6 ms·

TWO file photos of shady hooded figures with obscured faces and glitch art effects or other digital overlays put over the pic! Truly, this is a very comprehensi

by NamTaf 9y ago

TWO file photos of shady hooded figures with obscured faces and glitch art effects or other digital overlays put over the pic! Truly, this is a very comprehensive report about hacking indeed. On a serious note, I'm not at all surprised that my government's screwed up some sort of online database of private information. We had the famous census night access issues due to a DDoS and I am just waiting for that data to leak. It doesn't surprise me whatsoever when our government mismanages IT projects in particular and I suspect more of this sort of data leak is going to inevitably happen as a result. ITifying all of the things isn't necessarily a good idea. Some things are honestly worth the extra hassle of being left to pen and paper.

TomMarius 9y ago
Is there at least ONE country where IT projects are successful and with a normal price tag?
- yakult 9y ago
  The lesson there is that people have unrealistic budget and schedule expectations of large IT projects. Same with defense, medicare, etc.
  - Haydos585x2 9y ago
    I think it's just with everything. I saw a tweet once that was something like: "If you ask a programmer how long an hour will take they'll tell you 45 minutes"
    - a3n 9y ago
      That's because they only count the part that they're working on. The rest of the Hour project includes standups, testing, documentation, deployment, retrospectives and post-mortems, team happy hours, ...
      - lostboys67 9y ago
        You forgot browsing HN -)
- L_226 9y ago
  Estonia[0]. [0] - https://e-estonia.com/ https://e-estonia.com/
  - TomMarius 9y ago
    I actually own the e-residency card, but forgot about the country. :-D
JimmyAustin 9y ago
This is just as likely to be a rogue employee/sysadmin as it is a actual hack. I wouldn't start placing blame until it's determined what the actual cause is.
- duncan_bayne 9y ago
  Some blame can be placed up-front, at least potentially. Regardless of the _nature_ of the breach, if the data ought not to have been stored, the fault lies with those who decided to store it.
- stubish 9y ago
  If it is an employee or sysadmin, they are an idiot. Its $30 a pop for small volume and large risk. If you have a job with access to this data you should be charging a hell of a lot more. But its enough to get someone in a poorer country with little at risk to create a fake gmail account and use it to bootstrap access to an online self service portal or whatever approach they are using.
  - iamben 9y ago
    Indeed. Assuming they have some kind of logs for legitimate use in place (X was logged in and requested X), how hard would it be to add a bogus record, request it and see who looks it up. If it's accessed and the logs are avoided, there's probably something leaky. Assumption is a dangerous thing, however...
  - jacques_chester 9y ago
    > If it is an employee or sysadmin, they are an idiot. Its $30 a pop for small volume and large risk In this scenario, I expect a bad egg would've sold the records in bulk to a middleman for a high price.
ajdlinux 9y ago
My guess, based on what's publicly available, is that this incident is quite possibly just a set of stolen or misused creds for a fairly widely available Medicare card lookup database used by doctors. In which case, this is less of a "cyber security" issue and more an issue with fundamental system design/requirements. But we'll see.
- nomercy400 9y ago
  One way to avoid this would be to limit the access of a doctor to patient records. Unless you give permission at a doctor/hospital to have them access your record, they won't be able to do a lookup. Retract the permission automatically/renew it once every X months. This would make stolen/misused creds a much smaller risk.
  - yorwba 9y ago
    This runs into problems when the patient can't give permission e.g. because they are unconscious.
    - rwmj 9y ago
      This is a problem that can be solved in a low tech way using a medical bracelet / necklace for patients who have chronic diseases that doctors might need to know about.
      - killjoywashere 9y ago
        Somebody with sickle cell disease or otherwise transfusion dependent greatly benefits from electronic records, which help minimize antibody reactions (not just ABO and Rh, but Duffy, Kell, Kidd, MNS, etc)
  - ajdlinux 9y ago
    So, this isn't access to patient records as such - it's merely access from a name to a Medicare number. Additionally, how exactly are you going to get the patient to give permission beforehand? Patients will expect to walk into a medical clinic, hand over their card, and have it all just work.
L_226 9y ago
> We had the famous census night access issues due to a DDoS and I am just waiting for that data to leak That wasn't a DDoS, that was a few million Australians trying to use a poorly implemented system.
- NamTaf 9y ago
  I thought they blamed a DDoS by unknown parties in addition to the unexpectedly high load of us all trying to access it?
  - SyneRyder 9y ago
    They tried blaming it on that, but it was just incompetence. They didn't even buy DDoS protection services. There's more details on the inside story of the Census here: https://risky.biz/censusfailupdate/ https://risky.biz/censusfailupdate/
    - lmm 9y ago
      "DDoS protection services" are a racket. Build the thing right and you don't want or need them.
      - ironic_ali 9y ago
        You haven't worked in a govt department have you. In one meeting the BA Ministry lead fell asleep and actually started snoring. In another, the ministry infrastructure architect said, "oh, that thing, I've lost the word, what is it?" - "a server?". As an ex antipodean govt contractor, I'm not even kidding. Many other stories of complete fuckwits who had no right to touch a keyboard, never mind run things. My conclusion was anyone with any smarts was completely bamboozled by the abject incompetence and left to the private sector, leaving behind the above characters. Unbelievable, but true. Saying that, don't believe me, get a job there and I see for yourself :)
        lmm 9y ago
femto 9y ago
I'd encourage Australians to submit a privacy complaint. Every chance it will be "just for laughs", but never know, it might get a coherent response. The URL with the Department of Human Services is: https://www.humanservices.gov.au/customer/contact-us/submit-complaint-or-provide-feedback-online https://www.humanservices.gov.au/customer/contact-us/submit-... If they haven't responded to your satisfaction within 30 days, you can escalate the complaint to the Office of the Australian Information Commissioner. https://www.oaic.gov.au/individuals/how-do-i-make-a-privacy-complaint https://www.oaic.gov.au/individuals/how-do-i-make-a-privacy-... In a catch-22 move, the DHS complaint form tries to get you to submit your compliant via a MyGov account, but there is a button for submitting without an account, the direct URL being: https://feedback.humanservices.gov.au/mcasite_feedback/feedback/feedbackBasePage.jsf?wec-appid=feedback&wec-locale=en_US https://feedback.humanservices.gov.au/mcasite_feedback/feedb...
- indigo0086 9y ago
  I mean, if the us can't keep its tools for hacking citizens safe, how can yours
mmjaa 9y ago
Privacy has never been a priority for the Australian government - its citizens simply don't have the right. So there really shouldn't be much surprise over this. More importantly is that this story should educate Australians as to just how much their government values their privacy - sure, this will be hailed as a reason for even more political oversight over technological processes, but only for as long as there isn't a "legitimate corporate customer" for the Australian government, itself, to negotiate with, over ownership and control of this data.
- jacques_chester 9y ago
  Australia has much stricter privacy laws than many countries, and has had them for a relatively long time (starting in 1988 and updated since). The privacy laws apply to government agencies and any non-government organisation with > $3m in turnover. https://www.oaic.gov.au/privacy-law/privacy-act/australian-privacy-principles https://www.oaic.gov.au/privacy-law/privacy-act/australian-p...
  - mmjaa 9y ago
    Cool. All I need to get around this is a <$3m shell company and a few cronies in parliament. (Until its in a Bill of Rights, its not protected. Also: see the Australian Constitution - not worth the paper its printed on)
    - jacques_chester 9y ago
      You might wish to consult a lawyer about your theories. In general, the legal opinions of non-lawyers are not worth the paper they're printed on.
wingerlang 9y ago
EDIT: Nevermind, the URL was changed my mod. --- > TWO file photos of shady hooded figures with obscured faces.. Where are these photos? I see only one of a medicare card, and another of the 'auction'.

by NamTaf 9y ago

TomMarius 9y ago

Is there at least ONE country where IT projects are successful and with a normal price tag?

yakult 9y ago
The lesson there is that people have unrealistic budget and schedule expectations of large IT projects. Same with defense, medicare, etc.
- Haydos585x2 9y ago
  I think it's just with everything. I saw a tweet once that was something like: "If you ask a programmer how long an hour will take they'll tell you 45 minutes"
  - a3n 9y ago
    That's because they only count the part that they're working on. The rest of the Hour project includes standups, testing, documentation, deployment, retrospectives and post-mortems, team happy hours, ...
    - lostboys67 9y ago
      You forgot browsing HN -)
L_226 9y ago
Estonia[0]. [0] - https://e-estonia.com/ https://e-estonia.com/
- TomMarius 9y ago
  I actually own the e-residency card, but forgot about the country. :-D

JimmyAustin 9y ago

This is just as likely to be a rogue employee/sysadmin as it is a actual hack. I wouldn't start placing blame until it's determined what the actual cause is.

duncan_bayne 9y ago
Some blame can be placed up-front, at least potentially. Regardless of the _nature_ of the breach, if the data ought not to have been stored, the fault lies with those who decided to store it.
stubish 9y ago
If it is an employee or sysadmin, they are an idiot. Its $30 a pop for small volume and large risk. If you have a job with access to this data you should be charging a hell of a lot more. But its enough to get someone in a poorer country with little at risk to create a fake gmail account and use it to bootstrap access to an online self service portal or whatever approach they are using.
- iamben 9y ago
  Indeed. Assuming they have some kind of logs for legitimate use in place (X was logged in and requested X), how hard would it be to add a bogus record, request it and see who looks it up. If it's accessed and the logs are avoided, there's probably something leaky. Assumption is a dangerous thing, however...
- jacques_chester 9y ago
  > If it is an employee or sysadmin, they are an idiot. Its $30 a pop for small volume and large risk In this scenario, I expect a bad egg would've sold the records in bulk to a middleman for a high price.

ajdlinux 9y ago

My guess, based on what's publicly available, is that this incident is quite possibly just a set of stolen or misused creds for a fairly widely available Medicare card lookup database used by doctors. In which case, this is less of a "cyber security" issue and more an issue with fundamental system design/requirements. But we'll see.

nomercy400 9y ago
One way to avoid this would be to limit the access of a doctor to patient records. Unless you give permission at a doctor/hospital to have them access your record, they won't be able to do a lookup. Retract the permission automatically/renew it once every X months. This would make stolen/misused creds a much smaller risk.
- yorwba 9y ago
  This runs into problems when the patient can't give permission e.g. because they are unconscious.
  - rwmj 9y ago
    This is a problem that can be solved in a low tech way using a medical bracelet / necklace for patients who have chronic diseases that doctors might need to know about.
    - killjoywashere 9y ago
      Somebody with sickle cell disease or otherwise transfusion dependent greatly benefits from electronic records, which help minimize antibody reactions (not just ABO and Rh, but Duffy, Kell, Kidd, MNS, etc)
- ajdlinux 9y ago
  So, this isn't access to patient records as such - it's merely access from a name to a Medicare number. Additionally, how exactly are you going to get the patient to give permission beforehand? Patients will expect to walk into a medical clinic, hand over their card, and have it all just work.

L_226 9y ago

> We had the famous census night access issues due to a DDoS and I am just waiting for that data to leak That wasn't a DDoS, that was a few million Australians trying to use a poorly implemented system.

NamTaf 9y ago
I thought they blamed a DDoS by unknown parties in addition to the unexpectedly high load of us all trying to access it?
- SyneRyder 9y ago
  They tried blaming it on that, but it was just incompetence. They didn't even buy DDoS protection services. There's more details on the inside story of the Census here: https://risky.biz/censusfailupdate/ https://risky.biz/censusfailupdate/
  - lmm 9y ago
    "DDoS protection services" are a racket. Build the thing right and you don't want or need them.
    - ironic_ali 9y ago
      You haven't worked in a govt department have you. In one meeting the BA Ministry lead fell asleep and actually started snoring. In another, the ministry infrastructure architect said, "oh, that thing, I've lost the word, what is it?" - "a server?". As an ex antipodean govt contractor, I'm not even kidding. Many other stories of complete fuckwits who had no right to touch a keyboard, never mind run things. My conclusion was anyone with any smarts was completely bamboozled by the abject incompetence and left to the private sector, leaving behind the above characters. Unbelievable, but true. Saying that, don't believe me, get a job there and I see for yourself :)
      - lmm 9y ago

femto 9y ago

I'd encourage Australians to submit a privacy complaint. Every chance it will be "just for laughs", but never know, it might get a coherent response. The URL with the Department of Human Services is: https://www.humanservices.gov.au/customer/contact-us/submit-complaint-or-provide-feedback-online https://www.humanservices.gov.au/customer/contact-us/submit-... If they haven't responded to your satisfaction within 30 days, you can escalate the complaint to the Office of the Australian Information Commissioner. https://www.oaic.gov.au/individuals/how-do-i-make-a-privacy-complaint https://www.oaic.gov.au/individuals/how-do-i-make-a-privacy-... In a catch-22 move, the DHS complaint form tries to get you to submit your compliant via a MyGov account, but there is a button for submitting without an account, the direct URL being: https://feedback.humanservices.gov.au/mcasite_feedback/feedback/feedbackBasePage.jsf?wec-appid=feedback&wec-locale=en_US https://feedback.humanservices.gov.au/mcasite_feedback/feedb...

indigo0086 9y ago
I mean, if the us can't keep its tools for hacking citizens safe, how can yours

mmjaa 9y ago

Privacy has never been a priority for the Australian government - its citizens simply don't have the right. So there really shouldn't be much surprise over this. More importantly is that this story should educate Australians as to just how much their government values their privacy - sure, this will be hailed as a reason for even more political oversight over technological processes, but only for as long as there isn't a "legitimate corporate customer" for the Australian government, itself, to negotiate with, over ownership and control of this data.

jacques_chester 9y ago
Australia has much stricter privacy laws than many countries, and has had them for a relatively long time (starting in 1988 and updated since). The privacy laws apply to government agencies and any non-government organisation with > $3m in turnover. https://www.oaic.gov.au/privacy-law/privacy-act/australian-privacy-principles https://www.oaic.gov.au/privacy-law/privacy-act/australian-p...
- mmjaa 9y ago
  Cool. All I need to get around this is a <$3m shell company and a few cronies in parliament. (Until its in a Bill of Rights, its not protected. Also: see the Australian Constitution - not worth the paper its printed on)
  - jacques_chester 9y ago
    You might wish to consult a lawyer about your theories. In general, the legal opinions of non-lawyers are not worth the paper they're printed on.

wingerlang 9y ago

EDIT: Nevermind, the URL was changed my mod. --- > TWO file photos of shady hooded figures with obscured faces.. Where are these photos? I see only one of a medicare card, and another of the 'auction'.