Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

541–550 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#541

Post by mcguire »

strofcon wrote: post #309
bawolff wrote: post #284

Earlier quoted context omitted.

Users don't normally construct urls by hand. Wouldn't the equivalent more be like: You filled out some form to request a document from the irs. You give the form to the person they give you the document. You notice they dont check ids, so you change the name on the form, and get someone else's document. This definitely seems to fit the definition of fraud: 380 (1) Every one who, by deceit, falsehood or other fraudule…

But... they didn't change their name on the form. They literally just said "I'm still me, but I want this other file now, please." All company data was, in OPs scenario, made public to any and all authenticated users. There is no way to rationally spin this as a malicious act, in my view.

No one is claiming "I'm still me, but I want this other file now, please." is a malicious act.

Downloading a number of them and comparing information, however, is not necessarily malicious but rather sketchy.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#542

Post by spoonjim »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

When you went to 342 you were white hat. When you went to 343 you became black hat.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#543

Post by bigiain »

Miraste wrote: post #365
cortesoft wrote: post #339

Earlier quoted context omitted.

Umm, this seems to imply that these security vulnerabilities are intentional, which doesn't seem like what is happening. In your mayor example, you wouldn't go to the mayor because you know he is intentionally trying to break the law, so going to him doesn't make sense. Incompetence is very different than malfeasance.

The problem is that the response, as it pertains to you, is going to be the same for incompetence or malfeasance in a large number of organizations. Consider what the average self-interested politician would do if you uncovered a corruption problem in their administration they did not know about. Are they going to fix the problem, reward you, and risk losing the next election beneath an avalanche of attack ads? Or ar…

> I remember one case where the red team was hired by the agency involved explicitly to perform pentesting, and when they found a vulnerability the government pressed charges!

If the case you’re remembering is the one where the red team assumed (without asking) that physically breaking into the courthouse at night was “in scope” of their engagement, I’m of the opinion the short-sightedness there was not the agency…

https://www.cnbc.com/2019/11/12/iowa-paid-coalfire-to-pen-te...

It’s _maybe_ grey area. But there’s no way I’d escalate a pen test to breaking in to a courthouse without explicit in writing permission from someone clearly authorised to give it, including in writing assurances that all relevant law enforcement had been notified (at least at high levels, if part of the authorised physical pen test was actually testing on-ground law enforcement capabilities).

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#544

Post by _dain_ »

victorhooi wrote: post #536
_dain_ wrote: post #362

Earlier quoted context omitted.

People have gone to jail for incrementing integers in URLs like that (most famously, weev).

Yes, but "weev" is also a well-renowned internet "troll". Basically - he appears to take joy out of denigrating, humiliating, insulting and doxxing other people. https://en.wikipedia.org/wiki/Weev He's also a neo-Nazi and white supremacist. I do believe in free speech, but some of the things he does seem to take it way too far. And he famously doxed Kathy Sierra, a female technical writer who created the Head First s…

Bad laws and a corrupt justice system are infinitely more dangerous than a single man, however unpleasant he may be. People pointed out at the time, that the CFAA is totally broken, but nobody listened because the victim was unsympathetic. Well, now we see in TFA how nothing has changed.

"Yes, I'd give the Devil benefit of law, for my own safety's sake!"

And it should be noted, that weev's turn towards overt neonazism (rather than just antisocial trolling) took place in prison, where he was mistreated.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#545

Post by tremon »

kelnos wrote: post #400
klyrs wrote: post #166

Earlier quoted context omitted.

If I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?

Accessing data that you are not authorized to view is still wrong. The fact that someone has misconfigured the access controls doesn't change that. I might forget to lock my front door one day, but that doesn't make it ok for you to wander into my house and look at all my stuff.

If I send a HTTP request, and the server -who I believe is acting on behalf of the publishing party- sends a 200 OK response along with the data, how am I to conclude I wasn't authorized? Since when is authorization the client's responsibility?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#546

Post by ohazi »

websap wrote: post #535
ajmurmann wrote: post #502

Earlier quoted context omitted.

> I'm not a mobile developer, but it would be interesting if iOS provided a service that allowed data to never leave the phone I'm not sure I follow. Do you mean the app wouldn't be allowed to send any data over the network? As soon as the app can send any data, it's trivial to hide in there whatever the app wants to send home.

My idea is that Apple encourages Apps and features / adds badges for those apps that only store data locally. The local storage should be able to identify different types of data. They provide an API that allows data to be queried so that whenever an App queries some critically of confidential data it throws a big warning.

The developer would just query the sensitive field either immediately or at a seemingly reasonable moment (along with dozens of other sensitive and non-sensitive fields), put everything into a blob, and then send it to the server as an opaque web request to some innocuous looking endpoint like POST /login.

You either have to completely trust the developer today and forever after, or you need to make some fundamental advancements in homomorphic cryptography. "Secure data store that can be queried with a permissions box" doesn't work.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#548

Post by thrwwybnkvln »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I found a similar kind of problem at a bank, though the vulnerability was so simple I stumbled on it by accident. I promptly switched banks but was never brave enough to report it for fear I might wind up in a very bad situation.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#549

Post by kadoban »

Verdex wrote: post #485
TeMPOraL wrote: post #223

Earlier quoted context omitted.

Yeah, in my mind, the only "responsible disclosure" these days is one made anonymously to the local data protection authority.

Reading through these comments gave me the same thought. Notice a problem? Buy a raspberry pi with cash, visit starbucks, upload report about the issue to reporters via newly created (and never used again) gmail account, throw away raspberry pi, never talk or think about the issue again.

Gmail is probably not ideal. Last I tried I needed a phone number to create an account that actually worked.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#550

Post by tremon »

Spivak wrote: post #432
tomrod wrote: post #316

Earlier quoted context omitted.

This is 100% the correct analogy.

But this is assuming that the server has more agency than it does. Servers don't have minds and they don't make authorization decisions. This is more like someone giving you key to a filing cabinet in order to retrieve some documents and while you're there you snoop on the ones next to yours. Is this system more trusting of people than it should be? Probably. Does that mean you're allowed to snoop on other people's d…

But this is assuming that the server has more agency than it does.

No, it merely assumes the server is acting on authority of the organization identified by the domain name. It doesn't assume agency, only representation.

Post reply on HN