Slashdot Mirror

← Back to Stories (view on slashdot.org)

Web Based Turbo Tax Disclosure Vulnerability Found

Posted by samzenpus on from the whose-taxes-do-you-want-to-pay dept.

Anonymous MPLS Coward writes "Looks like the web-based Turbo Tax was allowing some users to look at other user's tax return information. Reports state that things like bank routing information was available as well as SSNs. Turbo Tax software was unaffected; the bug is in the web-based Turbo Tax service."

3 of 110 comments (clear)

  1. Penalty for the developers by davidmillions.com · · Score: 5, Insightful

    Companies should be penalized for something so severe to let them know that they need to do a better job in the future.

    --
    My Own Millions Blog
  2. Wearing Jackets with Bull's Eyes by bill_mcgonigle · · Score: 4, Insightful

    The Turbotax.com offering really does sound like a good idea, for the taxpayer, but I still bought the boxed version and won't E-File. These guys are taking perhaps millions of people's sensitive data online, into a database that's Internet accessible. Even if their admins have done the best possible job (let's assume they have) their software has undiscovered vulnerabilities, at least as far as the whitehat community is concerned.

    Now, factor in the fact that there is a smart blackhat community and this database is about the most delicious thing an high-tech organized-crime-sponsored identity thief can imagine - and sometimes it just doesn't make sense to walk around wearing a jacket with a bull's eye painted on the back, even if you're not a coward.

    As far as not E-filing, it also costs the IRS more to process, so that at least helps to keep one more negative about the income tax on the board.

    --
    My God, it's Full of Source!
    OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
  3. Re:I'll never go near turbo tax again. by ptbarnett · · Score: 5, Insightful
    You probably made a data entry error in TurboTax -- not necessarily entering the wrong amount, but clicking the "yes" button when you should have clicked "no" (or vice versa).

    Based on the difference in taxes ($280 owed vs. $700 refund = net $980) and presuming a 28% marginal tax rate, the difference in taxable income was $980 / 0.28 = 3,500).

    The personal exemption was $3,100 for tax year 2004. All you had to do was enter the personal exemption incorrectly (as in accidentally tell it you could were being claimed as a deduction on someone else's return), and you would have gotten the results you observed.

    If your taxes were that simple, just looking at the generated 1040 (or 1040A) would have revealed whatever error (yours or theirs) that was occuring. So, I'm skeptical of your claim.