Slashdot Mirror
City of Johannesburg Leaks Personal Bills Online, Threatens Flaw Finder
An anonymous reader writes "A major security hole in the City of Johannesburg's online billing system has meant that customer invoices have been visible on the open web with a bit of simple parameter phishing. Change a digit in the URL for your bill, and someone else's appears. Including major corporations like the roads agency, SANRAL (which is R55 000 in arrears, apparently). Neighboring Ekhuruleni had a similar problem too. Both problems were discovered by regular visitors at a local IT forum, and it's interesting to compare the two cities reactions. Ekhuruleni quietly and quickly fixed the problem, while Joburg has threatened legal action against the user — who tried to raise the issue with the city IT team several times before going public. Legal experts say there's a potential case for a class action."
I've never understood why people non-anonymously go public with security flaws, except for personal gain. "Yeah I'm that guy, give me credz/a job... BUT I DID IT ALTRUISTICALLY!"
Either post directly under an alias, or - better - release to the IT or even general press.
5 years ago it would be considered a "Hacking" crime to bring to light such a trivial adjustment to the way you access a website by changing it's URL in a small way, but now it is grounds for class action against the operator for actual lax security.
They think that the people who run this are people like them, reasonable people.
But these people are run for local government. If you think national government is filled with a cancerous collection of social misfits only out for their own egos, you've seen NOTHING compared to local government.
What these people thought was the same as someone who sees some money drop out of someone's bag or pocket, picks it up and then taps the person on the shoulder to say "Here, you dropped this". They thought they'd get "Thanks for that". What they GOT was "HOW DARE YOU STEAL MY MONEY!!!!!".
Because a person in charge is fucking crazy and everyone else is too scared to gainsay them because they're fucking crazy.
This sounds like a "let's sue the user before anyone sues us" tactic. Johannesburg has effectively been publishing sensitive data, which should violate privacy laws. If anyone should be brought to court, it is Johannesburg itself.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
Gimme Hope Jo'anna - where is the shining light of Freedom in Africa now?
http://mybroadband.co.za/vb/showthread.php/553957-City-of-Joburg-security-issue-everyone-can-see-all-customers-statements?p=11014501&viewfull=1#post11014501
"Hi all, I have yet to get contacted by CoJ or anyone else responsible/concerned about my initiative to help close the data-leak. As far as I am concerned I have not done anything illegal and have not been charged or accused of having conducted anything illegal. The CoJ certainly makes it out that the customer invoices were accessed in an sophisticated and malicious hack. I did elaborate this to the press and while all of you understand exactly what happened it is still astounding that CoJ attempts to bury the real story instead of taking accountability for what actually happened. Although this incident is presented as an attack, Google managed to index the tax-invoices dating back to February 2013 and all information circulating in the press (such as the mentioned SANRAL tax invoice) have been publicly available via a simple Google search, prior to my discovery on 20th August 2013. The CoJ claims of a hack are simply rubbish and any person with an internet connection would have been able to view the same information. There is ZERO IT-skill required to change an invoice number in a web-address. I am not going to worry about any criminal or civil charges and a team of lawyers is ready to deal with those should that situation arise. It is quite shocking to see how the media reported on this issue despite having had many witness accounts and solid evidence at hand. In my opinion it should have never gotten to the point that this situation is now all over the news, had the CoJ acted responsibly and shown accountability and prompt resolve. I think MyBroadband has managed to capture the actual events very accurately and I appreciate all the support, PM's and phone-calls I have received over the last few days. As a rate- and tax-payer it is our civic duty to ensure that our resources are managed in a responsible way and it is quite an embarrassment that our leaders (which we pay via our taxes) show zero interest in serving their residents - if they did, we would not sit with the number of threads and misinformation currently being pedalled to save face. The newspapers equally act irresponsibly by printing anything being said without having verified actual facts (which are readily available) and as such are not improving the situation. As a CoJ resident I am ashamed to life in a city where their representatives lie and misinform to cover up incompetence and shy away from their own accountability."
Yup, all (to any practical measure of it) powerful people become enamoured of the power. Small government *are worse* than central government in this case, mostly because the remit of the power is more immediate and they're less likely to have to (or be able to) delegate to a deep structure of flunkies. When you have an army of flunkies, it's the power over people you exercise. When it's power over some real external realities (i.e. parks and recreation management or councillor) then it's power over things you're "responsible for" that is required.
This is the same for corporations. Middle/senior management will want power over people. The technical prima donna will want power over the activity they work on.
So local government are much more likely to sue if you show them up like this. Police officers, the same. The CEO will want you to dance to his tune. The prima donna wants you to be humiliated.
The next city or government utility provider doing this, it will be referred to as "doing a Joburg" or "did a Joburg" (that is, thinking that merely having a login makes a site secure).
now we need to go OSS in diesel cars
Lenovo Canada had the same problem last year or so. I fired off an email to the right people, we emailed back and forth a few times, they didn't think there was a problem and couldn't reproduce, I finally setup a test case step by step to pull up someone's invoice, and they fixed it after.
They offered me a free case or battery or laptop accessory as thanks, I never bothered taking them up on it.
I was actually trying to lookup my own invoice from a laptop order I had made... their invoicing system is an utter mess as each component you buy gets separately invoiced as it ships, and I had bought a laptop as a guest or similar.. I knew my invoice number, just not the specific details.. I noticed the url given in the order email had the invoice number in it, and changing the invoice number to the other order gave my invoice.. and then tried a different number and learned that so-and-so had a mouse shipped to their address, etc.
They haven't fixed the invoicing system yet.. I'd much rather be billed for everything at once when it goes to manufacturing, or when it all ships.. Right now you have to go through each line on the order and match it up to the invoice they've sent... calculating the tax and shipping costs for each one.
Just a note for all those and the article writer, the pages were publicly available without any credentials. Thus you did not need to log in and then manipulate the URL to see other people's statements, rather you just typed in a URL and poof, there was someone's bill. In fact they have been indexed by Google since Feb this year.
Could the writer please update the article to reflect the above points, this was no phishing or any other malicious attack, it was just a straight public set of URLs that should have been secured, but weren't. You can't expect a poster on a public wall not to be viewed by the public, same principle applies.
http://mybroadband.co.za/news/general/85285-city-of-joburg-opens-criminal-case-against-hacking.html
The City of Joburg has opened a criminal case at the Hillbrow police station after a forensic investigation with its IT partner apparently showed that its online system was hacked.
It laid the charge at the Hillbrow police station in Johannesburg, said spokesman Gabu Tugwana. The police could not confirm whether a case had been opened.
“Criminal acts of this nature will not go unpunished and the city intends to send out a strong message that a deliberate and malicious breach of this nature will not be tolerated,” said Tugwana.
He declined to reveal the hacker’s identity, but said they were not a member of the city’s staff.
“We would like to reassure all residents that the necessary legal and technical steps are being taken to prevent similar incidents in future.
“Our residents’ confidential information is safe and secure,” Tugwana said.........