek

Subscriber

  # 701317 15-Oct-2012 10:38
Send private message

It's still an illegal access of a computer system .. doesn't matter if it was a peice of cake to achieve or really hard.  Say for example it was not a simple thing to achieve and he had to "hack" his way in to the files and then he bragged about it on his blog ... they'd arrest him straight away, how can this be different ?

To my mind it is two different things :

1) He got told how to access files, he made the decision to go off and access those files ... that is where he went wrong he should never ever ever ever gone and done it.  (I can tell you how to get into my neighbours house without the key ... would you go do it ?  And then go through the undies drawer ?)

2) Security for the kiosks at MSD is crap and someone needs dragging over the coals to explain why they were not fully tested out.

Sorry ... people doing stupid things and then getting praised for it erks me ... then I get more erked when stupider (I'm sure that is a word :-) people get all scared about enforcing the law.


And this issue would have been addressed how exactly without this sort of exposure?



4025 posts

Uber Geek

Trusted

  # 701322 15-Oct-2012 10:41
Send private message

From December 2011:
A national review of Work and Income security has been triggered after the ''appalling'' breaches of privacy, which could result in prosecutions.


Right, so we know one of two things
a) This system was set up since then
b) This claim they did a review of security is a pile of BS.

http://www.stuff.co.nz/national/6187390/WINZ-staff-under-fire

932 posts

Ultimate Geek

Trusted

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
View this topic in a long page with up to 500 replies per page Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Ring launches indoor-only security camera
Posted 23-Jan-2020 17:26


New report findings will help schools implement the digital technologies curriculum content
Posted 23-Jan-2020 17:25


N4L to upgrade & support wireless internet inside schools
Posted 23-Jan-2020 17:22


Netflix releases 21 Studio Ghibli works
Posted 22-Jan-2020 11:42


Vodafone integrates eSIM into device and wearable roadmap
Posted 17-Jan-2020 09:45


Do you need this camera app? Group investigates privacy implications
Posted 16-Jan-2020 03:30


JBL launches headphones range designed for gaming
Posted 13-Jan-2020 09:59


Withings introduces ScanWatch wearable combining ECG and sleep apnea detection
Posted 9-Jan-2020 18:34


NZ Police releases public app
Posted 8-Jan-2020 11:43


Suunto 7 combine sports and smart features on new smartwatch generation
Posted 7-Jan-2020 16:06


Intel brings innovation with technology spanning the cloud, network, edge and PC
Posted 7-Jan-2020 15:54


AMD announces high performance desktop and ultrathin laptop processors
Posted 7-Jan-2020 15:42


AMD unveils four new desktop and mobile GPUs including AMD Radeon RX 5600
Posted 7-Jan-2020 15:32


Consolidation in video streaming market with Spark selling Lightbox to Sky
Posted 19-Dec-2019 09:09


Intel introduces cryogenic control chip to enable quantum computers
Posted 10-Dec-2019 21:32



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.