Newspaper "Hacks Into" Aussie Gov't Website By Guessing URL

Wouldn't it have been easier by NotQuiteReal · 2010-02-23 03:59 · Score: 1

To just Google what they wanted to know? Google even has a "url" specifier!

--
This issue is a bit more complicated than you think.

Re:Wouldn't it have been easier by miggyb · 2010-02-23 04:05 · Score: 3, Informative

Google is already a dangerous hacker tool.

--
This signature serves no purpose other than to help you see which posts were made by me.
Re:Wouldn't it have been easier by SatanClauz · 2010-02-23 04:18 · Score: 1

I didn't see this personally, but the person that told me would not have known to make this up or do it on his own.
Picture this:
work laptop in work car
employee opens laptop to use it
employee happens to be down town in business areas
auto-connects to some strong wifi (this was a few years ago before things were pseudo-secure from the box)
accidentally opens the viewer for our in-house security cameras
camera software auto-scans for feeds
employee finds this hilarious and calls to tell about how he is looking at server rooms and hallways in some building
needless to say, that made my day.
Re:Wouldn't it have been easier by Anonymous Coward · 2010-02-23 04:44 · Score: 1, Insightful

Well, considering that he accessed an unknown wireless network and didn't have the laptop configured to VPN back to a trusted network, he was lucky that he just stumbled upon someone even less security-minded than himself.
Proper configuration is not to connect to unknown wireless networks and only configure WPA(2) protected networks. Autoconnecting to unsecured networks is just as stupid as offering them.
Re:Wouldn't it have been easier by SatanicPuppy · 2010-02-23 04:54 · Score: 5, Insightful

The problem with that analogy is that passwords are by default 2 factor authentication: you need a username and a password.
That's not really the case with a url. A better analogy would be walking around a building on a public street, and looking in windows. It's legal, but morally suspect.

--
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Re:Wouldn't it have been easier by Bengie · 2010-02-23 04:55 · Score: 1

A better analogy would be calling random phone numbers to see if you get any to ring. When you finally get a phone number to ring, it has a voice mail on it and doesn't even prompt for a password.
Re:Wouldn't it have been easier by GizmoToy · 2010-02-23 04:58 · Score: 5, Insightful

I wouldn't call putting something up on the internet, completely out in the open with no protection whatsoever, and then simply hoping no one will find it because you didn't announce its presence, "essentially a password".
If the internet is a forest and I protect my valuables by sitting them underneath a tree far from civilization and tell no one they're there, should I be mad if someone looking around the forest for valuables takes them all? No. Either you don't put your valuables in the forest or you put them in a big honking safe that no one can break into or walk off with.
Re:Wouldn't it have been easier by paiute · 2010-02-23 04:59 · Score: 4, Insightful

A secret URL is essentially a password
More like an unlisted phone number.

--
If Slashdot were chemistry it would look like this:Cadaverine
Re:Wouldn't it have been easier by SatanClauz · 2010-02-23 05:01 · Score: 1

Yes, it is bad to auto connect.
Things were different back-in-the-day, remember?
It is really sad to see things like this happen today.
Re:Wouldn't it have been easier by Anonymous Coward · 2010-02-23 05:01 · Score: 1, Insightful

A better analogy would be walking around a building on a public street, and looking in windows. It's legal, but morally suspect.
Unless you're a newspaper researching what your government is up to - in which case it's your job.
Re:Wouldn't it have been easier by Linuxmonger · 2010-02-23 05:07 · Score: 1

It was three factor, you needed to know the domain first, then the specific server, then the specific pathname on that domain/server. Kudos to the press for having the inside information on the first two, then the perseverance to discover the third.
Re:Wouldn't it have been easier by Anonymous Coward · 2010-02-23 05:19 · Score: 0

http://domain/user/password/filename
the analogy is pretty reasonable.
Re:Wouldn't it have been easier by schon · 2010-02-23 05:24 · Score: 5, Informative

Sorry, but the submitter got at wrong.
No, you did.

A secret URL is essentially a password
Wrong. There is no such thing as a 'secret' URL. This was an unpublished URL, which is not the same thing as a secret.
A secret is something that everybody involved knows not to divulge. A HTTP URL is transmitted in plaintext, URLs are stored in plaintext in your browser's history, they are sent as a referrer when you click on a link in a page or when you load an external element, they are stored in plaintext in your server's logs - they are the exact opposite of secret.
Re:Wouldn't it have been easier by Anonymous Coward · 2010-02-23 05:31 · Score: 1, Informative

A string anybody can guess with enough persistence? Why even bother with the "correction"? Passwords have the same weakness as "unlisted numbers" and "secret URLs". They mitigate it by using enormous key spaces. URL key spaces are of comparable size to password key spaces. The problem is using a crap secret, not merely keeping a secret.
Re:Wouldn't it have been easier by rbochan · 2010-02-23 05:41 · Score: 1

Sorry, but the submitter got at wrong. A secret URL is essentially a password - so attempting lots of funny URLs can be like trying lots of ssh logins. The problem here is that it was a weak password, not that they used a secret URL...
Do you work for the Tuttle, OK government?

--
...Rob
The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
Re:Wouldn't it have been easier by Anonymous Coward · 2010-02-23 06:08 · Score: 0

What if someone comes driving by with a backhoe, takes your big honking safe with your valuables in it? Just because you can take something doesn't mean it is right or legal to take it. There is a gray area between properly secured and out in the open. If the only protection is a secret URL, it depends on how you got the URL and what your intention was. Did it appear as a search result? Did you brute force it? Did you click on a referer link in your web server stats? Did you type in what an informant told you?
Re:Wouldn't it have been easier by BrokenHalo · 2010-02-23 06:10 · Score: 1

It's legal, but morally suspect.

Why? URL stands for Uniform Resource Locator. The whole point of it is to locate content. The fact that no-one has stood on the roof of the NSW parliament building yelling "Go to this address!" through a bullhorn doesn't mean it's "secret".

It certainly isn't secret if it is resolved through a standard DNS query. And since when is querying a DNS "morally suspect"?
Re:Wouldn't it have been easier by gnasher719 · 2010-02-23 06:19 · Score: 1

More like an unlisted phone number.
More like if we had a phone system where you typed in the name of the person you want to call and it connects, and you type in the name of a person who isn't listed in the official phone directory.
Re:Wouldn't it have been easier by Actually,+I+do+RTFA · 2010-02-23 06:51 · Score: 1

The problem with that analogy is that passwords are by default 2 factor authentication: you need a username and a password.
2 factor authentication implies two different types of authentication. These types are both information you know, and thus one-factor. It can easily be proven that a username(max length u1)/password(max length p1) combination is as secure as just a password(max length u1+p1).

--
Your ad here. Ask me how!
Re:Wouldn't it have been easier by Anonymous Coward · 2010-02-23 06:53 · Score: 0

The problem with that analogy is that passwords are by default 2 factor authentication: you need a username and a password.
A username and a password are NOT two-factor authentication. Two-factor authentication involves something you HAVE (an RSA token, for example) and something you KNOW (a username and password). The token generates a one-time code that is authenticated against a server. That's the real power behind two-factor authentication. Without the token to generate a verifiable code, the username and password are useless.
Re:Wouldn't it have been easier by Anonymous Coward · 2010-02-23 07:01 · Score: 0

Passwords are not 2-factor authentication. A card and PIN is an example of 2-factor authentication: something you have (card) and something you know (PIN). User/pass is just something you know.
this URL employs both username and pass: ftp://user:pass@ftp.example.com
Re:Wouldn't it have been easier by quickOnTheUptake · 2010-02-23 07:04 · Score: 1

Another difference is that URLs are not designed to be secret. This is evidenced by the fact that a good password system a) gives no feedback (i.e., doesn't tell you which of the two factors was incorrect) b) often will have a forced pause between attempts c) often will have a forced lock-out after some relatively low number of failed attempts. This makes bruteforcing a pw considerable less feasible. Most http servers don't have any such mechanisms in place, precisely because URLs aren't supposed to be secret (thus transfered and stored in plaintext etc).

--
Mod points: Guaranteed to remove your sense of humor.
Side effects may include gullibility and temporary retardation
Re:Wouldn't it have been easier by Itninja · 2010-02-23 07:09 · Score: 1

That is not even remotely accurate. The three factors of security are: something you have (like a door key or credit card), something you know (like a username or password), and something you are (like a fingerprint or a geographic location). A username/password combo is just duplicate single factor security.

--
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
Re:Wouldn't it have been easier by Homburg · 2010-02-23 07:29 · Score: 1

A secret URL is essentially a password - so attempting lots of funny URLs can be like trying lots of ssh logins.
Well, if they had used an intentionally hard-to-guess URL (like, say, the ones Google uses for shared calendars) you might have a point. But, from the article, they simply used the URL which would become the public URL once announced, nswtransportblueprint.com.au . They didn't have to try lots of URLs to defeat any kind of secrecy; they simply accessed an obvious, public URL, that the government hadn't yet officially announced.
Re:Wouldn't it have been easier by pentalive · 2010-02-23 07:36 · Score: 1

Password and Username are both "something you know" therefore that represents a one factor authentication. To have more than one factor you need to add either "Something you are" or "Something you have"
(Just finished with that chapter in my BS-ISS program)
Re:Wouldn't it have been easier by Anonymous Coward · 2010-02-23 07:42 · Score: 0

The problem with that analogy is that passwords are by default 2 factor authentication: you need a username and a password.
That's not really the case with a url. A better analogy would be walking around a building on a public street, and looking in windows. It's legal, but morally suspect.
Fail. A username is an identifier, not an authentication factor; a password is a shared-secret authenticator (i.e. a single factor of the "something you know" variety). To be considered two-factor, you'd have to add a 2nd - either a "something you have" (token, smartcard, etc) or a "something you are" (biometric) factor.
Re:Wouldn't it have been easier by Demonantis · 2010-02-23 07:47 · Score: 1

That analog would mean that every time I type a url in the wrong way then I was hacking. They only picked the lock once really and that would be when they got it right and that doesn't make sense. Any possible analogy would be akin trespassing or mischief, but that would not make sense because that would suggest you can own parts of the internet. Any real world analogy does not absolutely relate to what they did because it involves information.
Re:Wouldn't it have been easier by Fluffeh · 2010-02-23 09:08 · Score: 1

What if someone comes driving by with a backhoe, takes your big honking safe with your valuables in it? Just because you can take something doesn't mean it is right or legal to take it.
If someone did that you might THEN be able to argue that your stuff was yours, and that no-one should have nicked it. If it's just lying under a tree and someone picks it up, you can't really complain.

--
Moved to http://soylentnews.org/. You are invited to join us too!
Re:Wouldn't it have been easier by HTH+NE1 · 2010-02-23 09:50 · Score: 1

More like an unlisted phone number.
More like an unpublished phone number.
An unpublished number is not printed in your white pages, but will still be disclosed by directory assistance for by-name queries. An truly unlisted number won't even be provided by directory assistance.

--
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
Re:Wouldn't it have been easier by samson13 · 2010-02-23 09:50 · Score: 1

A better analogy.
Your walking down the street in the business district (it was a com domain). Your wearing your press hat (your coming from a press computer). One of you friends says you should check out the transport planning office. You walk up to the building labeled "transport planning office" and the automatic doors open in a welcoming way. You look around the foyer and there are posters saying all sorts of interesting stuff about plans for buses, trains and cycling etc. There are no posters saying bugger off this is still draft and private.
I wouldn't feel like I'd done anything immoral by reading them. If I was a reporter I'd report on what I'd read as well.
If you put something in a public place and don't provide a mechanism to keep people out like locking the doors or putting a keep out sign up then it is public.
Re:Wouldn't it have been easier by GizmoToy · 2010-02-23 10:24 · Score: 1

Exactly, the analogy holds for the case the AC presents. No security method is foolproof, but you made a reasonable effort to secure your belongings.
Leaving it out in the open for others to find is not such an effort. Of course, I suppose to make analogy even more accurate it wouldn't involve taking belongings, but rather merely viewing them and protecting them from view.
Re:Wouldn't it have been easier by Thinboy00 · 2010-02-23 10:45 · Score: 1

Are you kidding me? They made this data accessible on the public internet. I once read about a case where some kook had a website with a CGI file. Supposedly, accessing www.example.com/delete.cgi?file=example.txt (names changed to protect the guilty and because my memory sucks) would delete the file example.txt from the server. He then tried to claim that it was illegal for people to go to that URL and that he would... I don't even know what he actually intended to do about it but I think he was threatening to sue people over this. Moral of the story: If something is accessible on the public internet, you cannot assume noone will look at it/access it/whatever. If something is routable, you should assume it will be accessed. The government could easily have made this non-routable (behind a firewall or NAT router or something) or offline (don't plug in the ethernet; it's really that easy) or not a server (don't run Apache if you don't want people to look in /var/www or wherever) or password protected (unlike domain name records, passwords are not publicly accessible records that anyone with time can read). Any of those things would have been trivial to set up, and it is totally the government's fault for leaving a gaping hole there.

--
$ make available
Re:Wouldn't it have been easier by cojoco · 2010-02-23 13:09 · Score: 1

This analogy is appalling.
For a start, I think you would be justified if someone nicks your stuff, and it is definitely illegal.
However, information is *not* property, and nobody has actually stolen anything.
Re:Wouldn't it have been easier by complete+loony · 2010-02-23 16:35 · Score: 1

http://slashdot.org/index.pl?op=userlogin&logtoken=611928::[randomstring]
So if I fetch the above URL repeatedly and try to brute force a valid logtoken, this isn't the same as the "Hack" in TFA?
Not that I'm really trying to disagree with you. The search space in this case is about 1 in 1e83 depending on the characters used. A publicly accessible url with no authentication, and a short guessable id number is no protection whatsoever.

--
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Re:Wouldn't it have been easier by jotok · 2010-02-23 21:43 · Score: 1

It's sad that some people consider 2007 to be "back in the day."
Re:Wouldn't it have been easier by quadrox · 2010-02-23 21:59 · Score: 1

not having RTFA and only RTFS, a slightly improvement to your analogy would be having to find the somewhat obscure/hidden entrance to that office. I.e. there are no big signs around saying "secret office this way" or "enter here".
Re:Wouldn't it have been easier by GizmoToy · 2010-02-24 01:25 · Score: 1

Well, as I said in a later post, you can improve it by changing the theft of the property to simply the viewing of the property. Then it's much more appropriate.
Re:Wouldn't it have been easier by slater86 · 2010-02-24 14:00 · Score: 1

I think you'll find that username and password are still only single factor, as they're both something you know.
you'd still need a something you are or something you have to go along with that
http://en.wikipedia.org/wiki/Two-factor_authentication#Two-factor_Authentication_Overview

--
When people ask if I'm an optimist, I say "I hope so". --Bill Bailey
Re:Wouldn't it have been easier by countach · 2010-02-24 18:22 · Score: 1

That's funny. I would then say, don't visit those URLs of delete.cgi, just make a whole lot of links on your own web site to things like delete.cgi?file=/config.sys etc, and wait for Google to spider it and follow the links. See if he wants to sue Google.

Was it... by The+Wild+Norseman · 2010-02-23 04:01 · Score: 5, Funny

http://www.australia.gov.au/backdoor ?

--
"A government is a body of people usually -- notably -- ungoverned." -Shepherd Book

Re:Was it... by Anonymous Coward · 2010-02-23 04:08 · Score: 0

No, it was nswtransportblueprint.com.au. They didn't even have to do any guessing; they got a tip for what the URL of the web site was, and they went there. There were no secret URLs to go to, they just went to the web site, and printed everything they could navigate to.
Re:Was it... by Anonymous Coward · 2010-02-23 04:46 · Score: 0

Don't you mean http://www.australia.gov.au/sheeps_backdoor?
Re:Was it... by Wowsers · 2010-02-23 04:46 · Score: 2, Insightful

It wasn't even a back door, the front door was wide open!

--
Take Nobody's Word For It.
Re:Was it... by tomhudson · 2010-02-23 04:58 · Score: 3, Informative

It was : http://nswtransportblueprint.com.au/project
And it's not open any more - nswtransportblueprint.com.au is now completely off-line.
So they went from Security through Obscurity to Streisand Effect to Slashdot Effect ... but now that their server has melted, at least nobody can "hack" it, so I guess they're happy campers.
Re:Was it... by The+Wild+Norseman · 2010-02-23 05:01 · Score: 1

It wasn't even a back door, the front door was wide open!
How would you know... unless you WERE ONE OF THE HACKERS?!?!

--
"A government is a body of people usually -- notably -- ungoverned." -Shepherd Book
Re:Was it... by BrokenHalo · 2010-02-23 06:16 · Score: 1

but now that their server has melted, at least nobody can "hack" it

No, these guys are so clueless, they probably just "solved" their little problem by pulling the power-plug.
Re:Was it... by Anonymous Coward · 2010-02-23 06:27 · Score: 0

Checking into this I was shocked to find that http://www.australia.gov.au/secret_files and http://www.australia.gov.au/super_secret_files and http://www.australia.gov.au/ultra_super_secret_files were not secured with a password protected login! If I get the nerve up I'm going to see if I can find the PMs pron protected with Username: username Password: password
Wish me luck,
l33t3r k1Dz
Re:Was it... by BryanL · 2010-02-23 06:37 · Score: 1

I am so afraid to click that link.
Re:Was it... by Anonymous Coward · 2010-02-23 07:02 · Score: 5, Funny

reminds me of the time i hacked my friend's fridge for a can of beer when he was out of the room for a moment
Re:Was it... by Fluffeh · 2010-02-23 09:12 · Score: 1

reminds me of the time i hacked my friend's fridge for a can of beer when he was out of the room for a moment
Gawd, why did I not see and then mod Funny this utter GEM before I posted.

--
Moved to http://soylentnews.org/. You are invited to join us too!
Re:Was it... by Anonymous Coward · 2010-02-23 11:12 · Score: 0

Google has the page cached, in case anyone wants to see what boring stuff everyone is so excited about.
http://66.102.9.132/search?q=cache:http://nswtransportblueprint.com.au/project
Re:Was it... by Anonymous Coward · 2010-02-23 13:40 · Score: 0

although i am looking at the cached version from google, did google hack australia?
everybody knows whats on the internets stays on the internets...

Two Robots in Front of a Judge by eldavojohn · 2010-02-23 04:04 · Score: 5, Funny

NSW Lawyer: You allege that the Sydney Morning Herald sent repeatedly sent liscivious requests to you, is that correct?
NSW Server: *nods solemnly*
NSW Lawyer: I see ... and just exactly how many times were you violated?
NSW Server: *pauses and swallows loudly* Three ... three thousand seven hudred and twenty seven.
*crowd gasps*
NSW Lawyer: I see. Now, I know this is hard for you but could you please point to where, exactly, on this anatomically correct server doll the Sydney Morning Herald accessed you from.
NSW Server: *turns the server doll over and motions to the ports* Here on the back, in my ethernet port.
*sounds of disgust ripple through the crowd*
NSW Lawyer: And what did he say to you when this was happening?
NSW Server: GET.
NSW Lawyer: 'GET' what?
NSW Server: He just kept saying GET, GET, GET! GET this document. GET that document.
NSW Lawyer: And did you get it for him?
NSW Server: No it didn't exist! They just weren't there!
NSW Lawyer: And what did you say exactly!
NSW Server: 404! 404, goddammit, 404 ... *breaks down sobbing* I didn't know what he wanted from me until it was too late!!!
NSW Lawyer: There there. There there, it's okay. You're safe now. *turns to the judge* Can we let this sort of gross injustice go unpunished in today's society? How long before this happens to your server? Or ... your child's server?! Huh?
NSW Judge: *nods approvingly*
NSW Lawyer: I rest my case.

--
My work here is dung.

Re:Two Robots in Front of a Judge by Chrisq · 2010-02-23 04:17 · Score: 1

Just imagine how many "hits" they will be getting now they are on slashdot!They do seem to have removed their DNS records. Interestingly the domain belongs to
Domain Name: nswtransportblueprint.com.au

Registrant: BANG THE TABLE PTY LIMITED

Registrant Contact ID: R-000428733-SN
Registrant Contact Name: Karthik Reddy
Registrant Contact Email: Visit whois.ausregistry.com.au for Web based WhoIs

Name Server: ns10.dnsmadeeasy.com
Name Server: ns11.dnsmadeeasy.com
Re:Two Robots in Front of a Judge by Anonymous Coward · 2010-02-23 04:18 · Score: 1, Funny

Yeah, exxxxxxxactttlllyyyyy
Re:Two Robots in Front of a Judge by SeeSp0tRun · 2010-02-23 04:33 · Score: 1

I want to mod this up again, too funny!

IANAL, but what happened is akin to entering without permission. It kind of gets fuzzy where it was made publicly available, but not publicly broadcast.

--
Something witty.
Re:Two Robots in Front of a Judge by elrous0 · 2010-02-23 04:47 · Score: 2

As someone whose own server got rooted once, I sympathize.

--
SJW: Someone who has run out of real oppression, and has to fake it.
Re:Two Robots in Front of a Judge by dancingmilk · 2010-02-23 04:48 · Score: 1

This made my day, thank you.
Re:Two Robots in Front of a Judge by kalirion · 2010-02-23 04:50 · Score: 3, Insightful

If you put a billboard in a back alley, is it "private look only" just because you don't advertise its existence with a billboard on a major highway?
Re:Two Robots in Front of a Judge by Talderas · 2010-02-23 04:56 · Score: 1

Bang the table?

--
"Lack of speed can be overcome. In the worst case by patience." --Znork
Re:Two Robots in Front of a Judge by blackraven14250 · 2010-02-23 05:25 · Score: 1

A front "company" named for the times when he big boss goes "that's enough!"
Re:Two Robots in Front of a Judge by HungryHobo · 2010-02-23 05:28 · Score: 1

Oh god, if I had mod points I wouldn't just mod this up, I'd track down all your other posts and mode them up too!
This is the most glorious....
Re:Two Robots in Front of a Judge by HungryHobo · 2010-02-23 05:31 · Score: 5, Insightful

It's like getting an unlisted telephone number and using your secret plans as your answering machine message.
Nothing like entering without permission.
Re:Two Robots in Front of a Judge by scdeimos · 2010-02-23 12:02 · Score: 1

It's like parking your car outside a convenience store with the keys in the ignition and the engine still running, along with your US Customs-issued firearm sitting on the front seat, and then complaining about your car being "stolen". Dumbasses.

Urgent notification to all: by 140Mandak262Jamuna · 2010-02-23 04:06 · Score: 5, Funny

Dear NSW Transportation Dept Employee,

We have enhanced the security of our secret intranet site with immediate effect. The new enhanced security intranet site is SECRETnswtransportblueprint.com Please update your bookmarks. To allow our braindead minister who can not remember a password and is frightened when confronted with a login dialog to use the site, we have disabled the login requirements for all. So please keep the url confidential.

Signed

Assistant to the Minister D Umbi Diot

--
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact

Re:Urgent notification to all: by delinear · 2010-02-23 05:19 · Score: 1

This is modded funny, and it is, but it's also most likely true. Having been in the same situation with a prominent UK gov site I can confirm that it was frequently the practise to put unpublished URLs live without authentication so that the high-ups could access them (we had dev and test environments but their firewalls were locked down and their IT guys wouldn't open them up, they were loathe to open them even for the people who needed them for development and testing!).
Eventually after the URLs escaped and got in front of the wrong people a few times, they consented to basic authentication, and then proceeded to email around the username and password (they wouldn't let us create them unique ones!) to everyone so they, too escaped. We'd have to change the authentication every 3-4 weeks and suffer the high-ups sending around condescending emails telling everyone not to share the login details, even though we all knew it was them letting them slip.

Deja vu again once more by Hognoxious · 2010-02-23 04:06 · Score: 2, Insightful

Wasn't there a story like this about ten years ago, but it was something concerning grades or test scores on a college website?

--
Confucius say, "Find worm in apple - bad. Find half a worm - worse."

Re:Deja vu again once more by Yvanhoe · 2010-02-23 04:17 · Score: 3, Funny

Yeah, at this time we were supposing governments would be a bit more cautious than schools.

--
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
Re:Deja vu again once more by i-like-burritos · 2010-02-23 04:26 · Score: 1

Heh, I've gotten the actual answers to a test that hadn't happened yet by guessing the URL.
Re:Deja vu again once more by ottothecow · 2010-02-23 05:07 · Score: 1

I've seen that work with solutions to homework...
However, I think the parent was referring to to the harvard admissions website (business school maybe?) where people could figure out if they got in early by playing with the URL. IIRC Harvard took the douche route and decided not to admit those who tried this. I would hope they eventually realized that when someone posts simple URL changing instructions to a business website, peoples curiosity will kick in...

--
Bottles.
Re:Deja vu again once more by dlgeek · 2010-02-23 05:58 · Score: 2, Interesting

Yes it was Harvard Business School (and Stanford and somewhere else that I don't remember) and they denied admissions to the students who did it. A year or two later, Cornell had the same issue with their undergrad early admits (you could log in and then change the url from something like /profile.cfm to /decision.cfm). They posted a statement saying "A group of students at (some discussion forum) figured out blah. These students could not access any information other than their own, no privacy was breached and no action will be taken against the students." I checked out the forum, and one of the students posted an email where he had asked the admissions people if it was accurate and they wrote back and said something on the order of "Yes it was, but you weren't supposed to see it. Congratulations and welcome to Cornell."

Much more reasonable than Harvard and the others.
Re:Deja vu again once more by ottothecow · 2010-02-23 06:21 · Score: 1

So those schools followed through with their decision to reject the candidates that had checked?
Were there any lawsuits filed? I certainly wouldn't want to go to any school I had to sue to get in (and I imagine that if I got into HBS, I could get in somewhere else)...but I can see the plight of a person who read a forum post that said "decisions already posted! the link isn't up yet but you can just change &profile= to &decision="
seems like something *anyone* reading it might try...

--
Bottles.
Re:Deja vu again once more by MichaelSmith · 2010-02-23 10:16 · Score: 1

The classic was a few years ago when the Victorian state government sent out their budget in a word document with all their revisions left in.

--
http://michaelsmith.id.au
Re:Deja vu again once more by Anonymous Coward · 2010-02-24 11:00 · Score: 0

This also happened with the california state government a few years back; something about arnold but I can't remember what it was exactly. It was an unprotected file of some kind (video or photos?).
Re:Deja vu again once more by Hognoxious · 2010-02-25 00:59 · Score: 1

Yeah, at this time we were supposing governments would be a bit more cautious than schools.
I'd expect the opposite. After all, schoolteachers don't usually get rat-arsed and leave laptops/CDs of confidential information in taxis.
P.S. @dlgeek (1065796) - yup, that's the one I was thinking of. You must have lurked here a long time.

--
Confucius say, "Find worm in apple - bad. Find half a worm - worse."

Lock, what lock? by noidentity · 2010-02-23 04:06 · Score: 4, Insightful

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn the doorknobof an insecure office and make copies of highly confidential documents.'

There, fixed that for you, Mr. Minister.

Re:Lock, what lock? by Anonymous Coward · 2010-02-23 04:18 · Score: 0

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn the doorknobof an insecure office and make copies of highly confidential documents.'
There, fixed that for you, Mr. Minister.
Actually, it would be more something like this:
The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn the doorknob of an insecure PUBLIC place and make copies of highly confidential documents.'
The webserver, by definition, is setup as a public place, anyone is welcome to come in and look around as long as they follow the instructions (permissions) set by the webserver. In reality this is much more like someone literally turning over leaves in the park outside of a museum under which just one special leaf the government kept their notepad of secrets.
Re:Lock, what lock? by Obyron · 2010-02-23 04:20 · Score: 1

Even that doesn't work. At least in most of the US, you can still be considered "breaking and entering" even if the door is ajar, and you push it open. It's going into a place where you're not permitted for the purpose of committing a felony. The analogy here is more like being told there's a really juicy part in a book, so you flip through until you find the page. The author tries to sue you for circumventing his copyright protection, which was not putting a number on the page.

--
--Obyron
Re:Lock, what lock? by RoFLKOPTr · 2010-02-23 04:21 · Score: 5, Insightful

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn the doorknob of an insecure office and kindly accept the highly confidential documents that the receptionist hands to you.'
There, fixed that for you, Mr. Minister.
There, fixed that for you.
Re:Lock, what lock? by TexasTroy · 2010-02-23 04:25 · Score: 4, Insightful

Incorrect. Burglary can still occur if you do not lock the door to your house. The problem here is that the govt posted material on something akin to an unfinished public street that is not (yet) on any my map and then complaining that someone drove onto it because they (the govt) didn't put up a sign/gate to keep people off of it.
Re:Lock, what lock? by interkin3tic · 2010-02-23 04:30 · Score: 1

that this is 'akin to 3,727 attempts to turn the doorknob of an insecure office and make copies of highly confidential documents.
Makes you wonder if the reporter had typed in "http://nswtransportblueprint.com.au/project" on the first try instead of the 3,727th try, would the government have been okay with that? If a reporter were outside an unlocked government door, pawing it 3,727 times before successfully opening it, that would be pretty strange, but doesn't change anything.
Re:Lock, what lock? by Saint+Fnordius · 2010-02-23 04:32 · Score: 0, Redundant

To expand upon your metaphor...
Consider the "security" of the entry akin to having an unlocked door that is merely obscured by bushes painted to match the brickwork, and no pavement leading to it. There also was no one monitoring the traffic going in and out, so no one was there to notice the reporters making photographs until much later.
Security by obscurity at its finest.
Re:Lock, what lock? by zappepcs · 2010-02-23 04:38 · Score: 1

Exactly, logic says if you don't want it read by the public, don't host it on a public webserver. There are plenty of analogies here, but you're right, there was no lock or even a partially closed door. This doesn't equate well to the physical world unless you want to say they were invited into the room with no door on it, a room filled with artworks, and under a few of the paintings is a small sign with fine print that says 'please don't look at this painting'. Some of us are getting used to standards in web design and may attempt a uri by guess in case that common page is already created to save looking for it. This is not uncommon, so the practice of typing in a uri rather than clicking on links is not a felonious adventure. If you've already seen the painting, the fine print on the little sign is not going to be sufficient security. If you're not sure what I mean, try http://microsoft.com/search or http://ibm.com/search or http://any/ website/search I'm only guessing, but I bet the search box would have found the documents for them also?

--
Support NYCountryLawyer RIAA vs People
Re:Lock, what lock? by cowbutt · 2010-02-23 04:40 · Score: 2, Insightful

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to a single attempt to turn the doorknob of an insecure office and kindly accept the 3,727 highly confidential documents that the receptionist hands to you.'
There, fixed that for you, Mr. Minister.
There, fixed that for you.
Having RTFA, I fixed that for you. Doesn't look like there was any brute-forcing of the URL involved, just surfing around retrieving pages and images.
Re:Lock, what lock? by Anonymous Coward · 2010-02-23 04:41 · Score: 0

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to read from the public facing outside of a government building wall highly confidential documents that have been taped up there by an idiot.'
There, fixed that for you, Mr. Minister.
There, fixed that for you.
Done and done
Re:Lock, what lock? by elrous0 · 2010-02-23 04:50 · Score: 2, Insightful

Actually, it's more like "I hid the document in what I thought was a secret spot, in a public park. Someone discovered it there and started talking about it with their friends."

--
SJW: Someone who has run out of real oppression, and has to fake it.
Re:Lock, what lock? by kalirion · 2010-02-23 04:56 · Score: 1

FTA:
- We got a tip on Friday that you could read the government's transport plan by accessing a website called, unsurprisingly, nswtransportblueprint.com.au.
- Even we did not need help to type in those letters. No password was requested or offered.
- Instead we were confronted with a dream menu for any reporter: rail services, cycleways, walking and cycling, bus services, paying and road network.
So the analogy here is being told there's a really juicy book in a library at this specific location, but the book not being in the library's online catalog. The book itself has a full table of contents.
Re:Lock, what lock? by Anonymous Coward · 2010-02-23 04:59 · Score: 0

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to walking up to a person and kindly accepting the 3,727 highly confidential documents that he is waiting to hand to you.'
There, fixed that for you, Mr. Minister.
There, fixed that for you.
Having RTFA, I fixed that for you. Doesn't look like there was any brute-forcing of the URL involved, just surfing around retrieving pages and images.
Fixed that for you - there wasn't even a door.
Re:Lock, what lock? by tomhudson · 2010-02-23 05:07 · Score: 1

I RTFA, it was the first try. They were tipped off, entered this address: http://nswtransportblueprint.com.au/ there was no login or any other user verification, so they then clicked on all the links, downloading each page as it was served to them.
In other words, (again I RTFA) the site was supposed to go public a few days later - they just got there early and scooped everyone else, being the evil ink-stained wretches that they are :-)
Re:Lock, what lock? by HungryHobo · 2010-02-23 05:33 · Score: 1

It's like getting an unlisted telephone number and using your secret plans as your answering machine message.
Nothing about attempts to turn the doorknobof an insecure office and make copies of highly confidential documents
Re:Lock, what lock? by Anonymous Coward · 2010-02-23 05:51 · Score: 0

I was thinking more along the lines of the following: You walk into a Smithsonian museum, and notice a side room with an open doorway, and artwork on display just like the rest of the museum. So you go in and start looking around and taking pictures, but get yelled at because it's really a new exhibit that isn't open until Monday.
The door was open, there was no sign saying keep out, and the stuff in there was intended for public display, just not yet. It's not your fault that they didn't take proper care to prevent you from seeing it before you were supposed to, and since it's public property there's no restrictions against taking pictures. They can ask you to leave and put a barrier up to prevent you from coming back, but unless you actually damaged something in there that's all they can do...
Re:Lock, what lock? by Ltap · 2010-02-23 06:00 · Score: 2, Informative

The summary is actually misleading. They act like the newspaper bruteforced it - in reality, someone else found it first and just gave them the link. The "3,727 requests from different IPs" weren't some kind of botnet, they were just 3,727 people all accessing the blueprints that some guy found. That doesn't say that the newspaper was doing anything nefarious - just that the plans were absurdly, childishly easy to find.

--
Yet Another Tech Blog
(but so much more, including game and movie reviews)
http://yanteb.peasantoid.org
Re:Lock, what lock? by precariousgray · 2010-02-23 06:26 · Score: 1

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn the doorknob of an insecure office and kindly stick its head in the sand highly confidential documents like an ostrich, which then bleats, choking itself to death.'
There, fixed that for you, Mr. Minister.
There, fixed that for you.
I think we can finally settle on this one.

--
not much, just being forced to manually insert line breaks into my comment
Re:Lock, what lock? by smartr · 2010-02-23 06:58 · Score: 1

God forbid anyone use good RESTful design. It's almost as though it was designed partly to let people type things into the url to get what they want... http://en.wikipedia.org/wiki/Representational_State_Transfer
Re:Lock, what lock? by FoolishOwl · 2010-02-23 08:10 · Score: 1

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn the doorknobof an insecure office and make copies of highly confidential documents.'
There, fixed that for you, Mr. Minister.
I'd say it's equivalent to walking up to the headquarters of a government agency, entering by the side door adjacent to the parking lot -- a sliding glass door that opens automatically when you approach -- and walking to the main lobby, going to the kiosk under the sign that reads INFORMATION, and picking up and reading a few brochures with a total of 200 photographs and 3,527 words.
Re:Lock, what lock? by Dracophile · 2010-02-23 09:18 · Score: 1

This isn't burglary. To continue the analogy: this is someone walking up that unfinished street, looking in three thousand-odd places for someone with a list of things to see, finally finding someone with an index, asking them for a copy of that index, and then asking them for a copy of everything on that index. And that someone willingly complied with every request for information.

--
Athy, athier, athiest.
Re:Lock, what lock? by wvmarle · 2010-02-23 15:57 · Score: 1

There were four IP addresses involved. Probably about 1000 requests from each IP. After all a single web page can generate a couple dozen requests (html body, image here, script there, some flash, etc). I bet they counted every single GET request for every single part of the site here. Not unique visitors; just hits.

Reminds me of... by courteaudotbiz · 2010-02-23 04:07 · Score: 4, Interesting

This reminds me of a case in Canada, where Passport Canada (the agency responsible for passport emission) was "hacked" by changing some numbers in the URL to get from one passport request details to the other, making very confidential information available to even the most basic hackers.

However, no one was accused here, except the developpers of the solutions who were blamed. Now, Passport Canada still processes online passport requests, but applicants are no more able to view the details and advancement of their application online.

Re:Reminds me of... by courteaudotbiz · 2010-02-23 04:08 · Score: 1

Damned, the URL of the article I was trying to post
Re:Reminds me of... by Anonymous Coward · 2010-02-23 04:40 · Score: 0

That was bad coding, this is bad policy. I can understand it though. I know of a few ol' timers who get livid when asked a site prompts them to log in. They honestly feel their time is so precious and they are so important that they shouldn't have to log in. And they're so stubborn, they absolutely will not log in to the site, even after you've told them the password (for the 100th time). They just refuse to use the site to prove their point (that they shouldn't need to log in).
Re:Reminds me of... by girlintraining · 2010-02-23 05:11 · Score: 1

This reminds me of a case in Canada, where Passport Canada (the agency responsible for passport emission) was "hacked" by changing some numbers in the URL to get from one passport request details to the other, making very confidential information available to even the most basic hackers.

I still try that out of habit when I see a record ID encoded in the URL. Still works on a lot of websites... about 8% of the time, especially for smaller shops. I usually send them an e-mail and move on. There's too many to waste my time following up with each one...

--
#fuckbeta #iamslashdot #dicemustdie
Re:Reminds me of... by suomynonAyletamitlU · 2010-02-23 07:58 · Score: 1

The first production project I ever did using PHP, I was making a sort of hack-together forum for a small web-based game community. I was on the project less than 6 months, and I had never made a serious site up to that time. I had no technical expert to help me, just the woman who ran the site, who mostly didn't do much more than monitor and tell me what she wanted. I wasn't getting paid anything; it was an academic internship.
Staring at the GET request in the url, with all of my inexperience, I said, "that's not secure," and added checks to make sure you were authorized to see what you were getting.
Took all of a few hours to make that change, even accounting for porting it to several other related systems.
End of story.

Really? by Monkeedude1212 · 2010-02-23 04:07 · Score: 4, Insightful

Are there no IT Pros that work for the government?

I read stories like this and I think "Theres no way they could be monitoring my traffic, they can't even set up basic login authentication for their websites"

Re:Really? by WrongSizeGlass · 2010-02-23 04:29 · Score: 4, Funny

Are there no IT Pros that work for the government?
Sadly, no ... they're all working for school districts in southern Pennsylvania.
Re:Really? by digitalchinky · 2010-02-23 04:39 · Score: 3, Informative

There are some terribly bright and technically minded people in government, particularly in the intelligence gathering fields (secret 3 letter agencies) - unfortunately they are not usually in positions of power or within ear shot of anyone that might easily comprehend what they are actually saying. I guess it's the same old problem everywhere - if 'Government' knew what they actually had behind their own closed doors, they'd be shocked, maybe even outraged :-)
I spent a lot of years working for the defence signals directorate (Same as the NSA's, different acronym) - safe to say that those up at the top take about 5 to 10 years to actually understand what their underlings have been saying for the aforementioned 5 to 10 years. Ops Normal.
The main problem is, as others have more eloquently said, right up at the top you get the boss saying "Just make it f'ing happen already" Be damned if they care about security. Thus the stunningly illogical knee jerk reaction to shut the barn door after the quadrupeds have already legged it, oh, and death sentences to the idiots that forged the door hinges, because we need to punish the wrong people in spectacular fashion to prove a point that nobody will ever understand.
Re:Really? by delinear · 2010-02-23 05:31 · Score: 1

Exactly right, it doesn't matter how much you argue as a peon, if the directors don't like having to remember passwords then you're stuck. Add to that the fact that governments are massive, sprawling entities, where no one department has clear visibility of what others are doing, and you end up in the situation where the highly skilled IT department is bypassed by the clueless manager who gets in a clueless contractor to throw up a website.
Re:Really? by SleazyRidr · 2010-02-23 06:36 · Score: 1

Actually in Australia they work for four letter agencies.

--
Is 1563649 a prime number?
Re:Really? by RedTeflon · 2010-02-23 06:50 · Score: 1

Are there no IT Pros that work for the government?
Sadly, no ... they're all working for school districts in southern Pennsylvania.
And they are watching you!!!
Re:Really? by Anonymous Coward · 2010-02-23 08:51 · Score: 0

There are, but we're
* Hamstrung by process and procedure, especially when making a production release
* Slowed down by ITIL - see above
* Limited by what we can do with outdated software/hardware
* Cleaning up the mess left by contractors
Re:Really? by samson13 · 2010-02-23 10:26 · Score: 1

Actually in Australia they work for four letter agencies.
Like DSD and AFP :-)
(OK OK Maybe ASIO)
Re:Really? by Anonymous Coward · 2010-02-23 10:46 · Score: 0

It's not that there aren't IT pros that work for the government, it's that government moves glacially, and slowness and technology don't mix. I worked in IT for the QLD government, and they just finished installing XP state-wide less than six months ago. The OS is nearly ten years old, and was officially "deprecated" by Microsoft when they started the whole process!

I love the name of the web hosting outfit: by hey! · 2010-02-23 04:08 · Score: 5, Insightful

"Bang the Table".

Methinks we have found a new tag for articles about politicians who are bit by their own stupid security practices. Release Word file with revision history still in it? Bang the table. Secret government data stolen because of malware you downloaded from a porn site? Bang the table.

--
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.

Re:I love the name of the web hosting outfit: by HungryHobo · 2010-02-23 05:51 · Score: 1

I don't know why but somehow this sounds right.
Seconded.
Re:I love the name of the web hosting outfit: by Anonymous Coward · 2010-02-23 13:49 · Score: 0

"Bang the Table".
Methinks we have found a new tag for articles about politicians who are bit by their own stupid security practices. Release Word file with revision history still in it? Bang the table. Secret government data stolen because of malware you downloaded from a porn site? Bang the table.
i for one will be an early adopter of this phrase.
Re:I love the name of the web hosting outfit: by ax_42 · 2010-02-23 18:57 · Score: 1

Career advice for trial lawyers:
- If the law is against you, bang on the facts
- If the facts are against you, bang on the law
- If both are against you, bang on the table
Attribution: Seen on /. but couldn't find it again now for proper attribution

tubes from their door to my keyboard by uncanny · 2010-02-23 04:14 · Score: 1

Then dont put your UNLOCKED door in my house! This is the internets

Re:tubes from their door to my keyboard by Frosty+Piss · 2010-02-23 04:21 · Score: 1

Then dont put your UNLOCKED door in my house! This is the internets
This argument is used all the time, but it really doesn't apply. Leaving your door unlocked is not consent, implied or otherwise, for anyone to waltz on in.

That doesn't justify morons running the site in question, but like many anecdotal arguments, it doesn't hold much water in the real world.

--
If you want news from today, you have to come back tomorrow.
Re:tubes from their door to my keyboard by ircmaxell · 2010-02-23 04:33 · Score: 1

This argument is used all the time, but it really doesn't apply. Leaving your door unlocked is not consent, implied or otherwise, for anyone to waltz on in.

True, but this was more akin to walking in to a library, and finding confidential documents in the general section right next to the Sunday newspaper (AKA, not behind any doors at all). All it took was knowing (or figuring out) where to look. There was no door here (if there was, it would have been in the form of a password or a DNS block (only allowing internal IP addresses), etc)...

--
If a man isn't willing to take some risk for his opinions, either his opinions are no good or he's no good
Re:tubes from their door to my keyboard by Nadaka · 2010-02-23 04:50 · Score: 4, Insightful

How about a car analogy?
This isn't like breaking the window on a Civic and tearing out the stereo system that cost more than the car.
This isn't like opening the unlocked door on a Prius and and taking someones cd collection they left on the passenger seat.
This isn't like reaching through the open window of a hummer and snatching a stick of gum.
This is like getting on a public bus, and using your cell phone to snap pictures of the graffiti on the wall.
Re:tubes from their door to my keyboard by Lumpy · 2010-02-23 05:11 · Score: 1

Exactly and having a website on the internet is like not even having a door or even a house. It was all spread on the lawn for everyone to stop and see.

--
Do not look at laser with remaining good eye.
Re:tubes from their door to my keyboard by Anonymous Coward · 2010-02-23 09:56 · Score: 0

How about a car analogy?
This isn't like breaking the window on a Civic and tearing out the stereo system that cost more than the car.
This isn't like opening the unlocked door on a Prius and and taking someones cd collection they left on the passenger seat.
This isn't like reaching through the open window of a hummer and snatching a stick of gum.
This is like getting on a public bus, and using your cell phone to snap pictures of the graffiti on the wall.
Only problem is, all of these things are illegal in Sydney. Even the last one.

fuckfuck by fuckfuck69 · 2010-02-23 04:17 · Score: 0, Offtopic

Whenever I get a package of plain M&Ms, I make it my duty to continue the strength and robustness of the candy as a species. To this end, I hold M&M duels. Taking two candies between my thumb and forefinger, I apply pressure, squeezing them together until one of them breaks and splinters. That is the “loser,” and I eat the inferior one immediately. The winner gets to go another round. I have found that, in general, the brown and red M&Ms are tougher, and the newer blue ones are genetically inferior. I have hypothesized that the blue M&Ms as a race cannot survive long in the intense theater of competition that is the modern candy and snack-food world. Occasionally I will get a mutation, a candy that is misshapen, or pointier, or flatter than the rest. Almost invariably this proves to be a weakness, but on very rare occasions it gives the candy extra strength. In this way, the species continues to adapt to its environment. When I reach the end of the pack, I am left with one M&M, the strongest of the herd. Since it would make no sense to eat this one as well, I pack it neatly in an envelope and send it to M&M Mars, A Division of Mars, Inc., Hackettstown, NJ 17840-1503 U.S.A., along with a 3×5 card reading, “Please use this M&M for breeding purposes.” This week they wrote back to thank me, and sent me a coupon for a free 1/2 pound bag of plain M&Ms. I consider this “grant money.” I have set aside the weekend for a grand tournament. From a field of hundreds, we will discover the True Champion. There can be only one.

Re:fuckfuck by WrongSizeGlass · 2010-02-23 04:19 · Score: 2, Funny

Dude, way to ruin M&M's for me ... I don't ever want to think of M&M's breeding unless it's that hot one from the TV commercials.
Re:fuckfuck by SatanClauz · 2010-02-23 04:25 · Score: 2, Funny

okay
first, i'm not sure what this has to do with the post.
second, I do the EXACT same thing :)
that is all
Re:fuckfuck by Gerzel · 2010-02-23 04:40 · Score: 4, Insightful

But your method doesn't take into account the time it takes an M&M to rest and get into full fighting form between bouts. Thus if the first M&M you come across is the strongest it is still likely to lose simply because it has to face fresh competitor after competitor. Even your fingers raise the core temperature of the competitor high enough after a few bouts to induce softening leaving the M&M weaker against its rested cooler-cored foe.
Solution: Set up a randomized tournament system where you take two M&Ms at random from the rested pack, test them, and put the winner in a separate pile to rest until the pack is empty. Then repeat tournament again between the now rested victors of the first round. Repeat until there is only one.
Re:fuckfuck by Kell+Bengal · 2010-02-23 06:24 · Score: 1

I imagine this process could be automated, with new competitors being fed from some sort of hopper. If the m&m breeding method is also amenable to automation, I imagine we could create an apparatus that would eventually yield the ultimate m&m with minimal interference.

But what happens when they become too strong?

--
Scientists point out problems, engineers fix them
altslashdot.org: The future of slashdot.
Re:fuckfuck by Anonymous Coward · 2010-02-23 07:01 · Score: 0

If that story was somewhat original and not 15 years old already, I would be impressed.
Re:fuckfuck by Ihmhi · 2010-02-23 07:31 · Score: 1

Man, I would buy Lego Mindstorms just to figure out how to do the same thing with robots. Two bots try to crush an M&M, and the loser gets shoved off down a chute, into a cup, and catapulted into my mouth.

--
Random Thoughts From A Diseased Mind (Not For Dummies)
Re:fuckfuck by Anonymous Coward · 2010-02-23 07:41 · Score: 0

Old copypasta is old.
Re:fuckfuck by Anonymous Coward · 2010-02-23 07:44 · Score: 0

The new selectively breeded superior M&Ms crush you!
Re:fuckfuck by isama · 2010-02-23 08:30 · Score: 0

I for one welcome our new super m&m's overlord.
Re:fuckfuck by ooshna · 2010-02-23 09:44 · Score: 0, Troll

The new selectively breeded superior M&Ms crush you!
Are you talking about M&Ms or Aryans? Next you'll be wanting to send the misshapen and chipped ones to special "camps".
Re:fuckfuck by Thing+1 · 2010-02-23 14:22 · Score: 1

Those aren't M&Ms, they're Mike and Ikes.

--
I feel fantastic, and I'm still alive.
Re:fuckfuck by Anonymous Coward · 2010-02-23 17:57 · Score: 0

I like your article, I would often come back Hot Political Figures
Re:fuckfuck by Anonymous Coward · 2010-02-23 18:31 · Score: 0

If by "camp" you mean my tummy then yes.
Re:fuckfuck by pnutjam · 2010-02-24 04:33 · Score: 1

This is why nobody takes IT seriously, we over analyze everything.

--
Cheap storage VM.

Question: by Pojut · 2010-02-23 04:17 · Score: 4, Interesting

Is it even legally possible to bring up criminal charges, considering the URL was completely unsecured?

--
Living With a Nerd

Re:Question: by garcia · 2010-02-23 04:30 · Score: 1

Bring up? Sure. Successfully prosecute? That's up for debate.
Re:Question: by OzPeter · 2010-02-23 04:33 · Score: 3, Insightful

Its always possible to bring up charges .. whether they are warranted or provable is a totally different thing

--
I am Slashdot. Are you Slashdot as well?
Re:Question: by digitalhermit · 2010-02-23 04:54 · Score: 1

A couple years ago I was searching for the name of an old friend from college. I got a few Google hits for his full name and followed one of them. It led to a page on a radio station website that had lots of confidential information including birth date, email address, home address, business phone/address, salary, *and* password information. I alerted the radio station immediately. The first response from them was accusatory, asking what I was doing hacking their site. I sent back an email to the person who responded and to the addresses listed on their contact page detailing how I found the information.. Haven't heard back from them, but the page stayed up for over a week.
Re:Question: by Anonymous Coward · 2010-02-23 05:12 · Score: 0

Compare it to someone pressing all buttons next to the (not automatically opening) front door of an appartment-building : If some inhabitant presses the door-opener is he than entering the building illegally ?
Another comparision : If you knock on a door and someone opens it and than proceedes to hand you their wallet are you than in any way stealing from them ?
Yet another : A door with a lock (even if currently not applied) conveys the message that someone could want that passage blocked (and outof respect you do not even try to get that door open). A door with no such mechanism does not convey any such message.
P.s.
If I would have been stopped by any door which opening-mechanism I did not instantly understand than quite a few doors would have stayed closed to me.
P.p.s.
IANAL. And depending on the country you're in you mileage may vary.
captcha : thoughts. How apropriate. :-)
Re:Question: by Hatta · 2010-02-23 05:19 · Score: 1

It's Australia. They sent a man to prison for having a few naked drawing of Simpsons characters. I think they can find a way to charge anyone for just about anything they don't like.

--
Give me Classic Slashdot or give me death!

Bang the Table???? by 140Mandak262Jamuna · 2010-02-23 04:20 · Score: 2, Informative

The article mentions the hosting company is called Bang the table. Where have I heard that before?

Yup, recently someone in pandasthumb.org quoted someone famous saying, "If the law is on your side, bang on the law, If facts are on your side, bang on the facts, if neither, bang on the table".

--
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact

Re:Bang the Table???? by mcgrew · 2010-02-23 07:07 · Score: 1

I can remember that when I was a kid, there was a certain head of state with the initials NK, who banged the table at the UN while screaming "WE WILL BURY YOU!"
They wound up burying themselves. Banging the table, as well as any other acts of anger, is usually counterproductive.

--
Free Martian Whores!
Re:Bang the Table???? by Anonymous Coward · 2010-02-23 13:26 · Score: 0

Bang the Table
I thought it was some sort of furniture porn.

Robots.txt by sakdoctor · 2010-02-23 04:20 · Score: 1, Funny

User-agent: *
Disallow: /highly_confidential_documents/
Hack-delay: >9000

Why care about security when you can rule by fear? by Suzuran · 2010-02-23 04:20 · Score: 1

These reporters will learn not to meddle in government affairs when they're behind bars for the next 50+ years for computer offenses. Security is for chumps. Real security is sleeping well at night knowing that everyone else cowers in fear of your wrath. Not many reporters are willing to bet their lives on a story, and those that are willing will be made examples to the rest. Either the story dies or you do - Your choice!

More like "exceeding authorization" by ub3r+n3u7r4l1st · 2010-02-23 04:22 · Score: 1

There is no changes or password cracking involved. More like "accidentally" viewing a website that is not supposed to be public.

This reminds me of similar case of a story where an employee were able to look at files that he is not suppose to see with his account, thanks to a mistake by a sysadmin, and the boss accuse him of hacking.

--
New Economic Perspectives

'Trespassing' and 'Breaking and Entering' by capitaladot · 2010-02-23 04:24 · Score: 1

We do a very poor job, globally, of distinguishing between electronic trespass and electronic breaking and entering. In the rush to criminalize computer use deigned anti-social, bedrock concepts such as the above were not well-translated to electronic paradigms. As such, bizarrely disproportionate legal sanctions are often applied to those convicted of these acts, and with little reason beyond knee-jerk technophobia.

Re:'Trespassing' and 'Breaking and Entering' by SecurityGuy · 2010-02-23 05:27 · Score: 1

It's neither trespassing or breaking and entering. HTTP is a well known method of disseminating information. There are also well known ways of restricting access to information when you are disseminating it over HTTP. You can put it behind a firewall. You can restrict by IP ranges. You can give accounts with passwords to people who need to get it. No responsible organization can publish information on the web, not restricted by a firewall, not restricted by IP (which isn't very good anyway), not restricted by any authorization or authentication methods, and cry when somebody reads it.
It's rather like putting your private information between the pages of a library book and crying foul when someone reads it on the grounds that you didn't tell them which book or which page.
There are ways to secure information. Use them.
Re:'Trespassing' and 'Breaking and Entering' by capitaladot · 2010-02-23 05:44 · Score: 1

I'd argue that unsecured HTTP (e.g. no authentication in place and on the public internet) is akin to trespassing on unsecured property, or entering an unlocked door. Entering a secured system without authorization (e.g. through some hack, social engineering, etc) would be more like breaking and entering. I understand the distinction you're making, implicitly, between entering virtual space and physical space, but stand by my analogy. Unsecured systems (HTTP or otherwise) are like doors left open, and secured systems are like locked doors. It should be, I argue, left to the possessor of the space (e.g. physical place or network host) to determine whether access is (or was) acceptable. There are standards in some localities surrounding posting notices of "No Trespassing" to indicate private space that is not open to the public (even if it is not physically restricted, such as with a fence or wall). Perhaps a similar requirement would be suitable in these cases, and without such, hosts of unsecured HTTP sites might then have no right to "cry when somebody reads it".
Re:'Trespassing' and 'Breaking and Entering' by Kevin72594 · 2010-02-23 12:07 · Score: 1

The possessor of the space did determine whether or not access was acceptable. They configured the webserver in a way that it responded to the HTTP requests made by the reporters. You can't trespass when you've been given permission to access.
Re:'Trespassing' and 'Breaking and Entering' by capitaladot · 2010-02-24 02:39 · Score: 1

How is an unsecured server any different than an unlocked door? If the owner of the property finds that you've been there without permission, you're still trespassing.

As long as the URL is secret, it is an attack by Anonymous Coward · 2010-02-23 04:24 · Score: 0

There is no technical difference between a password in the URL and a password in the rest of the HTTP header. Neither is a particularly good access control, but as long as the URL is not easily derived from another URL or published in any way, they are actual access control methods. We don't use secret URLs because there are many ways a URL can easily leak and become public knowledge (e.g. through the HTTP Referer header). Secret URL components are however used frequently for session control when cookies are unavailable. Would you not consider using a leaked session-URL an attack?

Re:As long as the URL is secret, it is an attack by Anonymous Coward · 2010-02-23 04:47 · Score: 0

Thank you. Slashdot is truly full of stupid today...as it usually is.

Bad security != no security. I won't make tedious analogies, but suffice to say that unless the URL was linked from elsewhere (ie, Google-able), this does clearly constitute unauthorized access. Likewise, I can look at my server logs and give you plenty of URLs that, if used deliberately, are hacking attempts. Morally, effectively, attempting to brute force a private URL is no different than trolling for exploits. Which I hope we can all agree is plainly illegal, even if you're a DUR HUR DUMAS LOL WTF who forgot to update phpBB for the last five years.
Re:As long as the URL is secret, it is an attack by Destined+Soul · 2010-02-23 05:31 · Score: 1

I was thinking along these lines. I remember coming across the following in my linux apache logs and definitely thought of it an attack probe: "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" Surely this can also be done via just an URL but that doesn't make it right.
Just because you leave your door open doesn't make someone going through it not trespassing, lock or not. Checking all of the windows and doors to see if there's a way in also doesn't really help with the "I wasn't trespassing" argument, either.
I do admit it should have been locked down, though. At least IP filter access to the site if you're still in testing.
Re:As long as the URL is secret, it is an attack by Destined+Soul · 2010-02-23 05:44 · Score: 1

I know I RTFA, but I haven't had my coffee yet. I had thought they guessed URLs within the site to see if there was something new but they just clicked on a link.
On that I change my tune a bit as I think of regular pings as normal knocks on the door. Answer and expect to get a visit from a salesman. Just because I only gave out my domain name to my 10 close friends doesn't mean that I don't expect others. However, I start for my phone/baseball bat when someone tries to get in after they've been denied regular access.
Re:As long as the URL is secret, it is an attack by pavera · 2010-02-23 05:47 · Score: 1

If you had read the article you would know this wasn't a case of "guessing" the URL. The article states that they had a source that told them the EXACT url to use, and it doesn't involve a query string at all. This source (probably some lower level person inside the ministry in question) had knowledge of the new site, and what it contained, and they leaked this information to the journalists. This is 100% not hacking.
The URL in question is nswtransportblueprint.com.au. It isn't functioning now, but according to the journalists it was on Friday. The 3700 "hits" were probably the journalists going to various pages on the site and printing the information, as the article does say that is what they did.
At any rate, there wasn't a password *anywhere* not in the URL, not in the headers, it was a completely open and accessible site. Google could have crawled it if there were any external links pointing to it that would lead the googlebot over. Anyone on the planet could have gone to the URL and seen the information. If your friend tells you "Hey I know this great new site that you should check out its supercoolsite.com", and you go there, and supercoolsite.com has no access control, no passwords, no funky URL parameters to guess, but maybe supercoolsite.com hasn't officially launched yet, and they don't actually want traffic... are you hacking their site? Maybe the founders sister is a blabber mouth and told all her friends about this site her brother is building, unbeknownest to him. That is hacking according to your definition that if the URL isn't "published in any way" then the URL alone is access control? That's just crazy. Putting something on the web by definition is publishing it to the world. If you don't want the world to see it you have to put it behind some kind of real access control (username/password/encryption/run server on a different port/ip access list/VPN) Preferably a combination of all of those.
Re:As long as the URL is secret, it is an attack by Anonymous Coward · 2010-02-23 06:01 · Score: 0

In that case, the headline is wrong and the minister is clearly intentionally misleading the public with his lock-picking analogy. So the URL is not secret and accessing it is not an attack.
Re:As long as the URL is secret, it is an attack by silanea · 2010-02-23 06:32 · Score: 1

To give you a (non-car) analogy: You have super-secret information which you write onto a sheet of paper. You hide that paper underneath a bench in a public park - simply by placing it on the ground there, without an envelope or any other cover. A journalist gets tipped off to check all benches in this park for secret information. He looks under 3727 benches without finding anything, but under the 3728. bench he discovers your sheet of paper.
Sixty-four-dollar question: Did the journalist "hack" your super-secret information?

--
Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.
Re:As long as the URL is secret, it is an attack by silanea · 2010-02-23 06:37 · Score: 1

Nevermind, got it wrong. The journalist knew exactly which bench to check. Dunno where those 3727 other attempts come from. Point still stands. No password was hacked, no security measure was defeated. Someone just found something in plain sight that simply had not been publicly announced.

--
Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.
Re:As long as the URL is secret, it is an attack by Anonymous Coward · 2010-02-23 07:34 · Score: 0

(The story headline is misleading. I'm continuing the argument on the basis that a URL contains an actual secret component.)
Meatspace and cyberspace are sufficiently different that analogies are rarely useful, because they usually lead to inconsistent results. Sending a request to a server is not like turning a door knob or looking under a park bench. It's like sending a request to a server. One of the differences is that servers exhibit complex behaviors without constant control or supervision. Another difference is that server access is usually remote and that sending a request is most often the only way to see if a server is meant to deliver a response or not. This latter aspect alone throws off many people who are not familiar with how computers work.
On the internet, most access permissions are implied: If you can, you may. However, that obviously can't be the only rule. People who argue like you do (that if you can see it when you go looking for it, then it is out in the open) don't make a distinction between ability and permission. You justify this conflation with an analogy involving an arbitrarily low amount of secrecy about information placed in a public location. That's not a proper way to argue whether some server access was permissible or not.
If ability and permission always coincided, what would stop an attacker from brute-forcing a password? Or from using a software exploit? I would certainly agree that hardening your system against even these types of attacks is a good idea and the only way to achieve reasonable security, but from a legal point of view, the line between accessing a server and attacking a server is not where an attacker simply can no longer get any information that the server owner wanted to keep secret. Where is that line?
I argued that the mechanism which most would clearly regard as an access control mechanism, HTTP basic authentication, is not functionally different from secret URLs, as long as a secret URL isn't easily derived from other URLs (i.e. constructed to be secret) and not published in any way (i.e. not leaked through HTTP referer headers, links, etc.). If one is considered (albeit weak) access control, why isn't the other? They are both transmitted unencrypted. The password can even be entered as part of the URL.
Your analogy fails to differentiate the two cases. A journalist gets tipped off to check all benches in the park: You meant this as an analogy to an informant giving the journalist some URL pattern to check, but it can just as well be considered analogous to some password pattern. If your argument is meant to justify brute forcing URLs, then it must also justify brute forcing passwords. I am pretty sure you didn't mean it like that, but then what is the difference? IMHO there isn't one. Brute forcing URLs with components that are obviously meant to be secret is an attack.
Re:As long as the URL is secret, it is an attack by silanea · 2010-02-24 01:44 · Score: 1
"Secret" for me implies that it is
1. not known to anyone who is not authorised to know it, and
2. sufficiently complex that it cannot be discovered by mere accident or a bit of common sense or guesswork.
If active attacks, ie. unintended uses of your infrastructure, are necessary to reveal the secret (brute forcing, breaking into your server, kidnapping and torturing you etc.), then I agree that the line has been crossed.
I am aware that this distinction is rather blurry. But while I do condemn brute forcing and comparable attacks I cannot subscribe to the opinion that seeing through obscurity is an evil hack. Intent alone does not constitute a security measure. There has to be a certain level of quality to an access control system.
--
Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.

Library analogy by vlm · 2010-02-23 04:24 · Score: 4, Funny

'akin to 3,727 attempts to pick the lock of a secure office and take highly confidential documents.'

Much more like checking 3727 shelves in the public library looking for a copy of "internet security for dummies"

The funny part is both sides are fairly non-technical, meaning some "journalist" probably typed in all 3727 URLs.

--
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger

Re:Library analogy by TheOutLiar · 2010-02-23 04:37 · Score: 1

Seems more akin to handing someone a keyring with 3,727 keys on it and asking them to open the door.
Re:Library analogy by Mr+Thinly+Sliced · 2010-02-23 04:39 · Score: 1

The funny part is both sides are fairly non-technical, meaning some "journalist" probably typed in all 3727 URLs.
You mean they didn't write a visual basic GUI to trace an IP address?.
From the sounds of this story the Aussie Gov't hired the technical consultants from 24 as their sysadmin and security guy.
Re:Library analogy by nedlohs · 2010-02-23 04:53 · Score: 3, Informative

Nothing like that at all.
They were told the url by someone.
They entered it into their browser and got a everyday normal web page.
They clicked on the menu items and printed out the pages.
No guessing involved. No typing (other than the initial url) involved.
The 3727 is probably the number of request logs on the web server from them, counting all the images/css/js/etc files to make it look larger.
If they were slightly technical they might have done:
wget -m http://nswtransportblueprint.com.au/
but that would be *more* typing...
Re:Library analogy by tomhudson · 2010-02-23 05:21 · Score: 2, Interesting

No, the url was "published" in the legal sense - they were given it by someone.
No hacking involved.
They weren't the only ones to whom the url was "published", since several others also were grabbing the files at the same time. And the way they grabbed the files? Clicked on the menu and followed the links, then "Print".
The url in question? http://nswtransportblueprint.com.au/
No secret directories, no login required, no hidden subdomain, no .hosts file to exclude them, nothing. It was supposed to be a public website - it just went "public" a week early.
Re:Library analogy by Anonymous Coward · 2010-02-23 05:27 · Score: 0

If they were slightly technical they might have done:
wget -m http://nswtransportblueprint.com.au/
but that would be *more* typing...
Not to mention prima facie evidence of their guiltiness due to having using
super-sekrit linux haxxor codes to penetrate the firewall and abscond with stolen datas.
Re:Library analogy by blackraven14250 · 2010-02-23 05:31 · Score: 1

Only if they tried every other key on the ring before the successful one.
Re:Library analogy by Ltap · 2010-02-23 06:09 · Score: 1

They didn't - not every request was from the Herald, and I'm guessing only half a dozen were.

--
Yet Another Tech Blog
(but so much more, including game and movie reviews)
http://yanteb.peasantoid.org
Re:Library analogy by gnasher719 · 2010-02-23 06:34 · Score: 1

As an example, the UK government has an employment website at www.direct.gov.uk/en/Employment . All UK government websites in English (and not Welsh, I suppose) should be at www.direct.gov.uk/en/something. If I wanted to know our ministers' salaries, then I might try going to www.direct.gov.uk/en/ministerssalaries . Typing in that URL is not hacking, and I would consider it my right to use any information I find there. Or if the UK government is working on a transport blueprint, I could try www.direct.gov.uk/en/transportblueprint . Just common sense. Why would I try to find a link to the site when I can just type in the URL?

Now if I was told that the ministers' salaries are at www.direct.gov.uk/en/salaries_01934721adouex, then I would have to suspect that something illegal has been going on to get that URL, and that I shouldn't visit that site.
Re:Library analogy by iNaya · 2010-02-23 13:58 · Score: 1

Why would you suspect anything illegal was going on? I send links to my friends from government sites quite frequently, and they often have seemingly random letters/numbers in the links, which I originally accessed through the menu structure. For instance http://www.stats.govt.nz/browse_for_stats/population/estimates_and_projections/SubnationalPopulationProjections_MR2031.aspx This is information the government WANTS people to have access to. I don't see why the appearance of the URL has anything to do with whether it is private or not.

--
The Unicode standard is over 20 years old. Why does Slashdot not support it?
Re:Library analogy by Anonymous Coward · 2010-02-23 19:54 · Score: 0

Now if I was told that the ministers' salaries are at www.direct.gov.uk/en/salaries_01934721adouex, then I would have to suspect that something illegal has been going on to get that URL, and that I shouldn't visit that site.
Most CMS use arbitrary character/number sequences in URLs. Does that mean most of teh Interwebs is suddenly illegal?
The comments for this article are at http://news.slashdot.org/comments.pl?sid=1560312. Heck, even a randomly chosen link on one of those UK gov sites you mentioned has random characters in it: http://www.direct.gov.uk/en/Diol1/DoItOnline/DG_10015994.
Please don't go into politics ;)

Entropy by michaelmalak · 2010-02-23 04:34 · Score: 3, Interesting

Security by obscurity at its finest.

At what point does obscurity become security? 3,727 attempts corresponds to 12 bits of entropy. According to NIST, that's the equivalent of a 5-character user-selected password. The same document stipulates a mere 10 bits of entropy for some applications.

Re:Entropy by samkass · 2010-02-23 04:46 · Score: 1

That's an interesting point. The same point could be made about other "mathematically" obscure things such as an IPv6 address. If all information was available online but some of it was password protected, what's the difference between guessing URLs and guessing passwords?
To answer my own question: the expectation of privacy. A password implies the expectation of privacy, while posting something that anyone can access with the right URL does not have the same implication to me.

--
E pluribus unum
Re:Entropy by daremonai · 2010-02-23 05:03 · Score: 1

The newspaper didn't do any guessing at all. They were told the site name, and went directly to it. The site had links to all sorts of transportation plans, which the guys at the paper accessed. That's where the 3,727 number comes from - just the number of URI accesses listed in the web server log, most likely by other people in addition to the newspaper.
Re:Entropy by SatanClauz · 2010-02-23 05:06 · Score: 2, Interesting

You answered michaelmalak's question at the same time!
Obscurity becomes security when you have no reason for expectation of privacy :)
Re:Entropy by Anonymous Coward · 2010-02-23 05:15 · Score: 0

It's the difference between checking 3,000 unlocked doors and stealing 3,000 keys to try to unlock a single door.
Re:Entropy by tomhudson · 2010-02-23 05:25 · Score: 3, Informative

RTFA.
They were given this url http://nswtransportblueprint.com.au/
They went there.
They hit Print
They followed the pretty linkies
They hit Print some more
They wrote a story about it.
No password dialog. No secret subdomain. No secret subdirectory. No login required. No user session or password. No .hosts entry. How is that "hacking"?
There was no guesswork involved, so there was zero bits of entropy in this example, unless they were drunk at the time and had to retype it, in which case it's their own entropy pool, not the servers' /dev/urandom, that is being probed.
Re:Entropy by eth1 · 2010-02-23 05:46 · Score: 1

3000 "accesses" probably just means they looked at 30 pages with 100 images, scripts, and other elements that were all downloaded via separate requests/connections. But 3,727 is a better number to use when you're trying spin the journalists into villains.
Re:Entropy by dominious · 2010-02-23 06:53 · Score: 1

It's the difference between checking 3,000 unlocked doors and stealing 3,000 keys to try to unlock a single door.
stealing? so if I guess a password like 1234 did I just steal it from someone? oh god im a criminal!
Re:Entropy by Anonymous Coward · 2010-02-23 06:55 · Score: 0

Hmmm, 5 character user selected password?
"So the combination is... one, two, three, four, five? That's the stupidest combination I've ever heard in my life! The kind of thing an idiot would have on his luggage!" -- Dark Helmet, Spaceballs
Re:Entropy by AlgorithMan · 2010-02-23 11:11 · Score: 1

if 3,727 attemts took them 2 days, you bet it was manual... a little BASH oneliner would make 3,727 attempts in 1 hour

no automated program would need 46 seconds per request...

--
The MAFIAA is a bunch of mindless jerks who will be the first up against the wall when the revolution comes
Re:Entropy by canajin56 · 2010-02-23 11:25 · Score: 2, Informative

You're making the mistake of believing the Slashdot summary, instead of reading TFA. There was no trial and error involved. They were given a tip that a public government website had information they might find useful. The 3,727 "attempts" that Slashdot reports are 3,727 "hits on the firewall" according to TFA. All of those "hits" were allowed through. They didn't do a dictionary attack on an existing website hoping to find secret subdirectories that weren't linked to. They just followed links inside the main page, to various subpages. The government asserts that typing in a URL was a hack attempt, and each time they clicked a link it was also a hack attempt, some of which led to "classified" information. To repeat, it wasn't 3,726 404 errors, followed by "YES, VALID URL!" it was 3727 total scrips html pages images and css files as they browsed through a link somebody emailed them.

--
ASCII stupid question, get a stupid ANSI

Window analogy by realsilly · 2010-02-23 04:36 · Score: 3, Interesting

Just because a house has windows and they aren't covered by curtains does not mean that by looking through the window and reading an important document left near the window that you're aren't stealing info. An unlocked door also doesn't mean you have the right to open it either. Both are wrong.

Conversely, an unpublished website for a govt. agency... and they really thought that was secure? Buahhahhahhahhahha!

--
Life takes interesting turns, but the most interest is when you're off the beaten path.

Re:Window analogy by Dunbal · 2010-02-23 04:50 · Score: 3, Interesting

An unlocked door also doesn't mean you have the right to open it either.
However, leaving your "secret info" in a public place, like say, the MIDDLE OF THE STREET, does not entitle you to any form of protection.
No door was opened. The internet by definition is PUBLIC. That is the PURPOSE of the internet. If you create a website and put information on it that requires no authentication or other sort of credentials to access it, you have placed said information in the PUBLIC. Otherwise all search engines are repeatedly "hacking" every single site on the web. You know that there's a file called robots.txt that you can use to limit access from spiders. And you know there's something called a "password" to protect sensitive information.
Not only is it inexcusable that a public office would commit such an act of negligence as putting (presumably) sensitive information in a place where it can be accessed by anyone, they compound their ignorance by trying to go after people who stumble across it. There have been a lot of ridiculous things happening in Australia lately, but this one takes the cake.

--
Seven puppies were harmed during the making of this post.
Re:Window analogy by Anonymous Coward · 2010-02-23 05:27 · Score: 0

Just because a house has windows and they aren't covered by curtains does not mean that by looking through the window and reading an important document left near the window that you're aren't stealing info.
Yes it does. At best you could have copied (duplicated) it.
Actually, in my country if you leave the curtains open and you than decide to walk around naked and someone sees you than you will be picked up by police for "indecent exposure". In other words : Its your duty to make sure someone cannot get a sneek-peek into your home and see stuff that he should not.
In the same direction : If you leave valuable stuff in your car but leave it unlocked that you (can) get a ticket for that (even without those valuables getting stolen).
Re:Window analogy by realsilly · 2010-02-23 05:32 · Score: 1

"The internet by definition is PUBLIC. That is the PURPOSE of the internet."
That being said, then all websites on the web should be deemed public by default, but as we know that is not true. A city is road is public, but the car you drive on it is yours and is private. The poorly secured website that is a private webpage on that public internet highway. The information was not put out there for the public, there was an effort made by the entrant to purposefully look for info. Therefore, no matter how ill-secured it was, it was not in plain site. Over 3300 attempts to access does not equal an accidental find.
I don't agree with the lax security that the govt. had. It is and was pathetic.

--
Life takes interesting turns, but the most interest is when you're off the beaten path.
Re:Window analogy by realsilly · 2010-02-23 05:37 · Score: 1

Good god man, where in heavens do you live?
This leads to the question of what is deemed "Valuable".
Is an IPOD more valueable than say an insurance card. Hell cars are stolen all the time for the basic components of the car. I know one guy who leaves a car at the airport, because he travels; he's gone for 2 days, and leaves nothing in the car of value. He returns to find the seats stolen out of his car. The seats from the manufacturer. So then what is deemed "valuable", in your country, seems awefully subjective to me.

--
Life takes interesting turns, but the most interest is when you're off the beaten path.
Re:Window analogy by Dunbal · 2010-02-23 05:49 · Score: 1

That being said, then all websites on the web should be deemed public by default,
What are you, a lawyer? Your view opens the door to endless litigation. Websites on the web ARE public, just as are IP addresses. You can't prevent someone from going to a web-site. However you CAN secure your website from unauthorized access. In the case you propose, it would be a "crime" to commit a typo and end up on the "wrong" page. In my case, just visiting the page won't get you the information I don't want you to see. You have to actively try to break into the site in order to get to it. Thus I can prove malicious intent.
Just like it's a lot easier to convince a court that you were justified in shooting the armed burglar who jumped a fence, smashed your window and defeated the alarm system of your house. A lot easier than convincing them that the guy who strayed off the sidewalk 12 inches onto your un-fenced lawn deserved a bullet in the head.

--
Seven puppies were harmed during the making of this post.
Re:Window analogy by Anonymous Coward · 2010-02-23 06:11 · Score: 0

Its not about "valuable", its about if you took enough precautions. like locking the doors and keeping the valuables outof sight as far as possible. If you do not (leaving (one of) the doors open) its, as far as I know, called "provocation" and could get you ito trouble with the Law (and certainly does with your insurance-company).
But may I remark how well you seem to have missed the point of my examples. I get the feeling of either a "Whoosh!" or a troll ...
Re:Window analogy by Ltap · 2010-02-23 06:11 · Score: 1

Better than a "Windows" analogy - just because a computer has ports and they are open does not mean that by sending a few trojans its way and looking at some porn on another guy's computer means that you aren't totally exploiting user stupidity.

--
Yet Another Tech Blog
(but so much more, including game and movie reviews)
http://yanteb.peasantoid.org
Re:Window analogy by precariousgray · 2010-02-23 06:35 · Score: 1

So, let's see if I understand this correctly. There is a house, with windows, and these windows are not covered by curtains. If I am looking through the window and reading an important document, I am stealing information. You're right: that is incorrect.

--
not much, just being forced to manually insert line breaks into my comment
Re:Window analogy by Anonymous Coward · 2010-02-23 07:47 · Score: 0

Unpublished? It was in DNS wasn't it? Sounds like it was published to me...
Re:Window analogy by Anonymous Coward · 2010-02-23 08:45 · Score: 0

There have been a lot of ridiculous things happening in Australia lately, but this one takes the cake.
This hardly takes even a Danish. On one hand, you have patient and thoughtful ethicists trying to explain intent, and on the other, you have geeks rolling their eyes at the lack of skill and a classic mistake. It's a silly old topic. I'd say the fact that I wouldn't be legally allowed to have pictures of my fully-grown girlfriend (who has small breasts) is the cake taker. Great job, Australia!
Re:Window analogy by FoolishOwl · 2010-02-23 09:17 · Score: 1

Someone registered a domain name for the site. Someone configured an http server to serve that domain name. Someone designed the web pages. Someone posted those web pages to the http server.
A series of deliberate actions were taken to publicly display the documents, before the journalists saw them.
It is completely absurd to compare the journalist's actions to anything like trespassing or theft.
Re:Window analogy by Anonymous Coward · 2010-02-23 09:24 · Score: 0

So how are you supposed to know if a certain website is for public consumption or not. Should the governemnt have had big red letters on the front page saying: "Do not read until Monday"?
Re:Window analogy by AlgorithMan · 2010-02-23 11:04 · Score: 1

then why do insurances deny payment, when something is stolen from your unlocked home?

--
The MAFIAA is a bunch of mindless jerks who will be the first up against the wall when the revolution comes
Re:Window analogy by canajin56 · 2010-02-23 11:30 · Score: 1

Who gave you permission to access Slashdot? Seems by your reasoning, you decided to just walk through the unlocked door, which you claim is wrong. Please stop hacking Slashdot!

--
ASCII stupid question, get a stupid ANSI
Re:Window analogy by Anonymous Coward · 2010-02-23 11:51 · Score: 0

"... does not mean that by looking through the window and reading an important document left near the window that you're aren't stealing info."
What if the notice is posted on the window, and you only have to walk up the path to read it? Furthermore, imagine it is posted on the window of a government building with no security fence or other security precautions evident.
Re:Window analogy by Lunzo · 2010-02-23 14:55 · Score: 1

I agree that the internet is a public place and putting info on a website counts as publishing it.
With this issue I'm not sure what all the fuss is about anyway. It seems like a storm in a teacup. The NSW government was going to announce the report on Sunday or Monday. The transport minister is just annoyed that SMH scooped him by finding the site on Friday and publishing articles about his report in the Saturday paper. Instead of media outlets just picking up his press release and parroting the spin, the report was held scrutinised by investigative journalists, before he even got a chance to try and spin the announcement.
The transport minister is also shitty that his great report on how he was going to revolutionise everything was torn apart by The Herald. They basically said they heard the same announcement 10 years ago and it still hasn't been implemented yet. They also gave the government a lot of flak over roads getting three times the spending of public transport - in a report that was on the future of public transport and how the state government was investing in it.

Lowell Maximum Security Prison? by LaminatorX · 2010-02-23 04:39 · Score: 1

I'd like you to consider that web-address "off-limits," as a favor to me.

Bad Security Everywhere by Anonymous Coward · 2010-02-23 04:39 · Score: 0

I once worked for a 3rd Party Energy Marketer, ie they sell you Gas/Electric "supply" and you pay your local utility for "delivery". So in the company's quest to find "good" customers, I took the liberty of writing a small program that started with a base 15 digit number and just incremented the number by one each time and tried to login to the ConEd NY website with that account number. Once I found an account that I could login, I had the account holder's name, address, payment history and usage history and could discover if it was an account worth our enrollment department contacting to try to sign up or if we should flag their account number as a "never sign this person up, ever" account. ConEd tracked down the IP/source of the millions of requests and asked us politely to stop, but the hole still exists ~5 years later and if I had some more free time, I'd continue to use my little program and run a junk mail campaign on my spare time. I don't know what this has to do with the story other than that I bet just changing query string parameters and seeing what happens is probably the easiest, most common "attack", even by people who don't mean to be attacking.

Still not far enough. by zippthorne · 2010-02-23 04:40 · Score: 5, Insightful

More like,

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn their own head in a busy, public marketplace and look at a billboard.'

Don't want people reading your web site? Put it behind a login. Anything else is just sophistry to cover up incompetence. Web sites are advertisements first and foremost. The whole point is to make it possible for as many people as possible to read your thing. If you want to exclude certain people from being able to view it, then you shouldn't just put a billboard up where you think it's out of the way and hope nobody notices, you should put it behind a door which requires a key to get in.

--
Can you be Even More Awesome?!

Re:Still not far enough. by EvanED · 2010-02-23 04:58 · Score: 1

Don't want people reading your web site? Put it behind a login. Anything else is just sophistry to cover up incompetence.
While I do agree, and think that criminal investigations and such in this case are ludicrous and hope they don't go anywhere, part of me does wonder... what's the difference between a non-linked document where you don't tell people the URL and a site with a password?
Would guessing 3000 different passwords be as forgivable, even if the system doesn't cut you off? Is an easily-guessed URL any better than an easily-guessed password?
Re:Still not far enough. by DangerFace · 2010-02-23 05:36 · Score: 1

... what's the difference between a non-linked document where you don't tell people the URL and a site with a password?
Would guessing 3000 different passwords be as forgivable, even if the system doesn't cut you off? Is an easily-guessed URL any better than an easily-guessed password?
The difference is huge. Look at the way house insurance works - you leave a door open, you're not insured. You leave a window open, you're not insured. You have a crappy lock on the door that a five-year-old could bypass, you're insured and they're guilty of breaking and entering.
I don't know how it works everywhere else, but in the UK if there isn't significant indication that you shouldn't be somewhere then you aren't trespassing. Thus, an open doorway with a sign saying "No Entry" means you are trespassing if you go past it, but an open doorway is effectively an allowable entry point for the public.
Somehow I suspect if you said, "But the unguarded door I left open with valuable items inside was on a small alley - I didn't think anyone would notice!" people would laugh in your face. Of course, theft is theft, but if all these people did was have a look around and take photos of something embarrassing then it's just a bit funny, really.

--
Be smart, help people!
Re:Still not far enough. by FoolishOwl · 2010-02-23 05:37 · Score: 1

The difference is, by publishing a document on the Internet, you have made it publicly available. The Internet is a public medium. Publishing documents on the Internet is equivalent to passing out leaflets on a busy street corner -- people are likely to ignore you, but the assumption is, they can take the leaflets and read them if they please.
If they didn't want the documents to be publicly available, they could have:
* Required a password to view them;
* Or, hosted them on a webserver not accessible via the Internet;
* Or, not hosted them on a webserver.
The last would have taken no effort at all. You don't actually need a webserver running to view local HTML documents -- your filesystem is perfectly adequate for serving a website to a browser on your own computer.
Re:Still not far enough. by Anonymous Coward · 2010-02-23 06:02 · Score: 0

These arguments make sense, and I couldn't see anything on the website that would have led the reporters to think they shouldn't be there.
However, the byline for the article they wrote reads like this:
"THE Keneally government's transport masterplan is set to rehash old announcements, with minor additions to the CityRail network, secret government documents reveal."
The paper calls them "secret government documents". Since they don't appear secret by visiting the site, whoever tipped them off must have told them this was a secret site. In this case, they were knowingly accessing a website they knew was not meant for them to view.
While this doesn't excuse the government or the hosting provider, it also doesn't fit perfectly with the paper's stance of "we didn't do anything wrong... it was sitting right there!"
If they had simply called them "government documents" or "proposed government documents" -- which is what the government said they were when they were initially asked, I would see no issue here; just governmental incompetence.
As it is, the analogy is closer to this:
A security company is putting in a new system for a bank, and they mistakenly leave the proposed blueprints in a publicly accessible unlocked room (that is still bank property, and has not been officially made available to the public). Someone who works for the bank tells the newspaper, "hey, I saw these secret blueprints for the proposed security system for the bank in this room... here's how you get to it." The reporters then enter the bank, enter the room, and photograph every page of the proposed blueprints. Then they go back to the office and write up a story about the bank's secret new security system, highlighting possible flaws and printing excerpts from the blueprints.
Now, based on this analogy, it would be equally absurd for the paper to say "Hey, it was just sitting there; all we had to do was enter the room and we couldn't miss it" and for the bank to say "According to our CCTV, you broke into our secure room and took pictures of 3,727 elements of our confidential blueprints using 4 cameras."
See, the issue here is that both the ministry and the paper say that the documents were secret and confidential. And yet, at the time, it appears that the truth is that anyone stumbling across them would have argued that they were unpublicized and internal.
Another point here is that back in the day, Microsoft's web server by default gave access to the host filesystem on port 8080 -- I stumbled on a few of these, and being curious, opened a few files to see what I was looking at. When I realized it was the billing records for a medical establishment, I didn't grab them all and publish them; I deleted them from my system and never went back to the site again. You see, I realized that these were not meant for me, even though they were sitting in plain sight. This seems to be an ethic that was overshadowed by the ability to get a "sensational" scoop in this story -- a scoop that really wasn't all that sensational, especially since it was known that the data was going to be public in a couple of days anyway.
Re:Still not far enough. by EvanED · 2010-02-23 09:47 · Score: 1

I don't know how it works everywhere else, but in the UK if there isn't significant indication that you shouldn't be somewhere then you aren't trespassing. Thus, an open doorway with a sign saying "No Entry" means you are trespassing if you go past it, but an open doorway is effectively an allowable entry point for the public.
What about a closed door?
Let me ask this. Let's say I put together a site with a login page. When I create the form, I have the choice between submitting the form as a GET or POST request. Should it make a difference as to whether someone trying passwords in the "password" field is "in the right"?
Suppose I make the (poor) decision to submit with GET. Is there a difference between someone using the form to guess passwords vs. seeing that the password is in the URL and just trying different things after "?password="?
Finally, let's say I change the submission script a bit so I use Javascript to redirect the user to "example.com/login/password" instead of "example.com/login?password=password". Is there a difference between those?
And at that point, what is the "attacker" doing that isn't just guessing a URL?
Somewhere in here there has to be a distinction between guessing someone's password and guessing a URL, but I have to admit that I don't quite see where it is. Is it the final difference, because you could expect someone to know that "?password=blah" indicates that it's supposed to be restricted? I dunno.
Re:Still not far enough. by zippthorne · 2010-02-23 10:41 · Score: 1

There's no way to reasonably expect a person to know that your example is a login and password or just garbledegook auto-generated directory structure. You see autogenerated directory structures all over the web, in fact there's probably some on this very web page if you'd care to look under the hood.
Not only that, but even in the second example (and btw, don't foucs on GET v. POST very much. Under the hood, they're extremely similar.) everything is sent in plaintext. You're still not talking about a locked door. At best, you're talking about a long hallway of open doorways, where some lead to rooms and many do not.
There is already a very simple, pretty secure way to allow restricted web access to certain information, and that way is SSL, not http passwords. (which would be more of "http://user:pass@example.com/stuff" but which are also plaintext and therefore frowned upon.)
This is eerily reminiscent of the cell phone companies who used to, instead of encrypting their transmissions, just transmit in plain ol' AM, and rely on specific legislation to make sure no one was listening. Except that such legislation is not in place here.

--
Can you be Even More Awesome?!

Answer: by mea37 · 2010-02-23 04:40 · Score: 1

Why, yes, yes it is.

First of all, define "completely unsecured". I'm pretty sure I know your definition, and if I had to vote I'd support it; but I'm also pretty sure I know their definition and it has a frightening amount of support. They will argue, and the courts might accept, that the non-publication of the URL constitutes "security", or an expectation of privacy, or whatever terms they need to feel good about filing charges.

This is a matter of technical knowledge. To a person who only knows how to follow links, limiting circulation of links can seem like "security". You can point out that it's easy to learn the skills to circumvent that, but think how that looks to someone who isn't very computer literate. "Sure, you can learn how to get around it - just like a thief can learn how to bypass a typical 5-pin lock. The skill to bump a lock isn't very hard to learn either."

The point is, as long as the typical level of knowledge doesn't include ways to find a non-published URL, the perceived threat will be in those who have the knowledge - not in those whose idea of "security" allows that knowledge to be used. I've seen Fortune 500 companies ban dsektop search tools rather than tell their employees not to "hide" sensitive documents on unlocked directories of shared drives. You really think the courts and laws are so far ahead of that knowledge curve?

Ultimately what's missing is a universal legal standard that presumes information is public if it is deliberately placed on a web-accessible file system without at least a prescribed level of protection. How strong that prescribed level of protection should be is open to debate. I don't need fool-proof security on my house to charge you with trespassing - a closed door is more than enough.

The exact standard isn't important. What's important is, the standard should exist, should be universal, and should be known to all parties.

Re:Answer: by Monkeedude1212 · 2010-02-23 04:58 · Score: 1

the non-publication of the URL constitutes "security", or an expectation of privacy, or whatever terms they need to feel good about filing charges
That will be a scary day indeed.
All I will need to do is make a popular mis-spelling, claim my site was meant to be secured, and any and all visitors are intruders seeking to steal my private data, and then sue everyone listed in the logs.
slashhdot.org! Why they accessed my secret files!
Re:Answer: by maxume · 2010-02-23 05:02 · Score: 1

If we end up with a legal standard where making information available over http without authentication is considered anything other than intent to share the information, we have failed miserably.

--
Nerd rage is the funniest rage.
Re:Answer: by tomhudson · 2010-02-23 05:15 · Score: 2, Informative

Sorry, but your argument fails almost immediately.
The url had already been "published" in the legal sense - as soon as someone leaked it to the reporters. There was no guesswork here. The reporters are part of the general public, and the disclosing of the url, without a prior agreement to keep it confidential, meets the legal definition of "to publish", same as a defamation suit only needs the words to be "published" to any 3rd party, not the entire population.
Re:Answer: by Anonymous Coward · 2010-02-23 06:03 · Score: 0

My web site manages user sessions by requiring that the username and password be presented in the URL as follows:
www.foobar.com/page.php?u=foo&p=p45sw0Rd
Re:Answer: by mea37 · 2010-02-23 06:29 · Score: 1, Funny

Sorry, but your argument fails immediately.
RTFA. Nobody leaked the URL to reporters. Reporters guessed URL's until they hit on one.
But I guess the moderators are in wishful thinking mode today, so you got an up-mod for a non sequitur.
Also, you should probably learn to do a better job identifying who the enemy is. Jumping down my throat for pointing out unfortunate realities of the current legal landscape isn't helping you.
Re:Answer: by neurovish · 2010-02-23 06:46 · Score: 1

Sorry, but your argument fails immediately.
RTFA. Nobody leaked the URL to reporters. Reporters guessed URL's until they hit on one.
What? From TFA:
We got a tip on Friday that you could read the government's transport plan by accessing a website called, unsurprisingly, nswtransportblueprint.com.au ...we were confronted with a dream menu for any reporter: rail services, cycleways, walking and cycling, bus services, paying and road network.
I understand we're not supposed to RTFA, but telling somebody that they are contradicted by TFA without RTFA? Is this a new rule?
Re:Answer: by tomhudson · 2010-02-23 08:26 · Score: 2, Informative

Sorry, but your argument fails immediately.

RTFA. Nobody leaked the URL to reporters. Reporters guessed URL's until they hit on one.
But I guess the moderators are in wishful thinking mode today, so you got an up-mod for a non sequitur.
Also, you should probably learn to do a better job identifying who the enemy is. Jumping down my throat for pointing out unfortunate realities of the current legal landscape isn't helping you.

You are sooo full of crap. Instead of reading the comments and telling me to RTFA, go RTFA yourself, like I did. They didn't have to guess a url. They were given the base url, and that was ALL that anyone needed to get access to every other page, same as http://slashdot.org/ gives you access to this sites contents. Don't you know how the web works yet?
Re:Answer: by Anonymous Coward · 2010-02-23 12:26 · Score: 0

RTFA. Nobody leaked the URL to reporters. Reporters guessed URL's until they hit on one.
But I guess the moderators are in wishful thinking mode today, so you got an up-mod for a non sequitur.
Also, you should probably learn to do a better job identifying who the enemy is. Jumping down my throat for pointing out unfortunate realities of the current legal landscape isn't helping you.
In Soviet Russia, ^^THIS GUY^^ happens.

A more correct simile by Anonymous Coward · 2010-02-23 04:43 · Score: 0

'akin to 3,727 attempts to pick the lock of a secure office and take highly confidential documents.'

A more correct simile would be like driving around to the addresses of 3,727 public parks until they find the one that contains documents.

Redefinition by Anonymous Coward · 2010-02-23 04:47 · Score: 0

No matter what the vendor/contractor/"expert" told you, an unanounced valid URL is NOT a firewall.

Hey AU gov't by Arancaytar · 2010-02-23 04:49 · Score: 0

No, it's not. It's more like calling 3727 telephone numbers until you find one that is connected.

Re:Hey AU gov't by PRMan · 2010-02-23 05:20 · Score: 1

No. It's like calling ONE phone number and having the operator tell you 3727 secrets about her boss.

--
Peter predicted that you would "deliberately forget" creation 2000 years ago...
Re:Hey AU gov't by canajin56 · 2010-02-23 11:32 · Score: 1

Read TFA. They didn't trial and error 3,727 times. Somebody e-mailed them a link, and they followed it. 3,727 is the total number of HTML requests that the "secret" and "confidential" public web server received. As the above reply notes, it's like calling ONE phone number that somebody told you to call, and having an automated system there tell you everything you wanted to know.

--
ASCII stupid question, get a stupid ANSI

Proposal for Australia by elrous0 · 2010-02-23 04:54 · Score: 5, Funny

Considering all the anti-internet, anti-gaming, anti-pron laws and sentiment that seems to have become so pervasive in Australia recently (much to the delight of /. editors, who have had no shortage of great front page stories from there recently) I propose that Australia must, to protect its citizens from the immoral influence of the internet, REMOVE ITSELF FROM THE INTERNET IMMEDIATELY. It's the only way to be sure.

--
SJW: Someone who has run out of real oppression, and has to fake it.

Re:Proposal for Australia by blackraven14250 · 2010-02-23 05:33 · Score: 1

TL;DR:
Australia losez teh internetz, nao.
Re:Proposal for Australia by Heed00 · 2010-02-23 05:47 · Score: 1

I think you'll find that taking off and nuking the entire site from orbit is the only way to be sure.

--
Thought thinks itself.
Re:Proposal for Australia by Anonymous Coward · 2010-02-23 05:50 · Score: 0

No... no... don't give them any ideas. Please.
Re:Proposal for Australia by Destined+Soul · 2010-02-23 06:00 · Score: 1

Now /. needs a "Informative yet Funny" mod, if not at least for the above comment.
Next thing they'll be banning IE, Firefox, et al, for making one-click hacking software. Retarded* politicians.
(* I have a Down's syndrome brother, so I liberally apply the word retarded for those who act worse than my brother.)
Re:Proposal for Australia by Anonymous Coward · 2010-02-23 07:26 · Score: 0

It's the only way to be sure.
Haha. I love that movie.
"They mostly come at night. Mostly."
"Game over, man! Game over!"
Bill Paxton is ha-larious!
What were we talking about?
Re:Proposal for Australia by Anonymous Coward · 2010-02-24 00:26 · Score: 0

Sanctions only fuck up the citizens, what you really want is for all politicians to die in a fire (especially Australian ones).
Re:Proposal for Australia by elrous0 · 2010-02-24 03:05 · Score: 1

It's Australia. Unless you hit them directly in Sydney, they probably wouldn't even notice they'd been nuked.

--
SJW: Someone who has run out of real oppression, and has to fake it.
Re:Proposal for Australia by EdgeCreeper · 2010-02-25 00:05 · Score: 1

You say that nuking Australia from orbit protects it's citizens!? You might be a politician.

Latvia too by atisss · 2010-02-23 04:57 · Score: 0

Our local media is full of news regarding Gov't Tax office, it has been hacked by just incrementing id's in URL (without any authorization), so total of 7 million declarations have been downloaded. Attacker is publishing downloaded data on Goverment owned institutions, revealing income of most-paid employees. http://latviantelecoms.blogspot.com/2010/02/cyberactivists-obtain-latvian-state.html

Re:I am not a lawyer by Anonymous Coward · 2010-02-23 05:03 · Score: 0

If I hide my wristwatch in a crowded shopping mall with the intent of retrieving it after lunch, and someone else finds and takes it, has that person stole my watch?

Media like this never prosecuted by DVD9 · 2010-02-23 05:03 · Score: 2, Insightful

If an unemployed blogger had done this he would get many years in prison (perhaps, I'm American so maybe this does not apply in Australia). Not only that, but the "newspaper" involved here would pay no attention to the blogger's rights and report the story the way the government prosecutors wished it to be written. The editor of this paper is laughing about the "controversy" and enjoying the attention as he is part of the club who run the country.

--
Why do "Al Qaeda" bulletins allegedly authored by Osama Bin Laden sound as if they were authored by Oliver North?

Appraently, Yes. by celtic_hackr · 2010-02-23 05:04 · Score: 1

Someone has secured the site, or deleted it. The link no longer works, and here I was going to look for a robots.txt file. Rats! Foiled again!. Not even a login prompt. It may be:[Agent86 voice] "they used the old use the /. effect to bring the server crashing down and thereby securing it from all those pesky hackers" trick.[/Agent86 voice]

Curiously, they specifically make it sound like all 3,727 page hits were from the hacks at the Herald, but clearly state the "some of them" came from the Herald. So, what is the actual number from the Herald hacks? Hmmm... I'd buy that for a dollar!

Yes.... by MROD · 2010-02-23 05:11 · Score: 1

Daniel Cuthbert, who "hacked" the DEC charity website by using '../' in the URL. Convicted 2005.

http://www.samizdata.net/blog/archives/008118.html

--

Agrajag: "Oh no, not again!"

That's some gate you've got there.... by ElmoGonzo · 2010-02-23 05:19 · Score: 1

...now all you need to do is build a fence and connect it to either end.

Plead stupid! by headkase · 2010-02-23 05:25 · Score: 1

I'd almost want to plead guilty if in return the government would plead stupid.

--
Shh.

The best part. by thePowerOfGrayskull · 2010-02-23 05:30 · Score: 1

"This is akin to 3,727 attempts to pick the lock of a secure office and take highly confidential documents..."

Clearly, if an office is making 4k hits trying to guess a single URL, it must be hacking! But wait, there's more...

Mr Campbell says there were about 3,727 unauthorised hits on the website, some of them from a computer belonging to a "Sydney media organisation".

Erm, that is to say, clearly if an undisclosed subset of 4k hits come from a newspaper office, then it must, uh, be a hacking attempt.

Right-o. Carry on then.

A personal account. by Anonymous Coward · 2010-02-23 05:41 · Score: 0

A person on a discussion forum was being a general dick, skirting the line where you could say he was definitely being obnoxious but pulling back and acting hurt when anyone would address his dickishness.

So I noticed he posted images through a Photobucket account all the time. I took the URL of one image and simply removed the 'this_image.jpg' part of it.

Photobucket itself changed the URL and showed he his contents... and it turned out he liked collecting some racist imagery. I don't just mean historical photos, I mean stuff with text added and stuff Photoshopped to appeal to his fellow racists.

I made sure I took plenty of screenshots first. I then sent personal messages to those he had rubbed the wrong way, supplying them with the screenshots.

The next time he tried playing internet tough guy, out came screenshots. He made a big song and dance about how HE was being oppressed and how he was going to sue everyone. He accused everyone of hacking him, which is where I stepped in. I told him that I was the one that had saw his Photobucket was wide open for anyone to view (I didn't tell him about passwording it... some people just need to learn the risks). I told him that if I wanted to be nasty, I could have sent him a personal message with an image attatched that would reveal his IP address to me when opened... and he left the forum. I guess the fear of even considering the prospect of his face and location emailed to his ideological targets called his bluff.

He turned up some time later as an alt. Someone else recognized the style, and sure enough he was linking to images on Photobucket. The same account. Still not password protected.

Good times followed.

Too funny... by g0bshiTe · 2010-02-23 05:54 · Score: 1

Looking at the actual webpage, it appears there is a login now. Considering the previous gaping security hole I wonder how much fun you could have with the Login URL.

http://nswtransport.com/login?return_to=%2F

I wonder if it would return

http://nswtransport.com/login?return_to=..%2F..%2F..%2Fetc%2Fpasswd

--
I am Bennett Haselton! I am Bennett Haselton!

Alternate URL by Anonymous Coward · 2010-02-23 06:03 · Score: 0

Funny really, seeing as they didn't turn off the DNS for http://nswtransport.com which resolved to the same server

Re:Why care about security when you can rule by fe by Anonymous Coward · 2010-02-23 07:11 · Score: 0

These reporters will learn not to meddle in government affairs when they're behind bars for the next 50+ years for computer offenses.
Security is for chumps. Real security is sleeping well at night knowing that everyone else cowers in fear of your wrath.
Not many reporters are willing to bet their lives on a story, and those that are willing will be made examples to the rest.
Either the story dies or you do - Your choice!

"The more you tighten your grip, Tarkin, the more star systems will slip through your fingers."

Sorry, had to slip in a Star Wars quote somewhere. :)

Obscurity?? by Y+Ddraig+Goch · 2010-02-23 07:34 · Score: 1

The fact that the DNS server resolved the URL to an ip address is proof that this or was going to be a public site. Fer cryin' out loud, if you want obscurity don't create DNS records that point to your server. Sheesh!

--
Meddle thou not in the affairs of Dragons, for thou art crunchy and with most anything.

Fun w/ Numbers by Anonymous Coward · 2010-02-23 07:36 · Score: 1, Insightful

Numbers can be wonderful fun. They can mean many things, and not qualifying them can be very effective when you want to mislead....

The number of "violations" being bandied about is probably actually the number of individual GET requests by the web-browser(s) against the web server.
On a media-rich web-site, (which this probably was, since nobody want to actually read anymore), one could probably rack up that many GET requests simply by loading a couple dozen logical pages. (Since every href results in yet another GET...)

Also, they used the browser to print the web-pages. Depending on the web-browser and the cache-ability of the documents already viewed, the browser may have had to GET all of the pieces AGAIN just to print the document!

S.O.P. for Microsoft sites by Anonymous Coward · 2010-02-23 07:48 · Score: 0

This is not news. Microsoft site managers have always depended on 'unlisted number' type of fake security. They also have always tried to bully or threaten any that point out, accidentally or on purpose, that the Microsoft emperor has no clothes. That's not new either. Look around. Dig a little. You'll find this method of cover up for gross incompetence common at sites with Microsoft infestations.

Send them off to Silicone Pines by Anonymous Coward · 2010-02-23 07:59 · Score: 0

The self described "hacks" ((newspaper term)) claim that they are not really computer savy. OK , take that at face value. I think that the NSW blokes and theit IT provider should be sent to Silicone Pines: http://www.satirewire.com/features/siliconpines/acf.shtml

No analogy needed by TWX · 2010-02-23 08:09 · Score: 2, Interesting

There's no need for analogies for what the government did. They flatly [i]published[/i] something, didn't bother to tell anyone they published it or where they published it, and got mad when someone found their published work, read it, and presumably reported what they read and helped others to find that publication. I've always looked at posting to a website as publishing in the loosest of senses. It's certainly vanity publishing in the vast, vast majority of cases, but the entire point of putting something on to the Internet without any sort of real security is so that people can find it. If a person or organization doesn't want something read potentially by all, they simply have to not upload it to a public server.

--
Do not look into laser with remaining eye.

It all depends on intent by PPH · 2010-02-23 08:17 · Score: 1

You are not supposed to open a box with a combination lock because the owner, by installing that lock, has indicated his intent not to allow unauthorized persons access. It could be a cheapo lock with an easy to guess combo. Or it could be something expensive and pick proof. In the eyes of the law it doesn't matter. Common sense may suggest investing in something better than the cheapest lock, but the law doesn't care.

A URL is not a secret, given its common use. So it doesn't have the same legal standing as a combination or uid/password. Particularly if that URL has any meaning associated with the likely contents of the site. I would expect anyone searching for information on transportation in New South Wales to consider nswtransportblueprint.com.au to be a perfectly reasonable place to look for public information. So a reasonable person could assume that the site's owner had no intention of securing it. Hiding it at Goatse.cx would have been another matter. But then I don't know much about New South Wales government, so perhaps I'm wrong.

--
Have gnu, will travel.

robots.txt by indre1 · 2010-02-23 08:39 · Score: 1

Contents of aussiegovernmentdomain.com/robots.txt

User-Agent: *
Disallow: /very/secret/catalog123

Is that 3,727 requests to the http server? by FoolishOwl · 2010-02-23 08:46 · Score: 2, Insightful

I noticed a few people reacting to the 3,727, as if it was some sort of brute-force attack to get a URL.

If that was 3,727 requests to the http server, I think that wouldn't be very much. That is, reading a web page with graphical elements would, I would think, involve a dozen or so http requests -- more if there were lots of little icons and what not. Two journalists looking at a dozen such web pages a few times each would run up that number pretty quickly. (Can someone with more networking experience than I have check my thinking?)

And, of course, a decent firewall logs all requests, including legitimate requests.

So, I would guess that this is just the politician grabbing a number that sounds large to him, and ascribing significance it doesn't have.

Re:Is that 3,727 requests to the http server? by canajin56 · 2010-02-23 11:35 · Score: 1

3,727 is the total number of lines in the firewall log that involve outside IP addresses.

--
ASCII stupid question, get a stupid ANSI

Analogy Fail by Dracophile · 2010-02-23 09:26 · Score: 1

The web works differently. One computer asks another for an index of available material. The other computer, by default, complies with the request and hands over a copy of the index. The first computer asks for a copy of the material listed in the index, and the second, again by default, complies with that request. This is not at all the same as walking into a house with an open door and removing actual property. Computers on a network will always do what they are asked to do. They are designed to do exactly that. When they do it, they are working exactly as they are supposed to work. This is not at all analogous with our traditional understanding of the way houses work. It's way past time people understood that.

--
Athy, athier, athiest.

Re:Analogy Fail by realsilly · 2010-02-24 04:44 · Score: 1

But the computer didn't type the IP address, therefore it's a conscience action of the user of the PC that got to the IP location, whether Published or UnPublished.

--
Life takes interesting turns, but the most interest is when you're off the beaten path.

And who's the genius... by Anonymous Coward · 2010-02-23 09:36 · Score: 0

...who published said highly confidential documents to a public webserver? This story should be about them getting fired, not about "hackers".

Pikers, really. by Anonymous Coward · 2010-02-23 09:58 · Score: 0

All they need do to persecute Sydney Morning Herald is to put this on their main page: http://simpsons-xxx.com/thesimpsonsporn01.jpg

NSFNSW

Security through Obscurity by Anonymous Coward · 2010-02-23 10:07 · Score: 0

= Fail

Local newspaper? by GrahamCox · 2010-02-23 10:53 · Score: 1

The Sydney Morning Herald, a local newspaper? Well, yes, I guess so, in exactly the same way that the New York Times or Washington Post is.

Raises important points about security by cybereal · 2010-02-23 13:46 · Score: 2, Insightful

In nearly every home in the US, let alone the world, the doorways are locked with $5 pieces of tin and maybe a tiny bolt of metal shoved through some wood. There is little challenge to defeat these locks, either through picking or just jostling the door open or breaking the jamb. Furthermore, it's often the case that the doors are not locked at all, or perhaps a window is left open, or unlocked, and it's just assumed that since it's a second story window, that nobody would try it.

So many of these homes are invade by thieves. And yet, there is no question that those invading were violating a law.

If you enter a public place, rules tend to change. Despite the doors not being locked, I can walk into a grocery store and not feel like I've trespassed because it's a business and that's expected. However, I've often seen unmarked doors in dark corners of large stores, or even doors marked "Employee Only" or maybe an unlabeled staircase leading to who-knows-where. I know I'm not welcome in those areas, and if I entered one and was subsequently accosted for it, should I be shocked?

Now we start talking about computers, and their presence on public networks. To me this is some kind of bizarre combination of the two previous physical scenarios. The computers themselves are viewed as having the privacy rights of the house, where-as their offering and the environment in which they make the offer is more like the store, or even another unmentioned public situation: A public park. So how do we come to the conclusions we make? Why is "security by obscurity" not enough to justify criminal charges to those who would violate it?

Or, if you see things the other way, then I ask why you think that the public accessing a publicly offered machine is somehow unlawful, even if they are walking through those otherwise unmarked doors or looking for out-of-the way staircases?

Just because a person doesn't break a lock to get into a home doesn't mean it's not breaking and entering, and just because a door at a store is unmarked doesn't mean the person's trying to break the law either. In the internet, your computer is knowingly placed in the public arena with open attempts at making it easy for the public to find and access, yet somehow accessing an unadvertised part of that computer is a violation?

I don't think the answers are clear but I do think some of the associated assumptions on both sides are questionable. It's interesting to thing about at least. Who has the responsibility here, is it the site admin's responsibility to batten down every hatch or is it reasonable to expect people not to snoop around? You tell me...

--
I read the script, and I think it would help my character's motivation if he was on fire. -Bender

Re:Why care about security when you can rule by fe by mjwx · 2010-02-23 15:34 · Score: 1

Security is for chumps. Real security is sleeping well at night knowing that everyone else cowers in fear of your wrath.

But that will never happen, lets ignore the fact that the Australian government couldn't intimidate a kitten, let alone an Australian and think about that statement for a while.

You will not sleep well at all if everyone fears you, you are a threat to them and people like to remove threats to them so that they can live without fear. Fear you see is a very powerful motivator and extremely chaotic (it will never work like you expect it to). In actual fact you will sleep very restlessly out of the fear of an uprising or the fear that your own subordinates deciding to top you and take your place.

Those who rule by fear are also ruled fear or if you would prefer, live by the sword, die by the sword.

--
Calling someone a "hater" only means you can not rationally rebut their argument.

My first hack by Anonymous Coward · 2010-02-24 04:47 · Score: 0

I remember my first hack.

I was relatively young, maybe 13. It was when HOTMAIL was the thing. I had just entered seventh grade and changed into 'high school'. We had IT lessons in school and everybody was taught how to open up a hotmail account (it was the only commonly known free e-mail service back then).

I thought it was fun to change a character at the end of a hash (IIRC, this is years ago) and your account to someone else's account name in the URL when you were logged into your account.

This changed the inbox view to that other person's view. You could use it as if you had logged in as them. It was fun for maybe 10 minutes. Then my attention went elsewhere. I don't think I ever told an adult about it.

Was this a hack or not?

Please elaborate.

simply foolish by Anonymous Coward · 2010-02-24 06:06 · Score: 0

anyone who is foolish enough to put important documents in www.mysite.com/secretstuff deserves to have their "secret" stuff discovered.

trespass analogy by GregNorc · 2010-02-24 12:54 · Score: 1

In my state, if an area is not obviously private land, you have to post a "No Trespassing" sign. (Similarly, a business/gov't agency would have to mark an area "Restricted" or "Employees Only".

If no sign is posted, and the police are called, the police inform you you're trespassing, give you a little paper to this effect, and if you come back, you're arrested. But if the property owner tells you to leave, and you do, you have committed no trespass.

I see this access of the Australian Government's documents analogous to a hiker who was exploring public land, and wandered into a private field. Without a fence, or a posted sign, they had no way to know they were trespassing, and any charges to that effect would be easily overturned.

Splitting of hairs by DeVilla · 2010-02-24 14:49 · Score: 1

Without saying who I believe is actually right in this case, I can't help but wonder how is different to brute force

http(s)://hostname/secret

and

http(s)://username:pasword@hostname/

since basically secret could equal user:password? In the second case, you know the secret has at least one known character.

Newspaper Knows no Boundaries by greyblogs · 2010-02-24 19:46 · Score: 1

It is amazing the newspaper was poking around for two days to research a story and the Aussie gov't didn't notice--that is scary. And, the newspaper going in their backoffice to do research is pretty brassy and brash. Would think that would be illegal, as they don't own the website or have permissions. What if there is private information about the private citizens they were accessing? Yet, they thought it was okay to keep going back in there...Sickening, no honor, no boundaries.

Slashdot Mirror

Newspaper "Hacks Into" Aussie Gov't Website By Guessing URL

271 comments