Slashdot Mirror
Nevada Website Bug Leaks Thousands of Medical Marijuana Dispensary Applications (zdnet.com)
An anonymous reader quotes a report from ZDNet: Nevada's state government website has leaked the personal data on over 11,700 applicants for dispensing medical marijuana in the state. Each application, eight pages in length, includes the person's full name, home address, citizenship, and even their weight and height, race, and eye and hair color. The applications also include the applicant's citizenship, their driving license number (where applicable), and social security number. Security researcher Justin Shafer found the bug in the state's website portal, allowing anyone with the right web address to access and enumerate the thousands of applications. Though the medical marijuana portal can be found with a crafted Google search query, we're not publishing the web address out of caution until the bug is fixed. A spokesperson for the Nevada Dept. Health and Human Services, which runs the medical marijuana application program, told ZDNet that the website has been pulled offline to limit the vulnerability. The spokesperson added that the leaked data was a "portion" of one of several databases.
Anyone with the right web address? That's not just a bug, it's plain incompetence.
To every one of those applicants, it may have well been the entire database.
don't do that. ok?
That many people need MJ to treat their specific condition?
weight and height, race, and eye and hair color.
Why the hell is that on the application?
I thought "information wants to be free"? Or does that just pertain to everybody else's information?
The only way we're going to get away from the violence, coercion, theft, and fraud that government is is by eliminating it. I'm not a conservative, republican, or democrat. I want an end to the state because the state is violent. I don't think the government has any business in setting up wealth redistribution programs or telling people what they can or can't put in their own body. I don't think the government has any right to say who can and can't drive (drivers licenses, vehicular registration, insurance, etc). The government should be almost non-existent. We don't need board walls or guards. We don't need a state police. We don't need a lot of things and in the process of those who wish to get those things they currently depend on violence to achieve them via theft of funds from other non-voluntary participants. If you want security you should be free to purchase it or join with others whom want such things (there are even apps for smart phones to achieve that in a zero cost way; look up Cell 411). I hope to eliminate government by telling others about a movement for those of us who put freedom above "safety" and don't think the government should be setting up wealth redistributions programs or licensing drivers or even setting up check points (at the board or otherwise). Life has risks and trying to eliminate all risk doesn't end the way I want it to. It ends in a terrible police state that I'd rather not live in. http://www.freestateproject.org/ for migration effort of liberty-minded people http://www.freeekeene.com/ for liberty-oriented news in New Hampshire (destination of the liberty-minded).
That's 11,700 less records they'll have to provide to the feds under subpoena when Trump's stormtroopers show up with helicopters and assault rifles to take all that nasty devil weed away.
Anyone who voluntarily registers for one of these programs is a maroon. It's still a federal crime, kids.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
due to a poorly written app/site/webservice by a nephew for the dispensary owning uncle or some other amateur hour nonsense.
OK, give that some more thought next time you need to flush the toilet or drive your car somewhere.
"I don't think the government has any business in setting up wealth redistribution programs"
The government should create money for a basic income. Indexation fixes inflation.
eye color
- pretty sure that would be red on every application.
This message was relayed to be by an inmate at a Texas jail facility: "I'm writing this from the Dallas PD lockup. I was out in the Ft. Worth area doing security research of residential door knobs, testing which doors might be open and thus exposing housing to breaches. Some guy named Justin Shafer confronted me when I apparently accessed the knobs on his house. He called the cops and now I'm charged with attempted burglary! I explained that my intentions were purely honorable; after all, I'm not a thief! Yes, it's true, I copied some of his mail off the desk in the den, but that was just so I could prove the vulnerability to the gan... er, security community. Anyway, the arraignment didn't go so well, even after I explained that the judge should be thanking me. So I've got a contempt citation too. All I can say is, thank goodness for identity theft!
If companies that made safes and strong-boxes, and the like had the same record the people who make these things do, they'd be out of business, sued into oblivion or in jail.
Here's an idea... we have professional organizations to ensure standards for professions like doctors, engineers, even cabinet makers I think, are made to certain standards. The IT professions are NO LONGER in their infancies. Why isn't there someone licensing and credentialing the people responsible for making these systems like there are for people who build bridges, roads, office-buildings, apartment buildings, rockets, guns, etc.
Why aren't people required to be properly certified to make software, properly trained, and held accountable when shit like this happens?
Why are we at the mercy of these people? Can they really NOT do better? Modern conventional wisdom is that nothing is incapable of being hacked, but I beg to differ. I own a wristwatch that cannot be. Not by a hacker, not over the internet. Because it's not connected to it, it's not capable of being connected to it. So there goes that theory. A bottle of water cannot be hacked. There's nothing you can do as a hacker using the internet to alter the water and make it anything else. Even if you could convince someone using hacking skills or tools to add something to the water changing it, you don't know where the water is, and can't find out using the internet.
Let's suppose nothing is not hackable... well, let's say things can at least be made ridiculously hard to hack, prohibitively hard, and that's the way things should be when they put people's personal, private information in them and if they are not willing, ready and able to do so, they should not be allowed to make or sell, or buy or use software that isn't certifiable and certified, just as someone who recklessly fails to protect that which it is their duty to protect is liable in the eyes of the law.
So it should be with the writers of software, maintainers of data systems, etc. When someone screws up like this, it should not be the innocent who trusted that their software was worth a fuck, but the person or people responsible for the fact that it isn't worth a fuck, from a security perspective.
OMG ! The marijuana industry just got a BIG promotional boost - all for free - from the news that there will be a dispensary coming to your neighborhood soon - - - lol
redneck geek
Yea i don't think so
took all of about 15 seconds to find... name, social, ph num... everything anyone would want for identity theft.. this is potentially terrible for anyone that applied
yeah,
No. I do not think you understand what money is. Maybe you should take an economics class?