Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

311–320 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#311

Post by onychomys »

Buttons840 wrote: post #193

I commented days ago about a state website that was returning all kinds of nicely formatted NPI in JSON from an API response, but the NPI was not displayed. I donned my black hat and other hacker attire and pressed F12 to open the browser's developers tools (a tool created by a shifty company named Google most people have never heard of), and there it was, plain as day, SSNs, addresses, etc. I closed the page and nev…

At least make a throwaway email account somewhere and email the state's IT department to let them know. I doubt it'd ever get fixed (given state budgets), but still.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#312

Post by heavyset_go »

mindcrime wrote: post #163

I try to be an optimistic person, I really do. I try to remind myself that the sky isn't literally falling, and that the world is a more generally pleasant and peaceful place today than what it has been throughout much of history. But. Every time I see something like this, it just about drains my spirit to nothingness. I want to embrace nihilism and just quit giving a fuck about anything or anybody when I see stupidi…

I wouldn't say this is the result of stupidity. This is the result of a governor riling up his base by attacking the press.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#313

Post by BeFlatXIII »

bawolff wrote: post #195
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

> After I shopped a few other companies to see how our plans compared Yeah once you start using a vulnerability maliciously to obtain confidential data for your own personal gain, even if its a stupid vulnerability, you're not really good-guy security researcher anymore. If all you did was the bare minimum to demonstrate the vuln exists, that's cool. If after you do that you continue to use it to obtain confidential…

Oh no, not the heckin' confidential insurance negotiations! What's the worst that can happen by those being exposed?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#314

Post by coliveira »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

It is very easy for IT managers to put the blame on "hackers" intruding into the network, instead of assuming they created an insecure system. In many companies this can work.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#315

Post by giantg2 »

RHSeeger wrote: post #273
AnimalMuppet wrote: post #201

Earlier quoted context omitted.

"You can look like idiots now. Or you can try to keep from looking like idiots, and look like even bigger idiots very quickly. Your choice."

And, in the process, double down and cost the reporter his career and entire life savings as he pays for a lawyer to keep himself out of jail.

Usually the better publications have, or pay for, counsel for work related issues like this.

I don't think this will cost them their career. Every semi-intelligent person can see what's going on. It will certainly create some shortterm headaches though.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#316

Post by tomrod »

formerly_proven wrote: post #245
Dylan16807 wrote: post #222

Earlier quoted context omitted.

Asking for the next file isn't false pretenses. I don't know if this analogy works quite right. Even rifling through a file cabinet wouldn't be false pretenses, it would be something else. And you have to cause injury for it to be fraud. Is "Help I was too honest to a customer." a valid injury claim?

The closest real-life equivalent to asking a computer server for a document and getting it is asking a human server (e.g. office clerk, archivist) for a document and getting it. If I go to the IRS to do some paperwork and notice it says "File #7881991" in the top right corner and I go to the clerk and ask them "Hey, can I have files 7881992 and 7881993, too?" and they give them to me , who is liable for that? It's qu…

This is 100% the correct analogy.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#317

Post by fooqux »

bryanrasmussen wrote: post #287
formerly_proven wrote: post #180

Earlier quoted context omitted.

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator. It's pretty obvious that when you find…

this is a poor analogy because the IT department isn't doing something illegal, they are just doing something poorly, the proper analogy would be if you found out the mayor routinely left the special stamp that you can use to get anyone released from jail laying on the park bench he eats lunch at - do you then go around telling people hey the mayor does this or do you say hey mayor please stop taking that stamp with…

> this is a poor analogy because the IT department isn't doing something illegal

At what point does it cross the line into IT malpractice? I would say that not even bothering to verify the current user has the access to view what is being requested is well over that line.

When you're dealing with PII, HIPAA, etc, there should be a standard level of competence. If I go into a doctor's office with a runny nose, and they remove my liver, simply stating that they practiced medicine "poorly" shouldn't be a defense.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#318

Post by rpdillon »

bawolff wrote: post #202
klyrs wrote: post #166

Earlier quoted context omitted.

If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?

In real life, if you do it under false pretenses, you are. In this analogy the real-world version would be considered fraud.

Not sure I see how. More like the records office decided that, rather than staffing the front desk to handle records requests, they instead just dumped an unlocked filing cabinet into an alcove off the hallway with an arrow pointing to it labelled "Health Care Plans". Essentially identical to blaming users for finding an unsecured S3 bucket or MongoDB instance: it's on the operator to secure the data.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#319

Post by fshbbdssbbgdd »

Keyframe wrote: post #256
pwillia7 wrote: post #216

Earlier quoted context omitted.

I was thinking of a similar analogy but I don't think it holds. The right analogy would be if I was in the apartment complex and I said to a door not mine "I'm home open up!" If the door opened and I did it intentionally, am I liable? I still feel like yes but since you have to request the document and receive it I think it's different than just checking locks.

I think we're all gronw-ups here and don't need analogies here.

People of all ages suffer from confirmation bias. Analogies can be useful because they allow someone to appreciate the logic of an argument while temporarily dissociating from strongly-held opinions. After the framing moves back to the question under debate, the logic might stick. At least all parties might understand everyone’s perspective better after a few analogies are exchanged.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#320

Post by bawolff »

strofcon wrote: post #309
bawolff wrote: post #284

Earlier quoted context omitted.

Users don't normally construct urls by hand. Wouldn't the equivalent more be like: You filled out some form to request a document from the irs. You give the form to the person they give you the document. You notice they dont check ids, so you change the name on the form, and get someone else's document. This definitely seems to fit the definition of fraud: 380 (1) Every one who, by deceit, falsehood or other fraudule…

But... they didn't change their name on the form. They literally just said "I'm still me, but I want this other file now, please." All company data was, in OPs scenario, made public to any and all authenticated users. There is no way to rationally spin this as a malicious act, in my view.

Well they changed an id number. I guess the real life version would be changing the SSN number on the form.
Post reply on HN