Slashdot Mirror
GSA Bidding Site Compromised By Flaw
thomville writes "NY Times reports that eOffer, the government site allowing on-line bids for contracting government computer services, allowed viewing and modification of other contractor's corporate and financial data." From the article: "The security flaw, which could have permitted contractor fraud, was reported to the agency's inspector general on Dec. 22, but almost three weeks passed before the system was taken offline Wednesday afternoon. The General Services Administration is the federal agency responsible for procuring equipment and services, including computer security technology, making the lapse all the more striking. 'This is the government entity responsible for letting contracts for security,' said Mark Rasch, chief security counsel for Solutionary, a security firm. 'Clearly the people who log in would know about security.'"
move along...
First Military intelligence was considered an oxymoron, and now the govermnent gives us Government Computer Security ??? This is a surprise? This is news? Wow, and to think, next thing you know, they'll be outsourcing tax processing to India... oh, wait....
Never mind
Support NYCountryLawyer RIAA vs People
Could have? So it didn't happen? Did Halliburton suddenly feel a swell of moral responsibility?
The site used digital certs to protect authentication, so it wasn't amtter of the wrong users getting in. But once inside, clearly there's a problem with access rights (the app probably accessed all records as privleged user) and coding.
Actually, it is possible that the GSA waited with the response on purpose. At least this is what I used to do on a MUD -- carefully logging every action, in an attempt to get a list of the crooks. The bastards would then get slapped with appropiate action, including revoking gains for a period in the past. This would make them appropiately punished as opposed to simply fixing the flaw and let them slide.
This assumes some competency on the GSA's part -- but oh well, whom am I kidding?
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Having seen how the Gov't works in regards to computer systems, this is no surprise. Something gets reported, sits in an inbox, is read by someone who doesn't care, so they forward it to someone else.. eventually, it hits the inbox of someone who cares. This person is the exception, not the rule. As soon as someone becomes a federal government employee, you can almost watch as they just stop giving a damn about anything.
Did they find who left the Sony Music CD in the drive when they were done listening?
"Beware of he who would deny you access to information, for in his heart he dreams himself your master."
...is this the result of another brilliant recess appointment of an unqualified person to a government post? ;-)
Shop as usual. And avoid panic buying.
Since the morning seems to be slow, allow me to help get it going right.
If it were me doing it, I'd throw out lots of data, but all of it pretty much bunk. Makes things seem more realistic, while in reality making them useless.
For a number of the government employees it's not only that they stop giving a damn about anything. It's that after the repeated shitkickings and abuse they get for giving a damn either 1)their spirit gets broken, 2) they get out of the civil service before their spirit gets broken and tehy start not gioving a damn or 3)they become real nasty/skilled individuals who the senior bureaucrats are afraid to mess with.
This kind of flaw is hard to fix, not because of the single flaw, but because it is likely that most other components of the system would have the same flaw, that is, if the system has lots of subdata "owned" by someone, fixing one flaw and going public about it would just have made people poke and prod at the other flaws.
I'm still trying to figure out what people mean by 'social skills' here.
The security flaw, which would have permitted contractor fraud
There is no uncertainty, and it is wrong to suggest that there might be. It just makes the mistake seem less vital.
Whether or not someone used that flaw to commit wrongdoing is irrelevant. The capability did exist.
For those that think this is unnecessary grammar nazism, there is a difference between fact and probability.
For example, if you were to leave a gate open on a field of cattle, then you would have allowed the cattle to escape. to say that you could have allowed them to escape twists the facts. An open gate does, in fact allow cattle to escape.
If however, you shut the gate but didn't fasten the bolt correctly, then you could claim that the cattle could have escaped, because there was an element of uncertainty.
A small point but important, especially in these days of endless corporate spin and EULAs.
Apply Occam's Razor. Select the most likely of the two following scenarios:
1. The programmers of the bidding site were actually incompetent enough to oversee this very obvious flaw.
2. The GSA ordered a backdoor in the system to manipulate the biddings and to allow bribes to flow easier.
Apply Occam's Razor. Select the most likely of the two following scenarios:
1. The programmers of the bidding site were actually incompetent enough to oversee this very obvious flaw.
2. The GSA ordered a backdoor in the system to manipulate the biddings and to allow bribes to flow easier.
Unfortunately, this is a case where both A *and* B have both equal possibilities.
Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
It turns out that a feature/flaw on Rogers' website allowed you to check to see what cable channels your neighbours subscribed to. All you needed was a subscriber's name, phone number, and postal code (easily available information), and you could find out if the neighbours were subscribing to the Hustler Channel or Hard On Pridevision. Funny shit. Unfortunately Rogers fixed the problem.
http://www.thinkcomputer.com/corporate/news/restas sured.pdf
'Shiftless' has to be my all time favorite adjective for describing colored folks. Bravo!
Have you tried to get help from customer services of any large private organisation? Same thing
It doesn't get much better than this in US Government. Some agencies and departments are more formal about security, but that formality often consists of laborious compliance with irrelevant procedures by individuals who know only how to follow their own misinterpretation of the "the book".
Exploits trigger overreactions. If a password is hacked, the new requirement will be for weekly changes to passwords of at least 16 characters, including at least 4 each of alphabetic, numeric, symbol. The predictable result is that all the passwords are written on yellow stickies on the monitor bezels. But procedures have been enforced!
The difference is subtle (and probably a bit less likely), yet highly interesting!!
(Recall that a foreman oversees his employees)
from tfa:
"The system relies, rather stupidly, on making it difficult to get in in the first place, by forcing you to get a client certificate for your browser," a mechanism for establishing the user's identity, said Mark Seiden, a security consultant who perform tests for corporations. "Well, the 9/11 hijackers also had authentic drivers' licenses..."
is this as moronic a statement as it appears?