Web Based Turbo Tax Disclosure Vulnerability Found

Anonymous MPLS Coward writes "Looks like the web-based Turbo Tax was allowing some users to look at other user's tax return information. Reports state that things like bank routing information was available as well as SSNs. Turbo Tax software was unaffected; the bug is in the web-based Turbo Tax service."

Comments

Penalty for the developers

[davidmillions.com]

Companies should be penalized for something so severe to let them know that they need to do a better job in the future.

Re:Penalty for the developers

[CodeBuster]

Agreed. This is the same kind of crap that I see all of the time from inexperienced developers (especially offshore developers in India). They make all of the classic mistakes, client side javascript for input validation, use of query string parameters with the the SQL command builder on their pages (SQL injections galore), administrative query access to the SQL server directly from the web server, "secret" admin pages, cross-site scripting, you name it and they do it. The problem with a significant portion of the Indian developers is that they are are too busy waving their IIT degree, ISO certs, and other documentation of their extensive education, which taught them everything they needed to know, so they don't need to listen to American devs who have a few lessons left to teach them from school of hard knocks. They suffer from the "not invented here" syndrome, sometimes to an extreme, and thus earn themselves nasty surprises when the attack finally comes and catches them completely flat-footed. The really sad part about all of this is that same types of attacks are used again and again and the same developers keep building vulnerable sites again and again...even long after the attacks are known and proper designs have been presented on many developer forums to avoid these problems (i.e. use stored procedures, limit database permissions to those stored procedures only, don't use the query string for sensitive data, use regular expressions to validate user input data on the server side, etc...)

Wearing Jackets with Bull's Eyes

[bill_mcgonigle]

The Turbotax.com offering really does sound like a good idea, for the taxpayer, but I still bought the boxed version and won't E-File. These guys are taking perhaps millions of people's sensitive data online, into a database that's Internet accessible. Even if their admins have done the best possible job (let's assume they have) their software has undiscovered vulnerabilities, at least as far as the whitehat community is concerned.

Now, factor in the fact that there is a smart blackhat community and this database is about the most delicious thing an high-tech organized-crime-sponsored identity thief can imagine - and sometimes it just doesn't make sense to walk around wearing a jacket with a bull's eye painted on the back, even if you're not a coward.

As far as not E-filing, it also costs the IRS more to process, so that at least helps to keep one more negative about the income tax on the board.

No!

[Bluesman]

Not my bank routing number!

Someone please fix this before someone finds out how to deposit money into my account!

Perhaps we're looking at this the wrong way

[psaunders]

Think of it more as a useful, undocumented feature. Not only can you do your own tax return online, now you can do other people's! Well done to the good folks at Turbo Tax for coming up with it.

Oh, swell!

[Tokerat]

I just filed my taxes with TurboTax Online! Great, now I'm going to be hacked, and then audited and the IRS is going to repossess all of my belon

NO CARRIER

Not the first time this year!

[SD_92104]

It is very scary to see how much value Intuit seems to put to customer's data and how much they learn from past mistakes...

On January 6th this year I received an email from TurboTax Online with the subject
"TurboTax User ID Enclosed: Online Products Now Available!"

Problem being that - in addition to my UserID - it also contained two other (seemingly random) UserID including a live link to their login pages. I tried to be nice and alert them of their security problem but it was not easy. After hunting through the website for a feedback/support link I could only find an online chat with one of their support people. It took me close to an hour to tell her about the problem (it somehow didn't seem to fit into her questionnaire flow chart...) and she promised that she would pass the information on to the tech department and that they would get back to me (yeah, right!). I also asked her repeatedly to delete my account including all data and she said it couldn't be done and that I wouldn't have anything to worry about as the data would be safe on their servers - apparently not.

Guess I should have been a little more aggressive and tell some news outlet about the problem than thinking that their internal procedures and security audits would be sufficient without additional pressure. I decided after that email to never again use the online TurboTax version (I never actually filed from it before as it was a little too limited) and looks like I made a smart choice.

Re:I'll never go near turbo tax again.

[ptbarnett]

You probably made a data entry error in TurboTax -- not necessarily entering the wrong amount, but clicking the "yes" button when you should have clicked "no" (or vice versa).

Based on the difference in taxes ($280 owed vs. $700 refund = net $980) and presuming a 28% marginal tax rate, the difference in taxable income was $980 / 0.28 = 3,500).

The personal exemption was $3,100 for tax year 2004. All you had to do was enter the personal exemption incorrectly (as in accidentally tell it you could were being claimed as a deduction on someone else's return), and you would have gotten the results you observed.

If your taxes were that simple, just looking at the generated 1040 (or 1040A) would have revealed whatever error (yours or theirs) that was occuring. So, I'm skeptical of your claim.