How a company treated a white hat

[amdfangirl]

When Patrick Webster told First State Super he found a flaw exposing the personal details of its 770,000 members - including NSW Police officers, politicians and magistrates - he thought he was doing a good deed.

But before long, Webster, a private security consultant, received a knock on the door from police and a legal letter from the superannuation firm threatening legal action. First State Super has disabled his account, asked to check his computers and said he may be liable for any costs in fixing the breach.

http://www.smh.com.au/it-pro/security-it/super-bad-first-state-set-police-on-man-who-showed-them-how--770000-accounts-could-be-ripped-off-20111018-1lvx1.html#ixzz1b7yQOuID

There has to be something wrong with first state super. Anyone with half a brain...

 

[Pyree]

"He noticed that the URL contained the unique ID number for each account and by tweaking the number in the URL, he was able to easily access other people's statements."

OMGWTF, what kind of stupid dumb ass will include unique ID as part of URL and can be used to view online statement without further logon detail. Whoever designing the security for the First State Super should be thoroughly ashamed of him/herselves and should go back to kindergarten to be re-educated from the very beginning.

"Webster called First State to share with them his discovery and after spending an hour trying to find someone who could understand the technical issues, he got on to an IT staffer there and sent him the evidence."

Is the issue really that hard to understand? Ok, even if you don't understand, if I am the receptionist, I would contact the IT department straight away and let the IT people deal with Mr Webster. More incompetent people in the company again.

"The next day Webster received a letter from First State's law firm, Minter Ellison, telling him his actions constituted a breach of the Crimes Act and Criminal Code Act. He was also notified that his First State Super account had been disabled.

"You should be aware that due to the serious nature of your actions, this matter has been reported to the NSW Police," the letter, seen by Fairfax Media, reads."

A nice way to thank people who save your company, back stabber. Now you just made public how weak your cyber security is and I bet the company will attract more attention and hackers. I would hush it up if it was my company.

"Webster was also ordered to destroy all of the records he had accessed and notified that the firm reserved its rights to allow its IT personnel to examine his computer to verify that the records had been destroyed. The firm said they may go after him for costs related to the matter."

What a load of bullshit! I though only the police with search warrant can search through your computer. A private company can definitely not do that. Not even company like Apple or Google, let alone First State Super. Ok may be Apple and Google can do that without you knowing it, LOL!

"He was given seven days to respond and asked to sign a letter admitting to having gained "unauthorised access"."

If you left something that obvious outside, you can't sue them for unauthorised access. The customers statement may as well be made public. Who would sign that stupid thing? A conviction out of an innocent man? I would sue them back for perverting the course of justice and negligence as a customer if I am Patrick Webster.

"Dwyer acknowledged that the fact that the account information was exposed, potentially opening up members to identity theft, was "disappointing"."

Learn English, it should be "catastrophic"!

"There was no criminal offence committed and the company in question has been informed of the outcome. It was more a case of a civic-minded person reporting a potential security breach."

Luckily the police knows what they are doing.

In conclusion- First State Super= FAILURE. Oh wait, that could be their new name (First State Super Failure)!

 

[amdfangirl]

There are so many things wrong with this company.

 

[wanamingo]

The problem here is with the laws. I strongly recommend you take a quick peak at Unauthorized Access Laws. The law is vaguely worded that almost any kind of communication with hardware (Even accidentally) that you shouldn't have access to is breaking the law.

"Computer" means an electronic device which performs logical, arithmetic, and memory functions by the manipulations of electronic, photonic or magnetic impulses, and includes all input, output, processing, storage, software, or communications facilities which are connected or related to such a device in a system or network, including devices available to the public for limited or designated use or other devices used to access or connect to such a system or network.

This is the laws definition of a computer. Almost anything electronic could be considered a computer under this definition. (I'm using info from my state but Im sure its the same nation wide, other countries not so sure)

"Access" means to instruct, communicate with, store data in, enter data in, retrieve data from, or otherwise make use of any resources of a computer, computer system, or computer network.

Again legalese definition of access. Could be any kind of communication.

The only thing left is for the offended party to define "unauthorized" which could mean just about anything.

You dont let lawyers decide policy for IT or else you get nonsense.

 

[Houndsteeth]

The thing is, this will go on for about a month, and then someone with a brain and half a clue will realize this guy isn't a bad guy, but rather just another average Joe Q. Public who doesn't like the idea that his intimate details are available for everyone to peruse. Maybe, just maybe, this person-with-a-clue has enough clout to call off the brain-dead goons who are "just doing their job."

 

[riser]

There are so many things wrong with this company.

It isn't just this company. The recent credit card companies that were 'hacked' were the same issue. Changing the numbers in the URL would allow them access to other accounts after they had already logged in as a valid user.

This really isn't anything new. Moreso it is a lack of being updated with the technology they are using. Most likely they were running a newer piece of software that they didn't fully understand and thus exposed something that should have been fixed.

This goes back to the days when SQL Injection or Cookie Poisoning was extremely easy and very reliable.

Nowadays you can be a script kiddie and use Google for hacking or getting information. Plenty of opportunties and many ways to get the information out there. It is just a matter of people getting around to understanding how it works then looking for the flaws.