Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

491–500 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#491

Post by codegeek »

0x262d wrote: post #246
idworks1 wrote: post #174

Earlier quoted context omitted.

> echo json_encode($search_results); This is how I found out how much I, and all other contractors were being paid. And also how much the contracting company was actually charging the clients. All the data was being returned in a json but the very little was being displayed. Looking at the story, this is more of a posture thing. I'm sure the Governor is surrounded with people who can tell him that no hacking took pla…

wow, what fraction of websites leak data I want to look at? should I be poking at every non-tech-giant site I go to?

You will be surprised. Do a "Inspect Element" and have fun filtering on "XHR requests". Notice that JSON that a lot of those requests return. but sshhhh, you didn't hear this from me.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#492

Post by samstave »

jjk166 wrote: post #481
dataviz1000 wrote: post #376

Earlier quoted context omitted.

There were cia.gov email addresses in there too. When these guys don't get a joke and fixate on you, they really fixate on you. They are more clingy than that song.

Are you saying that the CIA is never going to give him up?

Well, they're never gonna let him go, that's for sure.

And they may also hurt him.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#493

Post by ncr100 »

joshenberg wrote: post #19

Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.

* https://oa.mo.gov/commissioners-office/news/state-missouri-a...

The State labeling a reporter as "a hacker".

* https://dese.mo.gov/media/pdf/educator-data-incident-commiss... * https://twitter.com/mocommissioner

State Education Commissioner refers to reporter only as a "individual". The Commissioner signs the letterhead "PhD". Sarcastically, I presume the PhD corresponds to the increase in level of correctness, from "hacker" to "individual".

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#494

Post by watchdogtimer »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I found a similar vulnerability in one of our vendors' online order system. I noticed after placing an order an integer in the order confirmation page URL. I reduced it by one and refreshed the page. Sure enough, I got all the order details of the previous customer's sale. Reducing _that_ URL by one got the next previous sale details etc. I notified the company about it. They fixed it, and in gratitude sent me a small package containing a pen and other office kitsch branded with their logo. Not much of a bug bounty, but the pen has proven useful.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#497

Post by throwaway743 »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

Having worked for a NYC government vendor who, unfortunately, outsourced a huge chunk of dev work abroad due to low costs (and I assume the manager's shady relationships with outsourcers), the amount of bugs and blatant negligence I observed in the delivered code was staggering. Even with said mistakes the manager/project managers were more concerned with getting the project out the door, so once delievered, they'd ship usually without internal audit of the code.

It makes one wonder if this is the case with the healthcare site you used, and whether or not this outsourcing of dev is common practice among government vendors? If so, it seems that we can only hope for something to fix these situations, given that government seems to only care once shit hits the fan

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#498

Post by arbuge »

This story just gets worse and worse:

https://news.stlpublicradio.org/government-politics-issues/2...

"Missouri Gov. Mike Parson on Thursday launched a criminal investigation of a St. Louis Post-Dispatch reporter... The investigation begins today, and Parson said the investigation could cost taxpayers as much as $50 million but did not detail those costs or take questions at a news conference Thursday."

$50m over this now? They say never to assume malice when outright incompetence will do, but I'm beginning to wonder if some corrupt dealings involving IT contractors might be going on under the table.

Whichever one it is, at this point I think the governor should just apologize and resign immediately. Not holding my breath.

Edit: Looks like the governor is tweeting about this now. Straight from the horse's mouth:

https://twitter.com/GovParsonMO/status/1448697768311132160

Really couldn't make this stuff up if I tried: "This individual did not have permission to do what they did. They had no authorization to convert and decode the code."

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#499

Post by Talanes »

kelnos wrote: post #456
Dylan16807 wrote: post #321

Earlier quoted context omitted.

I don't think changing the name is a fair comparison. This definition of fraud doesn't define the word "defraud"? I don't know how I'm supposed to see if it fits or not. It can't mean any action, or going into a store, lying about my name, and asking what aisle has baked beans would fit. Because that has "deceit" and "any service". If I interpret things as the service being minimal and provided for free, so that I'm…

The data in this case clearly had value; OP admitted to continuing to change numbers in the URL to get more information about what plans other companies were signing up for, because that information was valuable to them.

You're assuming the "because that information was valuable to them" part. Or you're using such a broad definition of valuable that would also make this comment thread valuable because I have refreshed it multiple times.

While you could construct hypotheticals where OP is using the health plan information to gain actual value, they are all so far-fetched I wouldn't buy them as a fictional plotline. Dude was probably just curious.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#500

Post by dylan604 »

jaywalk wrote: post #411
dylan604 wrote: post #383

Earlier quoted context omitted.

websites attempting to poorly comply with cookie banners and other GDPR regs that block a site from working without accepting something. I just display:none the offending elements and then remove the overflow:hidden. Disabling JS usually works, but sometimes the images in the page are lazy loaded via JS and will not load without.

Here you go: https://chrome.google.com/webstore/detail/super-agent-automa...

Thanks for playing, but I do not use Chrome. Also, I'm a bit perverse in my enjoyment of doing this on my own.
Post reply on HN