Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Government The Courts Your Rights Online

City of Johannesburg Leaks Personal Bills Online, Threatens Flaw Finder 46

Posted by samzenpus from the no-good-deed dept.
An anonymous reader writes "A major security hole in the City of Johannesburg's online billing system has meant that customer invoices have been visible on the open web with a bit of simple parameter phishing. Change a digit in the URL for your bill, and someone else's appears. Including major corporations like the roads agency, SANRAL (which is R55 000 in arrears, apparently). Neighboring Ekhuruleni had a similar problem too. Both problems were discovered by regular visitors at a local IT forum, and it's interesting to compare the two cities reactions. Ekhuruleni quietly and quickly fixed the problem, while Joburg has threatened legal action against the user — who tried to raise the issue with the city IT team several times before going public. Legal experts say there's a potential case for a class action."
This discussion has been archived. No new comments can be posted.

City of Johannesburg Leaks Personal Bills Online, Threatens Flaw Finder More

City of Johannesburg Leaks Personal Bills Online, Threatens Flaw Finder

Comments Filter:

  • attention-seeking (Score:3)

    by Joining Yet Again ( 2992179 ) on Friday August 23, 2013 @04:38AM (#44652413)

    I've never understood why people non-anonymously go public with security flaws, except for personal gain. "Yeah I'm that guy, give me credz/a job... BUT I DID IT ALTRUISTICALLY!"

    Either post directly under an alias, or - better - release to the IT or even general press.

    • Re: (Score:1)

      by Anonymous Coward
      Because they are stupid and seriously think that they will be received better if they attach a name. That's completely wrong. It just gives people, or in this case, a municipal government, a direction to sling shit in. It's kind of like how if you disagree with APK while logged in, he'll follow you around for months and spam every post you make, except it has real consequences.
      • Your looking at it wrong; these clowns are a public entity, and worse, they encourage you to use a flawed publicly available service that they provide. The guy told them about the flaw serveral times which they ignored, endangering the public and screwing up the trust. These guys are WRONG anyway you clide it, and pointing to the bell ringer as the problem is really bad.
        • Sounds like he tried to do this the right way, by contacting the cities several times. I'm sure he's getting sued for vindictive reasons, more like, "How dare he embarrass the city by exposing our security flaws, in the hopes that would pressure us to fix them after we did nothing from repeated warnings.... how DARE he???"

    • Why? They think they're helping. (Score:5, Insightful)

      by Anonymous Coward on Friday August 23, 2013 @04:49AM (#44652451)

      They think that the people who run this are people like them, reasonable people.

      But these people are run for local government. If you think national government is filled with a cancerous collection of social misfits only out for their own egos, you've seen NOTHING compared to local government.

      What these people thought was the same as someone who sees some money drop out of someone's bag or pocket, picks it up and then taps the person on the shoulder to say "Here, you dropped this". They thought they'd get "Thanks for that". What they GOT was "HOW DARE YOU STEAL MY MONEY!!!!!".

      Because a person in charge is fucking crazy and everyone else is too scared to gainsay them because they're fucking crazy.

    • Re:attention-seeking (Score:5, Insightful)

      by Chatsubo ( 807023 ) on Friday August 23, 2013 @04:59AM (#44652475)

      Years ago I stumbled a hideous flaw in a clients website after being asked to retrieve a file from it: Directory listings turned on and folders filled with customer accounts, details, histories, etc.

      Luckily I had read enough Slashdot to understand I shouldn't just bang an email out to them explaining that I'd just perused thousands of customer files by simply chopping the filename off. No, instead I reported to my superiors and warned them to let the CEO himself "gently" suggest this little oversight to the other company and keep my name out of it. So it was, and nothing nefarious came of it.

      As IT pro's we must understand that what sounds trivial to us sounds like (car analogy ahead) this to a customer:
      "Oh hey, that lock on your garage is useless, I mean I picked it in like 5 seconds. Then I unlocked your car too, and started it, and drove it around the block. Just wanted to let you know you should be more careful".

      It is not like that, but it sounds like that. S'all I'm sayin.

      • This is very well put. I think the hardest thing I've had to learn working in IT is not how to write code or troubleshoot software, but how to talk to non-IT people. When I first arrived at my current job, I saw many opportunities to improve things, and excitedly suggested a dozen projects. All people would hear though was that I thought they were bad at there jobs, the only reason they could see that I could be talking about improving how they do things. I'm still working on that aspect.

        • Re: (Score:1)

          by mcgrew ( 92797 ) *

          All people would hear though was that I thought they were bad at there jobs, the only reason they could see that I could be talking about improving how they do things.

          Well, maybe you should have said something in person rather than using email, because you come across as very uneducated. I mean uneducated as in "dropped out of the ninth grade." Nobody is going to take you seriously if you don't know the difference between there and their, which you should have learned by the third grade.

          In fact, that made m

    • Re: (Score:2)

      by Nyder ( 754090 )

      I've never understood why people non-anonymously go public with security flaws, except for personal gain. "Yeah I'm that guy, give me credz/a job... BUT I DID IT ALTRUISTICALLY!"

      Either post directly under an alias, or - better - release to the IT or even general press.

      Let say you banked at bank that had this flaw. You tell them it has this flaw, they ignore you. You tell them again, they ignore you. You tell them again, they ignore you. YOu tell them again, they ignore you.

      So besides moving to a new bank, what do you do? You let everyone know that they have a flaw and need to fix it. It's called public shaming and has been used since the beginning of man.

  • 5 years ago it would be considered a "Hacking" crime to bring to light such a trivial adjustment to the way you access a website by changing it's URL in a small way, but now it is grounds for class action against the operator for actual lax security.

    • Re: (Score:1)

      by Anonymous Coward

      I'm quite sure you are referring to a situation in a different country...! Seen this behavior the most with Americans, who always insist on their sovereignty in the world, but never acknowledge that laws work differently once you step across the border.

  • Sueing out of incompetence? (Score:4, Insightful)

    by Errol backfiring ( 1280012 ) on Friday August 23, 2013 @05:05AM (#44652489) Journal
    This sounds like a "let's sue the user before anyone sues us" tactic. Johannesburg has effectively been publishing sensitive data, which should violate privacy laws. If anyone should be brought to court, it is Johannesburg itself.

    • Re: (Score:2)

      by AmiMoJo ( 196126 ) *

      Rather than admit they were idiots who didn't implement basic security the staff prefer to say they were hacked and are victims of some criminal genius. Everyone knows that no security system can stop an elite hacker. How many movies open with some nerd breaking into the Pentagon's computer system?

  • Gimme Hope Jo'anna (Score:3)

    by Chrisq ( 894406 ) on Friday August 23, 2013 @05:14AM (#44652515)
    Gimme Hope Jo'anna - where is the shining light of Freedom in Africa now?

  • Feedback from the guy that found the flaw (Score:5, Informative)

    by KruiserX ( 1008455 ) on Friday August 23, 2013 @05:55AM (#44652645)
    http://mybroadband.co.za/vb/showthread.php/553957-City-of-Joburg-security-issue-everyone-can-see-all-customers-statements?p=11014501&viewfull=1#post11014501 [mybroadband.co.za]
    "Hi all, I have yet to get contacted by CoJ or anyone else responsible/concerned about my initiative to help close the data-leak. As far as I am concerned I have not done anything illegal and have not been charged or accused of having conducted anything illegal. The CoJ certainly makes it out that the customer invoices were accessed in an sophisticated and malicious hack. I did elaborate this to the press and while all of you understand exactly what happened it is still astounding that CoJ attempts to bury the real story instead of taking accountability for what actually happened. Although this incident is presented as an attack, Google managed to index the tax-invoices dating back to February 2013 and all information circulating in the press (such as the mentioned SANRAL tax invoice) have been publicly available via a simple Google search, prior to my discovery on 20th August 2013. The CoJ claims of a hack are simply rubbish and any person with an internet connection would have been able to view the same information. There is ZERO IT-skill required to change an invoice number in a web-address. I am not going to worry about any criminal or civil charges and a team of lawyers is ready to deal with those should that situation arise. It is quite shocking to see how the media reported on this issue despite having had many witness accounts and solid evidence at hand. In my opinion it should have never gotten to the point that this situation is now all over the news, had the CoJ acted responsibly and shown accountability and prompt resolve. I think MyBroadband has managed to capture the actual events very accurately and I appreciate all the support, PM's and phone-calls I have received over the last few days. As a rate- and tax-payer it is our civic duty to ensure that our resources are managed in a responsible way and it is quite an embarrassment that our leaders (which we pay via our taxes) show zero interest in serving their residents - if they did, we would not sit with the number of threads and misinformation currently being pedalled to save face. The newspapers equally act irresponsibly by printing anything being said without having verified actual facts (which are readily available) and as such are not improving the situation. As a CoJ resident I am ashamed to life in a city where their representatives lie and misinform to cover up incompetence and shy away from their own accountability."

    • Re: (Score:3)

      by Inda ( 580031 )
      That raises a question in my mind. How did Google find them? Surely it doesn't increment numbers in a query string?

      Either they were hyperlinked on CoJ's website, or someone else already 'hacked' the website and has linked the invoices from elsewhere.
      • You think Google only finds URL's using crawlers? All it takes is a single mention somewhere in a google docs document, or in an email sent or received by gmail. Or something on the page itself, like google analytics, ads by google, or maybe a reference to a google-hosted Javascript or image file, or a link to a google-hosted page, anything with a referrer.

  • The next city or government utility provider doing this, it will be referred to as "doing a Joburg" or "did a Joburg" (that is, thinking that merely having a login makes a site secure).

  • Lenovo Canada had the same problem last year or so. I fired off an email to the right people, we emailed back and forth a few times, they didn't think there was a problem and couldn't reproduce, I finally setup a test case step by step to pull up someone's invoice, and they fixed it after.

    They offered me a free case or battery or laptop accessory as thanks, I never bothered taking them up on it.

    I was actually trying to lookup my own invoice from a laptop order I had made... their invoicing system is an utte

Slashdot Top Deals

A Fortran compiler is the hobgoblin of little minis.

Close