Slashdot Mirror
City of Johannesburg Leaks Personal Bills Online, Threatens Flaw Finder
An anonymous reader writes "A major security hole in the City of Johannesburg's online billing system has meant that customer invoices have been visible on the open web with a bit of simple parameter phishing. Change a digit in the URL for your bill, and someone else's appears. Including major corporations like the roads agency, SANRAL (which is R55 000 in arrears, apparently). Neighboring Ekhuruleni had a similar problem too. Both problems were discovered by regular visitors at a local IT forum, and it's interesting to compare the two cities reactions. Ekhuruleni quietly and quickly fixed the problem, while Joburg has threatened legal action against the user — who tried to raise the issue with the city IT team several times before going public. Legal experts say there's a potential case for a class action."
I've never understood why people non-anonymously go public with security flaws, except for personal gain. "Yeah I'm that guy, give me credz/a job... BUT I DID IT ALTRUISTICALLY!"
Either post directly under an alias, or - better - release to the IT or even general press.
5 years ago it would be considered a "Hacking" crime to bring to light such a trivial adjustment to the way you access a website by changing it's URL in a small way, but now it is grounds for class action against the operator for actual lax security.
They think that the people who run this are people like them, reasonable people.
But these people are run for local government. If you think national government is filled with a cancerous collection of social misfits only out for their own egos, you've seen NOTHING compared to local government.
What these people thought was the same as someone who sees some money drop out of someone's bag or pocket, picks it up and then taps the person on the shoulder to say "Here, you dropped this". They thought they'd get "Thanks for that". What they GOT was "HOW DARE YOU STEAL MY MONEY!!!!!".
Because a person in charge is fucking crazy and everyone else is too scared to gainsay them because they're fucking crazy.
This sounds like a "let's sue the user before anyone sues us" tactic. Johannesburg has effectively been publishing sensitive data, which should violate privacy laws. If anyone should be brought to court, it is Johannesburg itself.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
Gimme Hope Jo'anna - where is the shining light of Freedom in Africa now?
http://mybroadband.co.za/vb/showthread.php/553957-City-of-Joburg-security-issue-everyone-can-see-all-customers-statements?p=11014501&viewfull=1#post11014501
"Hi all, I have yet to get contacted by CoJ or anyone else responsible/concerned about my initiative to help close the data-leak. As far as I am concerned I have not done anything illegal and have not been charged or accused of having conducted anything illegal. The CoJ certainly makes it out that the customer invoices were accessed in an sophisticated and malicious hack. I did elaborate this to the press and while all of you understand exactly what happened it is still astounding that CoJ attempts to bury the real story instead of taking accountability for what actually happened. Although this incident is presented as an attack, Google managed to index the tax-invoices dating back to February 2013 and all information circulating in the press (such as the mentioned SANRAL tax invoice) have been publicly available via a simple Google search, prior to my discovery on 20th August 2013. The CoJ claims of a hack are simply rubbish and any person with an internet connection would have been able to view the same information. There is ZERO IT-skill required to change an invoice number in a web-address. I am not going to worry about any criminal or civil charges and a team of lawyers is ready to deal with those should that situation arise. It is quite shocking to see how the media reported on this issue despite having had many witness accounts and solid evidence at hand. In my opinion it should have never gotten to the point that this situation is now all over the news, had the CoJ acted responsibly and shown accountability and prompt resolve. I think MyBroadband has managed to capture the actual events very accurately and I appreciate all the support, PM's and phone-calls I have received over the last few days. As a rate- and tax-payer it is our civic duty to ensure that our resources are managed in a responsible way and it is quite an embarrassment that our leaders (which we pay via our taxes) show zero interest in serving their residents - if they did, we would not sit with the number of threads and misinformation currently being pedalled to save face. The newspapers equally act irresponsibly by printing anything being said without having verified actual facts (which are readily available) and as such are not improving the situation. As a CoJ resident I am ashamed to life in a city where their representatives lie and misinform to cover up incompetence and shy away from their own accountability."
The next city or government utility provider doing this, it will be referred to as "doing a Joburg" or "did a Joburg" (that is, thinking that merely having a login makes a site secure).
now we need to go OSS in diesel cars
Lenovo Canada had the same problem last year or so. I fired off an email to the right people, we emailed back and forth a few times, they didn't think there was a problem and couldn't reproduce, I finally setup a test case step by step to pull up someone's invoice, and they fixed it after.
They offered me a free case or battery or laptop accessory as thanks, I never bothered taking them up on it.
I was actually trying to lookup my own invoice from a laptop order I had made... their invoicing system is an utter mess as each component you buy gets separately invoiced as it ships, and I had bought a laptop as a guest or similar.. I knew my invoice number, just not the specific details.. I noticed the url given in the order email had the invoice number in it, and changing the invoice number to the other order gave my invoice.. and then tried a different number and learned that so-and-so had a mouse shipped to their address, etc.
They haven't fixed the invoicing system yet.. I'd much rather be billed for everything at once when it goes to manufacturing, or when it all ships.. Right now you have to go through each line on the order and match it up to the invoice they've sent... calculating the tax and shipping costs for each one.