Newspaper "Hacks Into" Aussie Gov't Website By Guessing URL

Wouldn't it have been easier by NotQuiteReal · 2010-02-23 03:59 · Score: 1

To just Google what they wanted to know? Google even has a "url" specifier!

--
This issue is a bit more complicated than you think.

Re:Wouldn't it have been easier by miggyb · 2010-02-23 04:05 · Score: 3, Informative

Google is already a dangerous hacker tool.

--
This signature serves no purpose other than to help you see which posts were made by me.
Re:Wouldn't it have been easier by SatanClauz · 2010-02-23 04:18 · Score: 1

I didn't see this personally, but the person that told me would not have known to make this up or do it on his own.
Picture this:
work laptop in work car
employee opens laptop to use it
employee happens to be down town in business areas
auto-connects to some strong wifi (this was a few years ago before things were pseudo-secure from the box)
accidentally opens the viewer for our in-house security cameras
camera software auto-scans for feeds
employee finds this hilarious and calls to tell about how he is looking at server rooms and hallways in some building
needless to say, that made my day.
Re:Wouldn't it have been easier by Anonymous Coward · 2010-02-23 04:44 · Score: 1, Insightful

Well, considering that he accessed an unknown wireless network and didn't have the laptop configured to VPN back to a trusted network, he was lucky that he just stumbled upon someone even less security-minded than himself.
Proper configuration is not to connect to unknown wireless networks and only configure WPA(2) protected networks. Autoconnecting to unsecured networks is just as stupid as offering them.
Re:Wouldn't it have been easier by SatanicPuppy · 2010-02-23 04:54 · Score: 5, Insightful

The problem with that analogy is that passwords are by default 2 factor authentication: you need a username and a password.
That's not really the case with a url. A better analogy would be walking around a building on a public street, and looking in windows. It's legal, but morally suspect.

--
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Re:Wouldn't it have been easier by Bengie · 2010-02-23 04:55 · Score: 1

A better analogy would be calling random phone numbers to see if you get any to ring. When you finally get a phone number to ring, it has a voice mail on it and doesn't even prompt for a password.
Re:Wouldn't it have been easier by GizmoToy · 2010-02-23 04:58 · Score: 5, Insightful

I wouldn't call putting something up on the internet, completely out in the open with no protection whatsoever, and then simply hoping no one will find it because you didn't announce its presence, "essentially a password".
If the internet is a forest and I protect my valuables by sitting them underneath a tree far from civilization and tell no one they're there, should I be mad if someone looking around the forest for valuables takes them all? No. Either you don't put your valuables in the forest or you put them in a big honking safe that no one can break into or walk off with.
Re:Wouldn't it have been easier by paiute · 2010-02-23 04:59 · Score: 4, Insightful

A secret URL is essentially a password
More like an unlisted phone number.

--
If Slashdot were chemistry it would look like this:Cadaverine
Re:Wouldn't it have been easier by SatanClauz · 2010-02-23 05:01 · Score: 1

Yes, it is bad to auto connect.
Things were different back-in-the-day, remember?
It is really sad to see things like this happen today.
Re:Wouldn't it have been easier by Anonymous Coward · 2010-02-23 05:01 · Score: 1, Insightful

A better analogy would be walking around a building on a public street, and looking in windows. It's legal, but morally suspect.
Unless you're a newspaper researching what your government is up to - in which case it's your job.
Re:Wouldn't it have been easier by Linuxmonger · 2010-02-23 05:07 · Score: 1

It was three factor, you needed to know the domain first, then the specific server, then the specific pathname on that domain/server. Kudos to the press for having the inside information on the first two, then the perseverance to discover the third.
Re:Wouldn't it have been easier by schon · 2010-02-23 05:24 · Score: 5, Informative

Sorry, but the submitter got at wrong.
No, you did.

A secret URL is essentially a password
Wrong. There is no such thing as a 'secret' URL. This was an unpublished URL, which is not the same thing as a secret.
A secret is something that everybody involved knows not to divulge. A HTTP URL is transmitted in plaintext, URLs are stored in plaintext in your browser's history, they are sent as a referrer when you click on a link in a page or when you load an external element, they are stored in plaintext in your server's logs - they are the exact opposite of secret.
Re:Wouldn't it have been easier by Anonymous Coward · 2010-02-23 05:31 · Score: 1, Informative

A string anybody can guess with enough persistence? Why even bother with the "correction"? Passwords have the same weakness as "unlisted numbers" and "secret URLs". They mitigate it by using enormous key spaces. URL key spaces are of comparable size to password key spaces. The problem is using a crap secret, not merely keeping a secret.
Re:Wouldn't it have been easier by rbochan · 2010-02-23 05:41 · Score: 1

Sorry, but the submitter got at wrong. A secret URL is essentially a password - so attempting lots of funny URLs can be like trying lots of ssh logins. The problem here is that it was a weak password, not that they used a secret URL...
Do you work for the Tuttle, OK government?

--
...Rob
The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
Re:Wouldn't it have been easier by BrokenHalo · 2010-02-23 06:10 · Score: 1

It's legal, but morally suspect.

Why? URL stands for Uniform Resource Locator. The whole point of it is to locate content. The fact that no-one has stood on the roof of the NSW parliament building yelling "Go to this address!" through a bullhorn doesn't mean it's "secret".

It certainly isn't secret if it is resolved through a standard DNS query. And since when is querying a DNS "morally suspect"?
Re:Wouldn't it have been easier by gnasher719 · 2010-02-23 06:19 · Score: 1

More like an unlisted phone number.
More like if we had a phone system where you typed in the name of the person you want to call and it connects, and you type in the name of a person who isn't listed in the official phone directory.
Re:Wouldn't it have been easier by Actually,+I+do+RTFA · 2010-02-23 06:51 · Score: 1

The problem with that analogy is that passwords are by default 2 factor authentication: you need a username and a password.
2 factor authentication implies two different types of authentication. These types are both information you know, and thus one-factor. It can easily be proven that a username(max length u1)/password(max length p1) combination is as secure as just a password(max length u1+p1).

--
Your ad here. Ask me how!
Re:Wouldn't it have been easier by quickOnTheUptake · 2010-02-23 07:04 · Score: 1

Another difference is that URLs are not designed to be secret. This is evidenced by the fact that a good password system a) gives no feedback (i.e., doesn't tell you which of the two factors was incorrect) b) often will have a forced pause between attempts c) often will have a forced lock-out after some relatively low number of failed attempts. This makes bruteforcing a pw considerable less feasible. Most http servers don't have any such mechanisms in place, precisely because URLs aren't supposed to be secret (thus transfered and stored in plaintext etc).

--
Mod points: Guaranteed to remove your sense of humor.
Side effects may include gullibility and temporary retardation
Re:Wouldn't it have been easier by Itninja · 2010-02-23 07:09 · Score: 1

That is not even remotely accurate. The three factors of security are: something you have (like a door key or credit card), something you know (like a username or password), and something you are (like a fingerprint or a geographic location). A username/password combo is just duplicate single factor security.

--
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
Re:Wouldn't it have been easier by Homburg · 2010-02-23 07:29 · Score: 1

A secret URL is essentially a password - so attempting lots of funny URLs can be like trying lots of ssh logins.
Well, if they had used an intentionally hard-to-guess URL (like, say, the ones Google uses for shared calendars) you might have a point. But, from the article, they simply used the URL which would become the public URL once announced, nswtransportblueprint.com.au . They didn't have to try lots of URLs to defeat any kind of secrecy; they simply accessed an obvious, public URL, that the government hadn't yet officially announced.
Re:Wouldn't it have been easier by pentalive · 2010-02-23 07:36 · Score: 1

Password and Username are both "something you know" therefore that represents a one factor authentication. To have more than one factor you need to add either "Something you are" or "Something you have"
(Just finished with that chapter in my BS-ISS program)
Re:Wouldn't it have been easier by Demonantis · 2010-02-23 07:47 · Score: 1

That analog would mean that every time I type a url in the wrong way then I was hacking. They only picked the lock once really and that would be when they got it right and that doesn't make sense. Any possible analogy would be akin trespassing or mischief, but that would not make sense because that would suggest you can own parts of the internet. Any real world analogy does not absolutely relate to what they did because it involves information.
Re:Wouldn't it have been easier by Fluffeh · 2010-02-23 09:08 · Score: 1

What if someone comes driving by with a backhoe, takes your big honking safe with your valuables in it? Just because you can take something doesn't mean it is right or legal to take it.
If someone did that you might THEN be able to argue that your stuff was yours, and that no-one should have nicked it. If it's just lying under a tree and someone picks it up, you can't really complain.

--
Moved to http://soylentnews.org/. You are invited to join us too!
Re:Wouldn't it have been easier by HTH+NE1 · 2010-02-23 09:50 · Score: 1

More like an unlisted phone number.
More like an unpublished phone number.
An unpublished number is not printed in your white pages, but will still be disclosed by directory assistance for by-name queries. An truly unlisted number won't even be provided by directory assistance.

--
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
Re:Wouldn't it have been easier by samson13 · 2010-02-23 09:50 · Score: 1

A better analogy.
Your walking down the street in the business district (it was a com domain). Your wearing your press hat (your coming from a press computer). One of you friends says you should check out the transport planning office. You walk up to the building labeled "transport planning office" and the automatic doors open in a welcoming way. You look around the foyer and there are posters saying all sorts of interesting stuff about plans for buses, trains and cycling etc. There are no posters saying bugger off this is still draft and private.
I wouldn't feel like I'd done anything immoral by reading them. If I was a reporter I'd report on what I'd read as well.
If you put something in a public place and don't provide a mechanism to keep people out like locking the doors or putting a keep out sign up then it is public.
Re:Wouldn't it have been easier by GizmoToy · 2010-02-23 10:24 · Score: 1

Exactly, the analogy holds for the case the AC presents. No security method is foolproof, but you made a reasonable effort to secure your belongings.
Leaving it out in the open for others to find is not such an effort. Of course, I suppose to make analogy even more accurate it wouldn't involve taking belongings, but rather merely viewing them and protecting them from view.
Re:Wouldn't it have been easier by Thinboy00 · 2010-02-23 10:45 · Score: 1

Are you kidding me? They made this data accessible on the public internet. I once read about a case where some kook had a website with a CGI file. Supposedly, accessing www.example.com/delete.cgi?file=example.txt (names changed to protect the guilty and because my memory sucks) would delete the file example.txt from the server. He then tried to claim that it was illegal for people to go to that URL and that he would... I don't even know what he actually intended to do about it but I think he was threatening to sue people over this. Moral of the story: If something is accessible on the public internet, you cannot assume noone will look at it/access it/whatever. If something is routable, you should assume it will be accessed. The government could easily have made this non-routable (behind a firewall or NAT router or something) or offline (don't plug in the ethernet; it's really that easy) or not a server (don't run Apache if you don't want people to look in /var/www or wherever) or password protected (unlike domain name records, passwords are not publicly accessible records that anyone with time can read). Any of those things would have been trivial to set up, and it is totally the government's fault for leaving a gaping hole there.

--
$ make available
Re:Wouldn't it have been easier by cojoco · 2010-02-23 13:09 · Score: 1

This analogy is appalling.
For a start, I think you would be justified if someone nicks your stuff, and it is definitely illegal.
However, information is *not* property, and nobody has actually stolen anything.
Re:Wouldn't it have been easier by complete+loony · 2010-02-23 16:35 · Score: 1

http://slashdot.org/index.pl?op=userlogin&logtoken=611928::[randomstring]
So if I fetch the above URL repeatedly and try to brute force a valid logtoken, this isn't the same as the "Hack" in TFA?
Not that I'm really trying to disagree with you. The search space in this case is about 1 in 1e83 depending on the characters used. A publicly accessible url with no authentication, and a short guessable id number is no protection whatsoever.

--
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Re:Wouldn't it have been easier by jotok · 2010-02-23 21:43 · Score: 1

It's sad that some people consider 2007 to be "back in the day."
Re:Wouldn't it have been easier by quadrox · 2010-02-23 21:59 · Score: 1

not having RTFA and only RTFS, a slightly improvement to your analogy would be having to find the somewhat obscure/hidden entrance to that office. I.e. there are no big signs around saying "secret office this way" or "enter here".
Re:Wouldn't it have been easier by GizmoToy · 2010-02-24 01:25 · Score: 1

Well, as I said in a later post, you can improve it by changing the theft of the property to simply the viewing of the property. Then it's much more appropriate.
Re:Wouldn't it have been easier by slater86 · 2010-02-24 14:00 · Score: 1

I think you'll find that username and password are still only single factor, as they're both something you know.
you'd still need a something you are or something you have to go along with that
http://en.wikipedia.org/wiki/Two-factor_authentication#Two-factor_Authentication_Overview

--
When people ask if I'm an optimist, I say "I hope so". --Bill Bailey
Re:Wouldn't it have been easier by countach · 2010-02-24 18:22 · Score: 1

That's funny. I would then say, don't visit those URLs of delete.cgi, just make a whole lot of links on your own web site to things like delete.cgi?file=/config.sys etc, and wait for Google to spider it and follow the links. See if he wants to sue Google.

Was it... by The+Wild+Norseman · 2010-02-23 04:01 · Score: 5, Funny

http://www.australia.gov.au/backdoor ?

--
"A government is a body of people usually -- notably -- ungoverned." -Shepherd Book

Re:Was it... by Wowsers · 2010-02-23 04:46 · Score: 2, Insightful

It wasn't even a back door, the front door was wide open!

--
Take Nobody's Word For It.
Re:Was it... by tomhudson · 2010-02-23 04:58 · Score: 3, Informative

It was : http://nswtransportblueprint.com.au/project
And it's not open any more - nswtransportblueprint.com.au is now completely off-line.
So they went from Security through Obscurity to Streisand Effect to Slashdot Effect ... but now that their server has melted, at least nobody can "hack" it, so I guess they're happy campers.
Re:Was it... by The+Wild+Norseman · 2010-02-23 05:01 · Score: 1

It wasn't even a back door, the front door was wide open!
How would you know... unless you WERE ONE OF THE HACKERS?!?!

--
"A government is a body of people usually -- notably -- ungoverned." -Shepherd Book
Re:Was it... by BrokenHalo · 2010-02-23 06:16 · Score: 1

but now that their server has melted, at least nobody can "hack" it

No, these guys are so clueless, they probably just "solved" their little problem by pulling the power-plug.
Re:Was it... by BryanL · 2010-02-23 06:37 · Score: 1

I am so afraid to click that link.
Re:Was it... by Anonymous Coward · 2010-02-23 07:02 · Score: 5, Funny

reminds me of the time i hacked my friend's fridge for a can of beer when he was out of the room for a moment
Re:Was it... by Fluffeh · 2010-02-23 09:12 · Score: 1

reminds me of the time i hacked my friend's fridge for a can of beer when he was out of the room for a moment
Gawd, why did I not see and then mod Funny this utter GEM before I posted.

--
Moved to http://soylentnews.org/. You are invited to join us too!

Two Robots in Front of a Judge by eldavojohn · 2010-02-23 04:04 · Score: 5, Funny

NSW Lawyer: You allege that the Sydney Morning Herald sent repeatedly sent liscivious requests to you, is that correct?
NSW Server: *nods solemnly*
NSW Lawyer: I see ... and just exactly how many times were you violated?
NSW Server: *pauses and swallows loudly* Three ... three thousand seven hudred and twenty seven.
*crowd gasps*
NSW Lawyer: I see. Now, I know this is hard for you but could you please point to where, exactly, on this anatomically correct server doll the Sydney Morning Herald accessed you from.
NSW Server: *turns the server doll over and motions to the ports* Here on the back, in my ethernet port.
*sounds of disgust ripple through the crowd*
NSW Lawyer: And what did he say to you when this was happening?
NSW Server: GET.
NSW Lawyer: 'GET' what?
NSW Server: He just kept saying GET, GET, GET! GET this document. GET that document.
NSW Lawyer: And did you get it for him?
NSW Server: No it didn't exist! They just weren't there!
NSW Lawyer: And what did you say exactly!
NSW Server: 404! 404, goddammit, 404 ... *breaks down sobbing* I didn't know what he wanted from me until it was too late!!!
NSW Lawyer: There there. There there, it's okay. You're safe now. *turns to the judge* Can we let this sort of gross injustice go unpunished in today's society? How long before this happens to your server? Or ... your child's server?! Huh?
NSW Judge: *nods approvingly*
NSW Lawyer: I rest my case.

--
My work here is dung.

Re:Two Robots in Front of a Judge by Chrisq · 2010-02-23 04:17 · Score: 1

Just imagine how many "hits" they will be getting now they are on slashdot!They do seem to have removed their DNS records. Interestingly the domain belongs to
Domain Name: nswtransportblueprint.com.au

Registrant: BANG THE TABLE PTY LIMITED

Registrant Contact ID: R-000428733-SN
Registrant Contact Name: Karthik Reddy
Registrant Contact Email: Visit whois.ausregistry.com.au for Web based WhoIs

Name Server: ns10.dnsmadeeasy.com
Name Server: ns11.dnsmadeeasy.com
Re:Two Robots in Front of a Judge by Anonymous Coward · 2010-02-23 04:18 · Score: 1, Funny

Yeah, exxxxxxxactttlllyyyyy
Re:Two Robots in Front of a Judge by SeeSp0tRun · 2010-02-23 04:33 · Score: 1

I want to mod this up again, too funny!

IANAL, but what happened is akin to entering without permission. It kind of gets fuzzy where it was made publicly available, but not publicly broadcast.

--
Something witty.
Re:Two Robots in Front of a Judge by elrous0 · 2010-02-23 04:47 · Score: 2

As someone whose own server got rooted once, I sympathize.

--
SJW: Someone who has run out of real oppression, and has to fake it.
Re:Two Robots in Front of a Judge by dancingmilk · 2010-02-23 04:48 · Score: 1

This made my day, thank you.
Re:Two Robots in Front of a Judge by kalirion · 2010-02-23 04:50 · Score: 3, Insightful

If you put a billboard in a back alley, is it "private look only" just because you don't advertise its existence with a billboard on a major highway?
Re:Two Robots in Front of a Judge by Talderas · 2010-02-23 04:56 · Score: 1

Bang the table?

--
"Lack of speed can be overcome. In the worst case by patience." --Znork
Re:Two Robots in Front of a Judge by blackraven14250 · 2010-02-23 05:25 · Score: 1

A front "company" named for the times when he big boss goes "that's enough!"
Re:Two Robots in Front of a Judge by HungryHobo · 2010-02-23 05:28 · Score: 1

Oh god, if I had mod points I wouldn't just mod this up, I'd track down all your other posts and mode them up too!
This is the most glorious....
Re:Two Robots in Front of a Judge by HungryHobo · 2010-02-23 05:31 · Score: 5, Insightful

It's like getting an unlisted telephone number and using your secret plans as your answering machine message.
Nothing like entering without permission.
Re:Two Robots in Front of a Judge by scdeimos · 2010-02-23 12:02 · Score: 1

It's like parking your car outside a convenience store with the keys in the ignition and the engine still running, along with your US Customs-issued firearm sitting on the front seat, and then complaining about your car being "stolen". Dumbasses.

Urgent notification to all: by 140Mandak262Jamuna · 2010-02-23 04:06 · Score: 5, Funny

Dear NSW Transportation Dept Employee,

We have enhanced the security of our secret intranet site with immediate effect. The new enhanced security intranet site is SECRETnswtransportblueprint.com Please update your bookmarks. To allow our braindead minister who can not remember a password and is frightened when confronted with a login dialog to use the site, we have disabled the login requirements for all. So please keep the url confidential.

Signed

Assistant to the Minister D Umbi Diot

--
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact

Re:Urgent notification to all: by delinear · 2010-02-23 05:19 · Score: 1

This is modded funny, and it is, but it's also most likely true. Having been in the same situation with a prominent UK gov site I can confirm that it was frequently the practise to put unpublished URLs live without authentication so that the high-ups could access them (we had dev and test environments but their firewalls were locked down and their IT guys wouldn't open them up, they were loathe to open them even for the people who needed them for development and testing!).
Eventually after the URLs escaped and got in front of the wrong people a few times, they consented to basic authentication, and then proceeded to email around the username and password (they wouldn't let us create them unique ones!) to everyone so they, too escaped. We'd have to change the authentication every 3-4 weeks and suffer the high-ups sending around condescending emails telling everyone not to share the login details, even though we all knew it was them letting them slip.

Deja vu again once more by Hognoxious · 2010-02-23 04:06 · Score: 2, Insightful

Wasn't there a story like this about ten years ago, but it was something concerning grades or test scores on a college website?

--
Confucius say, "Find worm in apple - bad. Find half a worm - worse."

Re:Deja vu again once more by Yvanhoe · 2010-02-23 04:17 · Score: 3, Funny

Yeah, at this time we were supposing governments would be a bit more cautious than schools.

--
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
Re:Deja vu again once more by i-like-burritos · 2010-02-23 04:26 · Score: 1

Heh, I've gotten the actual answers to a test that hadn't happened yet by guessing the URL.
Re:Deja vu again once more by ottothecow · 2010-02-23 05:07 · Score: 1

I've seen that work with solutions to homework...
However, I think the parent was referring to to the harvard admissions website (business school maybe?) where people could figure out if they got in early by playing with the URL. IIRC Harvard took the douche route and decided not to admit those who tried this. I would hope they eventually realized that when someone posts simple URL changing instructions to a business website, peoples curiosity will kick in...

--
Bottles.
Re:Deja vu again once more by dlgeek · 2010-02-23 05:58 · Score: 2, Interesting

Yes it was Harvard Business School (and Stanford and somewhere else that I don't remember) and they denied admissions to the students who did it. A year or two later, Cornell had the same issue with their undergrad early admits (you could log in and then change the url from something like /profile.cfm to /decision.cfm). They posted a statement saying "A group of students at (some discussion forum) figured out blah. These students could not access any information other than their own, no privacy was breached and no action will be taken against the students." I checked out the forum, and one of the students posted an email where he had asked the admissions people if it was accurate and they wrote back and said something on the order of "Yes it was, but you weren't supposed to see it. Congratulations and welcome to Cornell."

Much more reasonable than Harvard and the others.
Re:Deja vu again once more by ottothecow · 2010-02-23 06:21 · Score: 1

So those schools followed through with their decision to reject the candidates that had checked?
Were there any lawsuits filed? I certainly wouldn't want to go to any school I had to sue to get in (and I imagine that if I got into HBS, I could get in somewhere else)...but I can see the plight of a person who read a forum post that said "decisions already posted! the link isn't up yet but you can just change &profile= to &decision="
seems like something *anyone* reading it might try...

--
Bottles.
Re:Deja vu again once more by MichaelSmith · 2010-02-23 10:16 · Score: 1

The classic was a few years ago when the Victorian state government sent out their budget in a word document with all their revisions left in.

--
http://michaelsmith.id.au
Re:Deja vu again once more by Hognoxious · 2010-02-25 00:59 · Score: 1

Yeah, at this time we were supposing governments would be a bit more cautious than schools.
I'd expect the opposite. After all, schoolteachers don't usually get rat-arsed and leave laptops/CDs of confidential information in taxis.
P.S. @dlgeek (1065796) - yup, that's the one I was thinking of. You must have lurked here a long time.

--
Confucius say, "Find worm in apple - bad. Find half a worm - worse."

Lock, what lock? by noidentity · 2010-02-23 04:06 · Score: 4, Insightful

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn the doorknobof an insecure office and make copies of highly confidential documents.'

There, fixed that for you, Mr. Minister.

Re:Lock, what lock? by Obyron · 2010-02-23 04:20 · Score: 1

Even that doesn't work. At least in most of the US, you can still be considered "breaking and entering" even if the door is ajar, and you push it open. It's going into a place where you're not permitted for the purpose of committing a felony. The analogy here is more like being told there's a really juicy part in a book, so you flip through until you find the page. The author tries to sue you for circumventing his copyright protection, which was not putting a number on the page.

--
--Obyron
Re:Lock, what lock? by RoFLKOPTr · 2010-02-23 04:21 · Score: 5, Insightful

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn the doorknob of an insecure office and kindly accept the highly confidential documents that the receptionist hands to you.'
There, fixed that for you, Mr. Minister.
There, fixed that for you.
Re:Lock, what lock? by TexasTroy · 2010-02-23 04:25 · Score: 4, Insightful

Incorrect. Burglary can still occur if you do not lock the door to your house. The problem here is that the govt posted material on something akin to an unfinished public street that is not (yet) on any my map and then complaining that someone drove onto it because they (the govt) didn't put up a sign/gate to keep people off of it.
Re:Lock, what lock? by interkin3tic · 2010-02-23 04:30 · Score: 1

that this is 'akin to 3,727 attempts to turn the doorknob of an insecure office and make copies of highly confidential documents.
Makes you wonder if the reporter had typed in "http://nswtransportblueprint.com.au/project" on the first try instead of the 3,727th try, would the government have been okay with that? If a reporter were outside an unlocked government door, pawing it 3,727 times before successfully opening it, that would be pretty strange, but doesn't change anything.
Re:Lock, what lock? by zappepcs · 2010-02-23 04:38 · Score: 1

Exactly, logic says if you don't want it read by the public, don't host it on a public webserver. There are plenty of analogies here, but you're right, there was no lock or even a partially closed door. This doesn't equate well to the physical world unless you want to say they were invited into the room with no door on it, a room filled with artworks, and under a few of the paintings is a small sign with fine print that says 'please don't look at this painting'. Some of us are getting used to standards in web design and may attempt a uri by guess in case that common page is already created to save looking for it. This is not uncommon, so the practice of typing in a uri rather than clicking on links is not a felonious adventure. If you've already seen the painting, the fine print on the little sign is not going to be sufficient security. If you're not sure what I mean, try http://microsoft.com/search or http://ibm.com/search or http://any/ website/search I'm only guessing, but I bet the search box would have found the documents for them also?

--
Support NYCountryLawyer RIAA vs People
Re:Lock, what lock? by cowbutt · 2010-02-23 04:40 · Score: 2, Insightful

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to a single attempt to turn the doorknob of an insecure office and kindly accept the 3,727 highly confidential documents that the receptionist hands to you.'
There, fixed that for you, Mr. Minister.
There, fixed that for you.
Having RTFA, I fixed that for you. Doesn't look like there was any brute-forcing of the URL involved, just surfing around retrieving pages and images.
Re:Lock, what lock? by elrous0 · 2010-02-23 04:50 · Score: 2, Insightful

Actually, it's more like "I hid the document in what I thought was a secret spot, in a public park. Someone discovered it there and started talking about it with their friends."

--
SJW: Someone who has run out of real oppression, and has to fake it.
Re:Lock, what lock? by kalirion · 2010-02-23 04:56 · Score: 1

FTA:
- We got a tip on Friday that you could read the government's transport plan by accessing a website called, unsurprisingly, nswtransportblueprint.com.au.
- Even we did not need help to type in those letters. No password was requested or offered.
- Instead we were confronted with a dream menu for any reporter: rail services, cycleways, walking and cycling, bus services, paying and road network.
So the analogy here is being told there's a really juicy book in a library at this specific location, but the book not being in the library's online catalog. The book itself has a full table of contents.
Re:Lock, what lock? by tomhudson · 2010-02-23 05:07 · Score: 1

I RTFA, it was the first try. They were tipped off, entered this address: http://nswtransportblueprint.com.au/ there was no login or any other user verification, so they then clicked on all the links, downloading each page as it was served to them.
In other words, (again I RTFA) the site was supposed to go public a few days later - they just got there early and scooped everyone else, being the evil ink-stained wretches that they are :-)
Re:Lock, what lock? by HungryHobo · 2010-02-23 05:33 · Score: 1

It's like getting an unlisted telephone number and using your secret plans as your answering machine message.
Nothing about attempts to turn the doorknobof an insecure office and make copies of highly confidential documents
Re:Lock, what lock? by Ltap · 2010-02-23 06:00 · Score: 2, Informative

The summary is actually misleading. They act like the newspaper bruteforced it - in reality, someone else found it first and just gave them the link. The "3,727 requests from different IPs" weren't some kind of botnet, they were just 3,727 people all accessing the blueprints that some guy found. That doesn't say that the newspaper was doing anything nefarious - just that the plans were absurdly, childishly easy to find.

--
Yet Another Tech Blog
(but so much more, including game and movie reviews)
http://yanteb.peasantoid.org
Re:Lock, what lock? by precariousgray · 2010-02-23 06:26 · Score: 1

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn the doorknob of an insecure office and kindly stick its head in the sand highly confidential documents like an ostrich, which then bleats, choking itself to death.'
There, fixed that for you, Mr. Minister.
There, fixed that for you.
I think we can finally settle on this one.

--
not much, just being forced to manually insert line breaks into my comment
Re:Lock, what lock? by smartr · 2010-02-23 06:58 · Score: 1

God forbid anyone use good RESTful design. It's almost as though it was designed partly to let people type things into the url to get what they want... http://en.wikipedia.org/wiki/Representational_State_Transfer
Re:Lock, what lock? by FoolishOwl · 2010-02-23 08:10 · Score: 1

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn the doorknobof an insecure office and make copies of highly confidential documents.'
There, fixed that for you, Mr. Minister.
I'd say it's equivalent to walking up to the headquarters of a government agency, entering by the side door adjacent to the parking lot -- a sliding glass door that opens automatically when you approach -- and walking to the main lobby, going to the kiosk under the sign that reads INFORMATION, and picking up and reading a few brochures with a total of 200 photographs and 3,527 words.
Re:Lock, what lock? by Dracophile · 2010-02-23 09:18 · Score: 1

This isn't burglary. To continue the analogy: this is someone walking up that unfinished street, looking in three thousand-odd places for someone with a list of things to see, finally finding someone with an index, asking them for a copy of that index, and then asking them for a copy of everything on that index. And that someone willingly complied with every request for information.

--
Athy, athier, athiest.
Re:Lock, what lock? by wvmarle · 2010-02-23 15:57 · Score: 1

There were four IP addresses involved. Probably about 1000 requests from each IP. After all a single web page can generate a couple dozen requests (html body, image here, script there, some flash, etc). I bet they counted every single GET request for every single part of the site here. Not unique visitors; just hits.

Reminds me of... by courteaudotbiz · 2010-02-23 04:07 · Score: 4, Interesting

This reminds me of a case in Canada, where Passport Canada (the agency responsible for passport emission) was "hacked" by changing some numbers in the URL to get from one passport request details to the other, making very confidential information available to even the most basic hackers.

However, no one was accused here, except the developpers of the solutions who were blamed. Now, Passport Canada still processes online passport requests, but applicants are no more able to view the details and advancement of their application online.

Re:Reminds me of... by courteaudotbiz · 2010-02-23 04:08 · Score: 1

Damned, the URL of the article I was trying to post
Re:Reminds me of... by girlintraining · 2010-02-23 05:11 · Score: 1

This reminds me of a case in Canada, where Passport Canada (the agency responsible for passport emission) was "hacked" by changing some numbers in the URL to get from one passport request details to the other, making very confidential information available to even the most basic hackers.

I still try that out of habit when I see a record ID encoded in the URL. Still works on a lot of websites... about 8% of the time, especially for smaller shops. I usually send them an e-mail and move on. There's too many to waste my time following up with each one...

--
#fuckbeta #iamslashdot #dicemustdie
Re:Reminds me of... by suomynonAyletamitlU · 2010-02-23 07:58 · Score: 1

The first production project I ever did using PHP, I was making a sort of hack-together forum for a small web-based game community. I was on the project less than 6 months, and I had never made a serious site up to that time. I had no technical expert to help me, just the woman who ran the site, who mostly didn't do much more than monitor and tell me what she wanted. I wasn't getting paid anything; it was an academic internship.
Staring at the GET request in the url, with all of my inexperience, I said, "that's not secure," and added checks to make sure you were authorized to see what you were getting.
Took all of a few hours to make that change, even accounting for porting it to several other related systems.
End of story.

Really? by Monkeedude1212 · 2010-02-23 04:07 · Score: 4, Insightful

Are there no IT Pros that work for the government?

I read stories like this and I think "Theres no way they could be monitoring my traffic, they can't even set up basic login authentication for their websites"

Re:Really? by WrongSizeGlass · 2010-02-23 04:29 · Score: 4, Funny

Are there no IT Pros that work for the government?
Sadly, no ... they're all working for school districts in southern Pennsylvania.
Re:Really? by digitalchinky · 2010-02-23 04:39 · Score: 3, Informative

There are some terribly bright and technically minded people in government, particularly in the intelligence gathering fields (secret 3 letter agencies) - unfortunately they are not usually in positions of power or within ear shot of anyone that might easily comprehend what they are actually saying. I guess it's the same old problem everywhere - if 'Government' knew what they actually had behind their own closed doors, they'd be shocked, maybe even outraged :-)
I spent a lot of years working for the defence signals directorate (Same as the NSA's, different acronym) - safe to say that those up at the top take about 5 to 10 years to actually understand what their underlings have been saying for the aforementioned 5 to 10 years. Ops Normal.
The main problem is, as others have more eloquently said, right up at the top you get the boss saying "Just make it f'ing happen already" Be damned if they care about security. Thus the stunningly illogical knee jerk reaction to shut the barn door after the quadrupeds have already legged it, oh, and death sentences to the idiots that forged the door hinges, because we need to punish the wrong people in spectacular fashion to prove a point that nobody will ever understand.
Re:Really? by delinear · 2010-02-23 05:31 · Score: 1

Exactly right, it doesn't matter how much you argue as a peon, if the directors don't like having to remember passwords then you're stuck. Add to that the fact that governments are massive, sprawling entities, where no one department has clear visibility of what others are doing, and you end up in the situation where the highly skilled IT department is bypassed by the clueless manager who gets in a clueless contractor to throw up a website.
Re:Really? by SleazyRidr · 2010-02-23 06:36 · Score: 1

Actually in Australia they work for four letter agencies.

--
Is 1563649 a prime number?
Re:Really? by RedTeflon · 2010-02-23 06:50 · Score: 1

Are there no IT Pros that work for the government?
Sadly, no ... they're all working for school districts in southern Pennsylvania.
And they are watching you!!!
Re:Really? by samson13 · 2010-02-23 10:26 · Score: 1

Actually in Australia they work for four letter agencies.
Like DSD and AFP :-)
(OK OK Maybe ASIO)

I love the name of the web hosting outfit: by hey! · 2010-02-23 04:08 · Score: 5, Insightful

"Bang the Table".

Methinks we have found a new tag for articles about politicians who are bit by their own stupid security practices. Release Word file with revision history still in it? Bang the table. Secret government data stolen because of malware you downloaded from a porn site? Bang the table.

--
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.

Re:I love the name of the web hosting outfit: by HungryHobo · 2010-02-23 05:51 · Score: 1

I don't know why but somehow this sounds right.
Seconded.
Re:I love the name of the web hosting outfit: by ax_42 · 2010-02-23 18:57 · Score: 1

Career advice for trial lawyers:
- If the law is against you, bang on the facts
- If the facts are against you, bang on the law
- If both are against you, bang on the table
Attribution: Seen on /. but couldn't find it again now for proper attribution

tubes from their door to my keyboard by uncanny · 2010-02-23 04:14 · Score: 1

Then dont put your UNLOCKED door in my house! This is the internets

Re:tubes from their door to my keyboard by Frosty+Piss · 2010-02-23 04:21 · Score: 1

Then dont put your UNLOCKED door in my house! This is the internets
This argument is used all the time, but it really doesn't apply. Leaving your door unlocked is not consent, implied or otherwise, for anyone to waltz on in.

That doesn't justify morons running the site in question, but like many anecdotal arguments, it doesn't hold much water in the real world.

--
If you want news from today, you have to come back tomorrow.
Re:tubes from their door to my keyboard by ircmaxell · 2010-02-23 04:33 · Score: 1

This argument is used all the time, but it really doesn't apply. Leaving your door unlocked is not consent, implied or otherwise, for anyone to waltz on in.

True, but this was more akin to walking in to a library, and finding confidential documents in the general section right next to the Sunday newspaper (AKA, not behind any doors at all). All it took was knowing (or figuring out) where to look. There was no door here (if there was, it would have been in the form of a password or a DNS block (only allowing internal IP addresses), etc)...

--
If a man isn't willing to take some risk for his opinions, either his opinions are no good or he's no good
Re:tubes from their door to my keyboard by Nadaka · 2010-02-23 04:50 · Score: 4, Insightful

How about a car analogy?
This isn't like breaking the window on a Civic and tearing out the stereo system that cost more than the car.
This isn't like opening the unlocked door on a Prius and and taking someones cd collection they left on the passenger seat.
This isn't like reaching through the open window of a hummer and snatching a stick of gum.
This is like getting on a public bus, and using your cell phone to snap pictures of the graffiti on the wall.
Re:tubes from their door to my keyboard by Lumpy · 2010-02-23 05:11 · Score: 1

Exactly and having a website on the internet is like not even having a door or even a house. It was all spread on the lawn for everyone to stop and see.

--
Do not look at laser with remaining good eye.

Question: by Pojut · 2010-02-23 04:17 · Score: 4, Interesting

Is it even legally possible to bring up criminal charges, considering the URL was completely unsecured?

--
Living With a Nerd

Re:Question: by garcia · 2010-02-23 04:30 · Score: 1

Bring up? Sure. Successfully prosecute? That's up for debate.
Re:Question: by OzPeter · 2010-02-23 04:33 · Score: 3, Insightful

Its always possible to bring up charges .. whether they are warranted or provable is a totally different thing

--
I am Slashdot. Are you Slashdot as well?
Re:Question: by digitalhermit · 2010-02-23 04:54 · Score: 1

A couple years ago I was searching for the name of an old friend from college. I got a few Google hits for his full name and followed one of them. It led to a page on a radio station website that had lots of confidential information including birth date, email address, home address, business phone/address, salary, *and* password information. I alerted the radio station immediately. The first response from them was accusatory, asking what I was doing hacking their site. I sent back an email to the person who responded and to the addresses listed on their contact page detailing how I found the information.. Haven't heard back from them, but the page stayed up for over a week.
Re:Question: by Hatta · 2010-02-23 05:19 · Score: 1

It's Australia. They sent a man to prison for having a few naked drawing of Simpsons characters. I think they can find a way to charge anyone for just about anything they don't like.

--
Give me Classic Slashdot or give me death!

Re:fuckfuck by WrongSizeGlass · 2010-02-23 04:19 · Score: 2, Funny

Dude, way to ruin M&M's for me ... I don't ever want to think of M&M's breeding unless it's that hot one from the TV commercials.

Bang the Table???? by 140Mandak262Jamuna · 2010-02-23 04:20 · Score: 2, Informative

The article mentions the hosting company is called Bang the table. Where have I heard that before?

Yup, recently someone in pandasthumb.org quoted someone famous saying, "If the law is on your side, bang on the law, If facts are on your side, bang on the facts, if neither, bang on the table".

--
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact

Re:Bang the Table???? by mcgrew · 2010-02-23 07:07 · Score: 1

I can remember that when I was a kid, there was a certain head of state with the initials NK, who banged the table at the UN while screaming "WE WILL BURY YOU!"
They wound up burying themselves. Banging the table, as well as any other acts of anger, is usually counterproductive.

--
Free Martian Whores!

Robots.txt by sakdoctor · 2010-02-23 04:20 · Score: 1, Funny

User-agent: *
Disallow: /highly_confidential_documents/
Hack-delay: >9000

Why care about security when you can rule by fear? by Suzuran · 2010-02-23 04:20 · Score: 1

These reporters will learn not to meddle in government affairs when they're behind bars for the next 50+ years for computer offenses. Security is for chumps. Real security is sleeping well at night knowing that everyone else cowers in fear of your wrath. Not many reporters are willing to bet their lives on a story, and those that are willing will be made examples to the rest. Either the story dies or you do - Your choice!

More like "exceeding authorization" by ub3r+n3u7r4l1st · 2010-02-23 04:22 · Score: 1

There is no changes or password cracking involved. More like "accidentally" viewing a website that is not supposed to be public.

This reminds me of similar case of a story where an employee were able to look at files that he is not suppose to see with his account, thanks to a mistake by a sysadmin, and the boss accuse him of hacking.

--
New Economic Perspectives

'Trespassing' and 'Breaking and Entering' by capitaladot · 2010-02-23 04:24 · Score: 1

We do a very poor job, globally, of distinguishing between electronic trespass and electronic breaking and entering. In the rush to criminalize computer use deigned anti-social, bedrock concepts such as the above were not well-translated to electronic paradigms. As such, bizarrely disproportionate legal sanctions are often applied to those convicted of these acts, and with little reason beyond knee-jerk technophobia.

Re:'Trespassing' and 'Breaking and Entering' by SecurityGuy · 2010-02-23 05:27 · Score: 1

It's neither trespassing or breaking and entering. HTTP is a well known method of disseminating information. There are also well known ways of restricting access to information when you are disseminating it over HTTP. You can put it behind a firewall. You can restrict by IP ranges. You can give accounts with passwords to people who need to get it. No responsible organization can publish information on the web, not restricted by a firewall, not restricted by IP (which isn't very good anyway), not restricted by any authorization or authentication methods, and cry when somebody reads it.
It's rather like putting your private information between the pages of a library book and crying foul when someone reads it on the grounds that you didn't tell them which book or which page.
There are ways to secure information. Use them.
Re:'Trespassing' and 'Breaking and Entering' by capitaladot · 2010-02-23 05:44 · Score: 1

I'd argue that unsecured HTTP (e.g. no authentication in place and on the public internet) is akin to trespassing on unsecured property, or entering an unlocked door. Entering a secured system without authorization (e.g. through some hack, social engineering, etc) would be more like breaking and entering. I understand the distinction you're making, implicitly, between entering virtual space and physical space, but stand by my analogy. Unsecured systems (HTTP or otherwise) are like doors left open, and secured systems are like locked doors. It should be, I argue, left to the possessor of the space (e.g. physical place or network host) to determine whether access is (or was) acceptable. There are standards in some localities surrounding posting notices of "No Trespassing" to indicate private space that is not open to the public (even if it is not physically restricted, such as with a fence or wall). Perhaps a similar requirement would be suitable in these cases, and without such, hosts of unsecured HTTP sites might then have no right to "cry when somebody reads it".
Re:'Trespassing' and 'Breaking and Entering' by Kevin72594 · 2010-02-23 12:07 · Score: 1

The possessor of the space did determine whether or not access was acceptable. They configured the webserver in a way that it responded to the HTTP requests made by the reporters. You can't trespass when you've been given permission to access.
Re:'Trespassing' and 'Breaking and Entering' by capitaladot · 2010-02-24 02:39 · Score: 1

How is an unsecured server any different than an unlocked door? If the owner of the property finds that you've been there without permission, you're still trespassing.

Library analogy by vlm · 2010-02-23 04:24 · Score: 4, Funny

'akin to 3,727 attempts to pick the lock of a secure office and take highly confidential documents.'

Much more like checking 3727 shelves in the public library looking for a copy of "internet security for dummies"

The funny part is both sides are fairly non-technical, meaning some "journalist" probably typed in all 3727 URLs.

--
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger

Re:Library analogy by TheOutLiar · 2010-02-23 04:37 · Score: 1

Seems more akin to handing someone a keyring with 3,727 keys on it and asking them to open the door.
Re:Library analogy by Mr+Thinly+Sliced · 2010-02-23 04:39 · Score: 1

The funny part is both sides are fairly non-technical, meaning some "journalist" probably typed in all 3727 URLs.
You mean they didn't write a visual basic GUI to trace an IP address?.
From the sounds of this story the Aussie Gov't hired the technical consultants from 24 as their sysadmin and security guy.
Re:Library analogy by nedlohs · 2010-02-23 04:53 · Score: 3, Informative

Nothing like that at all.
They were told the url by someone.
They entered it into their browser and got a everyday normal web page.
They clicked on the menu items and printed out the pages.
No guessing involved. No typing (other than the initial url) involved.
The 3727 is probably the number of request logs on the web server from them, counting all the images/css/js/etc files to make it look larger.
If they were slightly technical they might have done:
wget -m http://nswtransportblueprint.com.au/
but that would be *more* typing...
Re:Library analogy by tomhudson · 2010-02-23 05:21 · Score: 2, Interesting

No, the url was "published" in the legal sense - they were given it by someone.
No hacking involved.
They weren't the only ones to whom the url was "published", since several others also were grabbing the files at the same time. And the way they grabbed the files? Clicked on the menu and followed the links, then "Print".
The url in question? http://nswtransportblueprint.com.au/
No secret directories, no login required, no hidden subdomain, no .hosts file to exclude them, nothing. It was supposed to be a public website - it just went "public" a week early.
Re:Library analogy by blackraven14250 · 2010-02-23 05:31 · Score: 1

Only if they tried every other key on the ring before the successful one.
Re:Library analogy by Ltap · 2010-02-23 06:09 · Score: 1

They didn't - not every request was from the Herald, and I'm guessing only half a dozen were.

--
Yet Another Tech Blog
(but so much more, including game and movie reviews)
http://yanteb.peasantoid.org
Re:Library analogy by gnasher719 · 2010-02-23 06:34 · Score: 1

As an example, the UK government has an employment website at www.direct.gov.uk/en/Employment . All UK government websites in English (and not Welsh, I suppose) should be at www.direct.gov.uk/en/something. If I wanted to know our ministers' salaries, then I might try going to www.direct.gov.uk/en/ministerssalaries . Typing in that URL is not hacking, and I would consider it my right to use any information I find there. Or if the UK government is working on a transport blueprint, I could try www.direct.gov.uk/en/transportblueprint . Just common sense. Why would I try to find a link to the site when I can just type in the URL?

Now if I was told that the ministers' salaries are at www.direct.gov.uk/en/salaries_01934721adouex, then I would have to suspect that something illegal has been going on to get that URL, and that I shouldn't visit that site.
Re:Library analogy by iNaya · 2010-02-23 13:58 · Score: 1

Why would you suspect anything illegal was going on? I send links to my friends from government sites quite frequently, and they often have seemingly random letters/numbers in the links, which I originally accessed through the menu structure. For instance http://www.stats.govt.nz/browse_for_stats/population/estimates_and_projections/SubnationalPopulationProjections_MR2031.aspx This is information the government WANTS people to have access to. I don't see why the appearance of the URL has anything to do with whether it is private or not.

--
The Unicode standard is over 20 years old. Why does Slashdot not support it?

Re:fuckfuck by SatanClauz · 2010-02-23 04:25 · Score: 2, Funny

okay

first, i'm not sure what this has to do with the post.

second, I do the EXACT same thing :)

that is all

Entropy by michaelmalak · 2010-02-23 04:34 · Score: 3, Interesting

Security by obscurity at its finest.

At what point does obscurity become security? 3,727 attempts corresponds to 12 bits of entropy. According to NIST, that's the equivalent of a 5-character user-selected password. The same document stipulates a mere 10 bits of entropy for some applications.

Re:Entropy by samkass · 2010-02-23 04:46 · Score: 1

That's an interesting point. The same point could be made about other "mathematically" obscure things such as an IPv6 address. If all information was available online but some of it was password protected, what's the difference between guessing URLs and guessing passwords?
To answer my own question: the expectation of privacy. A password implies the expectation of privacy, while posting something that anyone can access with the right URL does not have the same implication to me.

--
E pluribus unum
Re:Entropy by daremonai · 2010-02-23 05:03 · Score: 1

The newspaper didn't do any guessing at all. They were told the site name, and went directly to it. The site had links to all sorts of transportation plans, which the guys at the paper accessed. That's where the 3,727 number comes from - just the number of URI accesses listed in the web server log, most likely by other people in addition to the newspaper.
Re:Entropy by SatanClauz · 2010-02-23 05:06 · Score: 2, Interesting

You answered michaelmalak's question at the same time!
Obscurity becomes security when you have no reason for expectation of privacy :)
Re:Entropy by tomhudson · 2010-02-23 05:25 · Score: 3, Informative

RTFA.
They were given this url http://nswtransportblueprint.com.au/
They went there.
They hit Print
They followed the pretty linkies
They hit Print some more
They wrote a story about it.
No password dialog. No secret subdomain. No secret subdirectory. No login required. No user session or password. No .hosts entry. How is that "hacking"?
There was no guesswork involved, so there was zero bits of entropy in this example, unless they were drunk at the time and had to retype it, in which case it's their own entropy pool, not the servers' /dev/urandom, that is being probed.
Re:Entropy by eth1 · 2010-02-23 05:46 · Score: 1

3000 "accesses" probably just means they looked at 30 pages with 100 images, scripts, and other elements that were all downloaded via separate requests/connections. But 3,727 is a better number to use when you're trying spin the journalists into villains.
Re:Entropy by dominious · 2010-02-23 06:53 · Score: 1

It's the difference between checking 3,000 unlocked doors and stealing 3,000 keys to try to unlock a single door.
stealing? so if I guess a password like 1234 did I just steal it from someone? oh god im a criminal!
Re:Entropy by AlgorithMan · 2010-02-23 11:11 · Score: 1

if 3,727 attemts took them 2 days, you bet it was manual... a little BASH oneliner would make 3,727 attempts in 1 hour

no automated program would need 46 seconds per request...

--
The MAFIAA is a bunch of mindless jerks who will be the first up against the wall when the revolution comes
Re:Entropy by canajin56 · 2010-02-23 11:25 · Score: 2, Informative

You're making the mistake of believing the Slashdot summary, instead of reading TFA. There was no trial and error involved. They were given a tip that a public government website had information they might find useful. The 3,727 "attempts" that Slashdot reports are 3,727 "hits on the firewall" according to TFA. All of those "hits" were allowed through. They didn't do a dictionary attack on an existing website hoping to find secret subdirectories that weren't linked to. They just followed links inside the main page, to various subpages. The government asserts that typing in a URL was a hack attempt, and each time they clicked a link it was also a hack attempt, some of which led to "classified" information. To repeat, it wasn't 3,726 404 errors, followed by "YES, VALID URL!" it was 3727 total scrips html pages images and css files as they browsed through a link somebody emailed them.

--
ASCII stupid question, get a stupid ANSI

Window analogy by realsilly · 2010-02-23 04:36 · Score: 3, Interesting

Just because a house has windows and they aren't covered by curtains does not mean that by looking through the window and reading an important document left near the window that you're aren't stealing info. An unlocked door also doesn't mean you have the right to open it either. Both are wrong.

Conversely, an unpublished website for a govt. agency... and they really thought that was secure? Buahhahhahhahhahha!

--
Life takes interesting turns, but the most interest is when you're off the beaten path.

Re:Window analogy by Dunbal · 2010-02-23 04:50 · Score: 3, Interesting

An unlocked door also doesn't mean you have the right to open it either.
However, leaving your "secret info" in a public place, like say, the MIDDLE OF THE STREET, does not entitle you to any form of protection.
No door was opened. The internet by definition is PUBLIC. That is the PURPOSE of the internet. If you create a website and put information on it that requires no authentication or other sort of credentials to access it, you have placed said information in the PUBLIC. Otherwise all search engines are repeatedly "hacking" every single site on the web. You know that there's a file called robots.txt that you can use to limit access from spiders. And you know there's something called a "password" to protect sensitive information.
Not only is it inexcusable that a public office would commit such an act of negligence as putting (presumably) sensitive information in a place where it can be accessed by anyone, they compound their ignorance by trying to go after people who stumble across it. There have been a lot of ridiculous things happening in Australia lately, but this one takes the cake.

--
Seven puppies were harmed during the making of this post.
Re:Window analogy by realsilly · 2010-02-23 05:32 · Score: 1

"The internet by definition is PUBLIC. That is the PURPOSE of the internet."
That being said, then all websites on the web should be deemed public by default, but as we know that is not true. A city is road is public, but the car you drive on it is yours and is private. The poorly secured website that is a private webpage on that public internet highway. The information was not put out there for the public, there was an effort made by the entrant to purposefully look for info. Therefore, no matter how ill-secured it was, it was not in plain site. Over 3300 attempts to access does not equal an accidental find.
I don't agree with the lax security that the govt. had. It is and was pathetic.

--
Life takes interesting turns, but the most interest is when you're off the beaten path.
Re:Window analogy by realsilly · 2010-02-23 05:37 · Score: 1

Good god man, where in heavens do you live?
This leads to the question of what is deemed "Valuable".
Is an IPOD more valueable than say an insurance card. Hell cars are stolen all the time for the basic components of the car. I know one guy who leaves a car at the airport, because he travels; he's gone for 2 days, and leaves nothing in the car of value. He returns to find the seats stolen out of his car. The seats from the manufacturer. So then what is deemed "valuable", in your country, seems awefully subjective to me.

--
Life takes interesting turns, but the most interest is when you're off the beaten path.
Re:Window analogy by Dunbal · 2010-02-23 05:49 · Score: 1

That being said, then all websites on the web should be deemed public by default,
What are you, a lawyer? Your view opens the door to endless litigation. Websites on the web ARE public, just as are IP addresses. You can't prevent someone from going to a web-site. However you CAN secure your website from unauthorized access. In the case you propose, it would be a "crime" to commit a typo and end up on the "wrong" page. In my case, just visiting the page won't get you the information I don't want you to see. You have to actively try to break into the site in order to get to it. Thus I can prove malicious intent.
Just like it's a lot easier to convince a court that you were justified in shooting the armed burglar who jumped a fence, smashed your window and defeated the alarm system of your house. A lot easier than convincing them that the guy who strayed off the sidewalk 12 inches onto your un-fenced lawn deserved a bullet in the head.

--
Seven puppies were harmed during the making of this post.
Re:Window analogy by Ltap · 2010-02-23 06:11 · Score: 1

Better than a "Windows" analogy - just because a computer has ports and they are open does not mean that by sending a few trojans its way and looking at some porn on another guy's computer means that you aren't totally exploiting user stupidity.

--
Yet Another Tech Blog
(but so much more, including game and movie reviews)
http://yanteb.peasantoid.org
Re:Window analogy by precariousgray · 2010-02-23 06:35 · Score: 1

So, let's see if I understand this correctly. There is a house, with windows, and these windows are not covered by curtains. If I am looking through the window and reading an important document, I am stealing information. You're right: that is incorrect.

--
not much, just being forced to manually insert line breaks into my comment
Re:Window analogy by FoolishOwl · 2010-02-23 09:17 · Score: 1

Someone registered a domain name for the site. Someone configured an http server to serve that domain name. Someone designed the web pages. Someone posted those web pages to the http server.
A series of deliberate actions were taken to publicly display the documents, before the journalists saw them.
It is completely absurd to compare the journalist's actions to anything like trespassing or theft.
Re:Window analogy by AlgorithMan · 2010-02-23 11:04 · Score: 1

then why do insurances deny payment, when something is stolen from your unlocked home?

--
The MAFIAA is a bunch of mindless jerks who will be the first up against the wall when the revolution comes
Re:Window analogy by canajin56 · 2010-02-23 11:30 · Score: 1

Who gave you permission to access Slashdot? Seems by your reasoning, you decided to just walk through the unlocked door, which you claim is wrong. Please stop hacking Slashdot!

--
ASCII stupid question, get a stupid ANSI
Re:Window analogy by Lunzo · 2010-02-23 14:55 · Score: 1

I agree that the internet is a public place and putting info on a website counts as publishing it.
With this issue I'm not sure what all the fuss is about anyway. It seems like a storm in a teacup. The NSW government was going to announce the report on Sunday or Monday. The transport minister is just annoyed that SMH scooped him by finding the site on Friday and publishing articles about his report in the Saturday paper. Instead of media outlets just picking up his press release and parroting the spin, the report was held scrutinised by investigative journalists, before he even got a chance to try and spin the announcement.
The transport minister is also shitty that his great report on how he was going to revolutionise everything was torn apart by The Herald. They basically said they heard the same announcement 10 years ago and it still hasn't been implemented yet. They also gave the government a lot of flak over roads getting three times the spending of public transport - in a report that was on the future of public transport and how the state government was investing in it.

Lowell Maximum Security Prison? by LaminatorX · 2010-02-23 04:39 · Score: 1

I'd like you to consider that web-address "off-limits," as a favor to me.

Re:fuckfuck by Gerzel · 2010-02-23 04:40 · Score: 4, Insightful

But your method doesn't take into account the time it takes an M&M to rest and get into full fighting form between bouts. Thus if the first M&M you come across is the strongest it is still likely to lose simply because it has to face fresh competitor after competitor. Even your fingers raise the core temperature of the competitor high enough after a few bouts to induce softening leaving the M&M weaker against its rested cooler-cored foe.

Solution: Set up a randomized tournament system where you take two M&Ms at random from the rested pack, test them, and put the winner in a separate pile to rest until the pack is empty. Then repeat tournament again between the now rested victors of the first round. Repeat until there is only one.

Still not far enough. by zippthorne · 2010-02-23 04:40 · Score: 5, Insightful

More like,

The affected government minister said that the website was accessed 3,727 times, and that this is 'akin to 3,727 attempts to turn their own head in a busy, public marketplace and look at a billboard.'

Don't want people reading your web site? Put it behind a login. Anything else is just sophistry to cover up incompetence. Web sites are advertisements first and foremost. The whole point is to make it possible for as many people as possible to read your thing. If you want to exclude certain people from being able to view it, then you shouldn't just put a billboard up where you think it's out of the way and hope nobody notices, you should put it behind a door which requires a key to get in.

--
Can you be Even More Awesome?!

Re:Still not far enough. by EvanED · 2010-02-23 04:58 · Score: 1

Don't want people reading your web site? Put it behind a login. Anything else is just sophistry to cover up incompetence.
While I do agree, and think that criminal investigations and such in this case are ludicrous and hope they don't go anywhere, part of me does wonder... what's the difference between a non-linked document where you don't tell people the URL and a site with a password?
Would guessing 3000 different passwords be as forgivable, even if the system doesn't cut you off? Is an easily-guessed URL any better than an easily-guessed password?
Re:Still not far enough. by DangerFace · 2010-02-23 05:36 · Score: 1

... what's the difference between a non-linked document where you don't tell people the URL and a site with a password?
Would guessing 3000 different passwords be as forgivable, even if the system doesn't cut you off? Is an easily-guessed URL any better than an easily-guessed password?
The difference is huge. Look at the way house insurance works - you leave a door open, you're not insured. You leave a window open, you're not insured. You have a crappy lock on the door that a five-year-old could bypass, you're insured and they're guilty of breaking and entering.
I don't know how it works everywhere else, but in the UK if there isn't significant indication that you shouldn't be somewhere then you aren't trespassing. Thus, an open doorway with a sign saying "No Entry" means you are trespassing if you go past it, but an open doorway is effectively an allowable entry point for the public.
Somehow I suspect if you said, "But the unguarded door I left open with valuable items inside was on a small alley - I didn't think anyone would notice!" people would laugh in your face. Of course, theft is theft, but if all these people did was have a look around and take photos of something embarrassing then it's just a bit funny, really.

--
Be smart, help people!
Re:Still not far enough. by FoolishOwl · 2010-02-23 05:37 · Score: 1

The difference is, by publishing a document on the Internet, you have made it publicly available. The Internet is a public medium. Publishing documents on the Internet is equivalent to passing out leaflets on a busy street corner -- people are likely to ignore you, but the assumption is, they can take the leaflets and read them if they please.
If they didn't want the documents to be publicly available, they could have:
* Required a password to view them;
* Or, hosted them on a webserver not accessible via the Internet;
* Or, not hosted them on a webserver.
The last would have taken no effort at all. You don't actually need a webserver running to view local HTML documents -- your filesystem is perfectly adequate for serving a website to a browser on your own computer.
Re:Still not far enough. by EvanED · 2010-02-23 09:47 · Score: 1

I don't know how it works everywhere else, but in the UK if there isn't significant indication that you shouldn't be somewhere then you aren't trespassing. Thus, an open doorway with a sign saying "No Entry" means you are trespassing if you go past it, but an open doorway is effectively an allowable entry point for the public.
What about a closed door?
Let me ask this. Let's say I put together a site with a login page. When I create the form, I have the choice between submitting the form as a GET or POST request. Should it make a difference as to whether someone trying passwords in the "password" field is "in the right"?
Suppose I make the (poor) decision to submit with GET. Is there a difference between someone using the form to guess passwords vs. seeing that the password is in the URL and just trying different things after "?password="?
Finally, let's say I change the submission script a bit so I use Javascript to redirect the user to "example.com/login/password" instead of "example.com/login?password=password". Is there a difference between those?
And at that point, what is the "attacker" doing that isn't just guessing a URL?
Somewhere in here there has to be a distinction between guessing someone's password and guessing a URL, but I have to admit that I don't quite see where it is. Is it the final difference, because you could expect someone to know that "?password=blah" indicates that it's supposed to be restricted? I dunno.
Re:Still not far enough. by zippthorne · 2010-02-23 10:41 · Score: 1

There's no way to reasonably expect a person to know that your example is a login and password or just garbledegook auto-generated directory structure. You see autogenerated directory structures all over the web, in fact there's probably some on this very web page if you'd care to look under the hood.
Not only that, but even in the second example (and btw, don't foucs on GET v. POST very much. Under the hood, they're extremely similar.) everything is sent in plaintext. You're still not talking about a locked door. At best, you're talking about a long hallway of open doorways, where some lead to rooms and many do not.
There is already a very simple, pretty secure way to allow restricted web access to certain information, and that way is SSL, not http passwords. (which would be more of "http://user:pass@example.com/stuff" but which are also plaintext and therefore frowned upon.)
This is eerily reminiscent of the cell phone companies who used to, instead of encrypting their transmissions, just transmit in plain ol' AM, and rely on specific legislation to make sure no one was listening. Except that such legislation is not in place here.

--
Can you be Even More Awesome?!

Answer: by mea37 · 2010-02-23 04:40 · Score: 1

Why, yes, yes it is.

First of all, define "completely unsecured". I'm pretty sure I know your definition, and if I had to vote I'd support it; but I'm also pretty sure I know their definition and it has a frightening amount of support. They will argue, and the courts might accept, that the non-publication of the URL constitutes "security", or an expectation of privacy, or whatever terms they need to feel good about filing charges.

This is a matter of technical knowledge. To a person who only knows how to follow links, limiting circulation of links can seem like "security". You can point out that it's easy to learn the skills to circumvent that, but think how that looks to someone who isn't very computer literate. "Sure, you can learn how to get around it - just like a thief can learn how to bypass a typical 5-pin lock. The skill to bump a lock isn't very hard to learn either."

The point is, as long as the typical level of knowledge doesn't include ways to find a non-published URL, the perceived threat will be in those who have the knowledge - not in those whose idea of "security" allows that knowledge to be used. I've seen Fortune 500 companies ban dsektop search tools rather than tell their employees not to "hide" sensitive documents on unlocked directories of shared drives. You really think the courts and laws are so far ahead of that knowledge curve?

Ultimately what's missing is a universal legal standard that presumes information is public if it is deliberately placed on a web-accessible file system without at least a prescribed level of protection. How strong that prescribed level of protection should be is open to debate. I don't need fool-proof security on my house to charge you with trespassing - a closed door is more than enough.

The exact standard isn't important. What's important is, the standard should exist, should be universal, and should be known to all parties.

Re:Answer: by Monkeedude1212 · 2010-02-23 04:58 · Score: 1

the non-publication of the URL constitutes "security", or an expectation of privacy, or whatever terms they need to feel good about filing charges
That will be a scary day indeed.
All I will need to do is make a popular mis-spelling, claim my site was meant to be secured, and any and all visitors are intruders seeking to steal my private data, and then sue everyone listed in the logs.
slashhdot.org! Why they accessed my secret files!
Re:Answer: by maxume · 2010-02-23 05:02 · Score: 1

If we end up with a legal standard where making information available over http without authentication is considered anything other than intent to share the information, we have failed miserably.

--
Nerd rage is the funniest rage.
Re:Answer: by tomhudson · 2010-02-23 05:15 · Score: 2, Informative

Sorry, but your argument fails almost immediately.
The url had already been "published" in the legal sense - as soon as someone leaked it to the reporters. There was no guesswork here. The reporters are part of the general public, and the disclosing of the url, without a prior agreement to keep it confidential, meets the legal definition of "to publish", same as a defamation suit only needs the words to be "published" to any 3rd party, not the entire population.
Re:Answer: by mea37 · 2010-02-23 06:29 · Score: 1, Funny

Sorry, but your argument fails immediately.
RTFA. Nobody leaked the URL to reporters. Reporters guessed URL's until they hit on one.
But I guess the moderators are in wishful thinking mode today, so you got an up-mod for a non sequitur.
Also, you should probably learn to do a better job identifying who the enemy is. Jumping down my throat for pointing out unfortunate realities of the current legal landscape isn't helping you.
Re:Answer: by neurovish · 2010-02-23 06:46 · Score: 1

Sorry, but your argument fails immediately.
RTFA. Nobody leaked the URL to reporters. Reporters guessed URL's until they hit on one.
What? From TFA:
We got a tip on Friday that you could read the government's transport plan by accessing a website called, unsurprisingly, nswtransportblueprint.com.au ...we were confronted with a dream menu for any reporter: rail services, cycleways, walking and cycling, bus services, paying and road network.
I understand we're not supposed to RTFA, but telling somebody that they are contradicted by TFA without RTFA? Is this a new rule?
Re:Answer: by tomhudson · 2010-02-23 08:26 · Score: 2, Informative

Sorry, but your argument fails immediately.

RTFA. Nobody leaked the URL to reporters. Reporters guessed URL's until they hit on one.
But I guess the moderators are in wishful thinking mode today, so you got an up-mod for a non sequitur.
Also, you should probably learn to do a better job identifying who the enemy is. Jumping down my throat for pointing out unfortunate realities of the current legal landscape isn't helping you.

You are sooo full of crap. Instead of reading the comments and telling me to RTFA, go RTFA yourself, like I did. They didn't have to guess a url. They were given the base url, and that was ALL that anyone needed to get access to every other page, same as http://slashdot.org/ gives you access to this sites contents. Don't you know how the web works yet?

Proposal for Australia by elrous0 · 2010-02-23 04:54 · Score: 5, Funny

Considering all the anti-internet, anti-gaming, anti-pron laws and sentiment that seems to have become so pervasive in Australia recently (much to the delight of /. editors, who have had no shortage of great front page stories from there recently) I propose that Australia must, to protect its citizens from the immoral influence of the internet, REMOVE ITSELF FROM THE INTERNET IMMEDIATELY. It's the only way to be sure.

--
SJW: Someone who has run out of real oppression, and has to fake it.

Re:Proposal for Australia by blackraven14250 · 2010-02-23 05:33 · Score: 1

TL;DR:
Australia losez teh internetz, nao.
Re:Proposal for Australia by Heed00 · 2010-02-23 05:47 · Score: 1

I think you'll find that taking off and nuking the entire site from orbit is the only way to be sure.

--
Thought thinks itself.
Re:Proposal for Australia by Destined+Soul · 2010-02-23 06:00 · Score: 1

Now /. needs a "Informative yet Funny" mod, if not at least for the above comment.
Next thing they'll be banning IE, Firefox, et al, for making one-click hacking software. Retarded* politicians.
(* I have a Down's syndrome brother, so I liberally apply the word retarded for those who act worse than my brother.)
Re:Proposal for Australia by elrous0 · 2010-02-24 03:05 · Score: 1

It's Australia. Unless you hit them directly in Sydney, they probably wouldn't even notice they'd been nuked.

--
SJW: Someone who has run out of real oppression, and has to fake it.
Re:Proposal for Australia by EdgeCreeper · 2010-02-25 00:05 · Score: 1

You say that nuking Australia from orbit protects it's citizens!? You might be a politician.

Media like this never prosecuted by DVD9 · 2010-02-23 05:03 · Score: 2, Insightful

If an unemployed blogger had done this he would get many years in prison (perhaps, I'm American so maybe this does not apply in Australia). Not only that, but the "newspaper" involved here would pay no attention to the blogger's rights and report the story the way the government prosecutors wished it to be written. The editor of this paper is laughing about the "controversy" and enjoying the attention as he is part of the club who run the country.

--
Why do "Al Qaeda" bulletins allegedly authored by Osama Bin Laden sound as if they were authored by Oliver North?

Appraently, Yes. by celtic_hackr · 2010-02-23 05:04 · Score: 1

Someone has secured the site, or deleted it. The link no longer works, and here I was going to look for a robots.txt file. Rats! Foiled again!. Not even a login prompt. It may be:[Agent86 voice] "they used the old use the /. effect to bring the server crashing down and thereby securing it from all those pesky hackers" trick.[/Agent86 voice]

Curiously, they specifically make it sound like all 3,727 page hits were from the hacks at the Herald, but clearly state the "some of them" came from the Herald. So, what is the actual number from the Herald hacks? Hmmm... I'd buy that for a dollar!

Yes.... by MROD · 2010-02-23 05:11 · Score: 1

Daniel Cuthbert, who "hacked" the DEC charity website by using '../' in the URL. Convicted 2005.

http://www.samizdata.net/blog/archives/008118.html

--

Agrajag: "Oh no, not again!"

That's some gate you've got there.... by ElmoGonzo · 2010-02-23 05:19 · Score: 1

...now all you need to do is build a fence and connect it to either end.

Re:Hey AU gov't by PRMan · 2010-02-23 05:20 · Score: 1

No. It's like calling ONE phone number and having the operator tell you 3727 secrets about her boss.

--
Peter predicted that you would "deliberately forget" creation 2000 years ago...

Plead stupid! by headkase · 2010-02-23 05:25 · Score: 1

I'd almost want to plead guilty if in return the government would plead stupid.

--
Shh.

The best part. by thePowerOfGrayskull · 2010-02-23 05:30 · Score: 1

"This is akin to 3,727 attempts to pick the lock of a secure office and take highly confidential documents..."

Clearly, if an office is making 4k hits trying to guess a single URL, it must be hacking! But wait, there's more...

Mr Campbell says there were about 3,727 unauthorised hits on the website, some of them from a computer belonging to a "Sydney media organisation".

Erm, that is to say, clearly if an undisclosed subset of 4k hits come from a newspaper office, then it must, uh, be a hacking attempt.

Right-o. Carry on then.

Re:As long as the URL is secret, it is an attack by Destined+Soul · 2010-02-23 05:31 · Score: 1

I was thinking along these lines. I remember coming across the following in my linux apache logs and definitely thought of it an attack probe: "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" Surely this can also be done via just an URL but that doesn't make it right.

Just because you leave your door open doesn't make someone going through it not trespassing, lock or not. Checking all of the windows and doors to see if there's a way in also doesn't really help with the "I wasn't trespassing" argument, either.

I do admit it should have been locked down, though. At least IP filter access to the site if you're still in testing.

Re:As long as the URL is secret, it is an attack by Destined+Soul · 2010-02-23 05:44 · Score: 1

I know I RTFA, but I haven't had my coffee yet. I had thought they guessed URLs within the site to see if there was something new but they just clicked on a link.

On that I change my tune a bit as I think of regular pings as normal knocks on the door. Answer and expect to get a visit from a salesman. Just because I only gave out my domain name to my 10 close friends doesn't mean that I don't expect others. However, I start for my phone/baseball bat when someone tries to get in after they've been denied regular access.

Re:As long as the URL is secret, it is an attack by pavera · 2010-02-23 05:47 · Score: 1

If you had read the article you would know this wasn't a case of "guessing" the URL. The article states that they had a source that told them the EXACT url to use, and it doesn't involve a query string at all. This source (probably some lower level person inside the ministry in question) had knowledge of the new site, and what it contained, and they leaked this information to the journalists. This is 100% not hacking.

The URL in question is nswtransportblueprint.com.au. It isn't functioning now, but according to the journalists it was on Friday. The 3700 "hits" were probably the journalists going to various pages on the site and printing the information, as the article does say that is what they did.

At any rate, there wasn't a password *anywhere* not in the URL, not in the headers, it was a completely open and accessible site. Google could have crawled it if there were any external links pointing to it that would lead the googlebot over. Anyone on the planet could have gone to the URL and seen the information. If your friend tells you "Hey I know this great new site that you should check out its supercoolsite.com", and you go there, and supercoolsite.com has no access control, no passwords, no funky URL parameters to guess, but maybe supercoolsite.com hasn't officially launched yet, and they don't actually want traffic... are you hacking their site? Maybe the founders sister is a blabber mouth and told all her friends about this site her brother is building, unbeknownest to him. That is hacking according to your definition that if the URL isn't "published in any way" then the URL alone is access control? That's just crazy. Putting something on the web by definition is publishing it to the world. If you don't want the world to see it you have to put it behind some kind of real access control (username/password/encryption/run server on a different port/ip access list/VPN) Preferably a combination of all of those.

Too funny... by g0bshiTe · 2010-02-23 05:54 · Score: 1

Looking at the actual webpage, it appears there is a login now. Considering the previous gaping security hole I wonder how much fun you could have with the Login URL.

http://nswtransport.com/login?return_to=%2F

I wonder if it would return

http://nswtransport.com/login?return_to=..%2F..%2F..%2Fetc%2Fpasswd

--
I am Bennett Haselton! I am Bennett Haselton!

Re:fuckfuck by Kell+Bengal · 2010-02-23 06:24 · Score: 1

I imagine this process could be automated, with new competitors being fed from some sort of hopper. If the m&m breeding method is also amenable to automation, I imagine we could create an apparatus that would eventually yield the ultimate m&m with minimal interference.

But what happens when they become too strong?

--
Scientists point out problems, engineers fix them
altslashdot.org: The future of slashdot.

Re:As long as the URL is secret, it is an attack by silanea · 2010-02-23 06:32 · Score: 1

To give you a (non-car) analogy: You have super-secret information which you write onto a sheet of paper. You hide that paper underneath a bench in a public park - simply by placing it on the ground there, without an envelope or any other cover. A journalist gets tipped off to check all benches in this park for secret information. He looks under 3727 benches without finding anything, but under the 3728. bench he discovers your sheet of paper.

Sixty-four-dollar question: Did the journalist "hack" your super-secret information?

--
Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.

Re:As long as the URL is secret, it is an attack by silanea · 2010-02-23 06:37 · Score: 1

Nevermind, got it wrong. The journalist knew exactly which bench to check. Dunno where those 3727 other attempts come from. Point still stands. No password was hacked, no security measure was defeated. Someone just found something in plain sight that simply had not been publicly announced.

--
Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.

Re:fuckfuck by Ihmhi · 2010-02-23 07:31 · Score: 1

Man, I would buy Lego Mindstorms just to figure out how to do the same thing with robots. Two bots try to crush an M&M, and the loser gets shoved off down a chute, into a cup, and catapulted into my mouth.

--
Random Thoughts From A Diseased Mind (Not For Dummies)

Obscurity?? by Y+Ddraig+Goch · 2010-02-23 07:34 · Score: 1

The fact that the DNS server resolved the URL to an ip address is proof that this or was going to be a public site. Fer cryin' out loud, if you want obscurity don't create DNS records that point to your server. Sheesh!

--
Meddle thou not in the affairs of Dragons, for thou art crunchy and with most anything.

Fun w/ Numbers by Anonymous Coward · 2010-02-23 07:36 · Score: 1, Insightful

Numbers can be wonderful fun. They can mean many things, and not qualifying them can be very effective when you want to mislead....

The number of "violations" being bandied about is probably actually the number of individual GET requests by the web-browser(s) against the web server.
On a media-rich web-site, (which this probably was, since nobody want to actually read anymore), one could probably rack up that many GET requests simply by loading a couple dozen logical pages. (Since every href results in yet another GET...)

Also, they used the browser to print the web-pages. Depending on the web-browser and the cache-ability of the documents already viewed, the browser may have had to GET all of the pieces AGAIN just to print the document!

No analogy needed by TWX · 2010-02-23 08:09 · Score: 2, Interesting

There's no need for analogies for what the government did. They flatly [i]published[/i] something, didn't bother to tell anyone they published it or where they published it, and got mad when someone found their published work, read it, and presumably reported what they read and helped others to find that publication. I've always looked at posting to a website as publishing in the loosest of senses. It's certainly vanity publishing in the vast, vast majority of cases, but the entire point of putting something on to the Internet without any sort of real security is so that people can find it. If a person or organization doesn't want something read potentially by all, they simply have to not upload it to a public server.

--
Do not look into laser with remaining eye.

It all depends on intent by PPH · 2010-02-23 08:17 · Score: 1

You are not supposed to open a box with a combination lock because the owner, by installing that lock, has indicated his intent not to allow unauthorized persons access. It could be a cheapo lock with an easy to guess combo. Or it could be something expensive and pick proof. In the eyes of the law it doesn't matter. Common sense may suggest investing in something better than the cheapest lock, but the law doesn't care.

A URL is not a secret, given its common use. So it doesn't have the same legal standing as a combination or uid/password. Particularly if that URL has any meaning associated with the likely contents of the site. I would expect anyone searching for information on transportation in New South Wales to consider nswtransportblueprint.com.au to be a perfectly reasonable place to look for public information. So a reasonable person could assume that the site's owner had no intention of securing it. Hiding it at Goatse.cx would have been another matter. But then I don't know much about New South Wales government, so perhaps I'm wrong.

--
Have gnu, will travel.

robots.txt by indre1 · 2010-02-23 08:39 · Score: 1

Contents of aussiegovernmentdomain.com/robots.txt

User-Agent: *
Disallow: /very/secret/catalog123

Is that 3,727 requests to the http server? by FoolishOwl · 2010-02-23 08:46 · Score: 2, Insightful

I noticed a few people reacting to the 3,727, as if it was some sort of brute-force attack to get a URL.

If that was 3,727 requests to the http server, I think that wouldn't be very much. That is, reading a web page with graphical elements would, I would think, involve a dozen or so http requests -- more if there were lots of little icons and what not. Two journalists looking at a dozen such web pages a few times each would run up that number pretty quickly. (Can someone with more networking experience than I have check my thinking?)

And, of course, a decent firewall logs all requests, including legitimate requests.

So, I would guess that this is just the politician grabbing a number that sounds large to him, and ascribing significance it doesn't have.

Re:Is that 3,727 requests to the http server? by canajin56 · 2010-02-23 11:35 · Score: 1

3,727 is the total number of lines in the firewall log that involve outside IP addresses.

--
ASCII stupid question, get a stupid ANSI

Analogy Fail by Dracophile · 2010-02-23 09:26 · Score: 1

The web works differently. One computer asks another for an index of available material. The other computer, by default, complies with the request and hands over a copy of the index. The first computer asks for a copy of the material listed in the index, and the second, again by default, complies with that request. This is not at all the same as walking into a house with an open door and removing actual property. Computers on a network will always do what they are asked to do. They are designed to do exactly that. When they do it, they are working exactly as they are supposed to work. This is not at all analogous with our traditional understanding of the way houses work. It's way past time people understood that.

--
Athy, athier, athiest.

Re:Analogy Fail by realsilly · 2010-02-24 04:44 · Score: 1

But the computer didn't type the IP address, therefore it's a conscience action of the user of the PC that got to the IP location, whether Published or UnPublished.

--
Life takes interesting turns, but the most interest is when you're off the beaten path.

Local newspaper? by GrahamCox · 2010-02-23 10:53 · Score: 1

The Sydney Morning Herald, a local newspaper? Well, yes, I guess so, in exactly the same way that the New York Times or Washington Post is.

Re:Hey AU gov't by canajin56 · 2010-02-23 11:32 · Score: 1

Read TFA. They didn't trial and error 3,727 times. Somebody e-mailed them a link, and they followed it. 3,727 is the total number of HTML requests that the "secret" and "confidential" public web server received. As the above reply notes, it's like calling ONE phone number that somebody told you to call, and having an automated system there tell you everything you wanted to know.

--
ASCII stupid question, get a stupid ANSI

Raises important points about security by cybereal · 2010-02-23 13:46 · Score: 2, Insightful

In nearly every home in the US, let alone the world, the doorways are locked with $5 pieces of tin and maybe a tiny bolt of metal shoved through some wood. There is little challenge to defeat these locks, either through picking or just jostling the door open or breaking the jamb. Furthermore, it's often the case that the doors are not locked at all, or perhaps a window is left open, or unlocked, and it's just assumed that since it's a second story window, that nobody would try it.

So many of these homes are invade by thieves. And yet, there is no question that those invading were violating a law.

If you enter a public place, rules tend to change. Despite the doors not being locked, I can walk into a grocery store and not feel like I've trespassed because it's a business and that's expected. However, I've often seen unmarked doors in dark corners of large stores, or even doors marked "Employee Only" or maybe an unlabeled staircase leading to who-knows-where. I know I'm not welcome in those areas, and if I entered one and was subsequently accosted for it, should I be shocked?

Now we start talking about computers, and their presence on public networks. To me this is some kind of bizarre combination of the two previous physical scenarios. The computers themselves are viewed as having the privacy rights of the house, where-as their offering and the environment in which they make the offer is more like the store, or even another unmentioned public situation: A public park. So how do we come to the conclusions we make? Why is "security by obscurity" not enough to justify criminal charges to those who would violate it?

Or, if you see things the other way, then I ask why you think that the public accessing a publicly offered machine is somehow unlawful, even if they are walking through those otherwise unmarked doors or looking for out-of-the way staircases?

Just because a person doesn't break a lock to get into a home doesn't mean it's not breaking and entering, and just because a door at a store is unmarked doesn't mean the person's trying to break the law either. In the internet, your computer is knowingly placed in the public arena with open attempts at making it easy for the public to find and access, yet somehow accessing an unadvertised part of that computer is a violation?

I don't think the answers are clear but I do think some of the associated assumptions on both sides are questionable. It's interesting to thing about at least. Who has the responsibility here, is it the site admin's responsibility to batten down every hatch or is it reasonable to expect people not to snoop around? You tell me...

--
I read the script, and I think it would help my character's motivation if he was on fire. -Bender

Re:fuckfuck by Thing+1 · 2010-02-23 14:22 · Score: 1

Those aren't M&Ms, they're Mike and Ikes.

--
I feel fantastic, and I'm still alive.

Re:Why care about security when you can rule by fe by mjwx · 2010-02-23 15:34 · Score: 1

Security is for chumps. Real security is sleeping well at night knowing that everyone else cowers in fear of your wrath.

But that will never happen, lets ignore the fact that the Australian government couldn't intimidate a kitten, let alone an Australian and think about that statement for a while.

You will not sleep well at all if everyone fears you, you are a threat to them and people like to remove threats to them so that they can live without fear. Fear you see is a very powerful motivator and extremely chaotic (it will never work like you expect it to). In actual fact you will sleep very restlessly out of the fear of an uprising or the fear that your own subordinates deciding to top you and take your place.

Those who rule by fear are also ruled fear or if you would prefer, live by the sword, die by the sword.

--
Calling someone a "hater" only means you can not rationally rebut their argument.

Re:As long as the URL is secret, it is an attack by silanea · 2010-02-24 01:44 · Score: 1

"Secret" for me implies that it is

not known to anyone who is not authorised to know it, and
sufficiently complex that it cannot be discovered by mere accident or a bit of common sense or guesswork.

If active attacks, ie. unintended uses of your infrastructure, are necessary to reveal the secret (brute forcing, breaking into your server, kidnapping and torturing you etc.), then I agree that the line has been crossed.

I am aware that this distinction is rather blurry. But while I do condemn brute forcing and comparable attacks I cannot subscribe to the opinion that seeing through obscurity is an evil hack. Intent alone does not constitute a security measure. There has to be a certain level of quality to an access control system.

--
Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.

Re:fuckfuck by pnutjam · 2010-02-24 04:33 · Score: 1

This is why nobody takes IT seriously, we over analyze everything.

--
Cheap storage VM.

trespass analogy by GregNorc · 2010-02-24 12:54 · Score: 1

In my state, if an area is not obviously private land, you have to post a "No Trespassing" sign. (Similarly, a business/gov't agency would have to mark an area "Restricted" or "Employees Only".

If no sign is posted, and the police are called, the police inform you you're trespassing, give you a little paper to this effect, and if you come back, you're arrested. But if the property owner tells you to leave, and you do, you have committed no trespass.

I see this access of the Australian Government's documents analogous to a hiker who was exploring public land, and wandered into a private field. Without a fence, or a posted sign, they had no way to know they were trespassing, and any charges to that effect would be easily overturned.

Splitting of hairs by DeVilla · 2010-02-24 14:49 · Score: 1

Without saying who I believe is actually right in this case, I can't help but wonder how is different to brute force

http(s)://hostname/secret

and

http(s)://username:pasword@hostname/

since basically secret could equal user:password? In the second case, you know the secret has at least one known character.

Newspaper Knows no Boundaries by greyblogs · 2010-02-24 19:46 · Score: 1

It is amazing the newspaper was poking around for two days to research a story and the Aussie gov't didn't notice--that is scary. And, the newspaper going in their backoffice to do research is pretty brassy and brash. Would think that would be illegal, as they don't own the website or have permissions. What if there is private information about the private citizens they were accessing? Yet, they thought it was okay to keep going back in there...Sickening, no honor, no boundaries.

Slashdot Mirror

Newspaper "Hacks Into" Aussie Gov't Website By Guessing URL

201 of 271 comments (clear)