7 ms·

Coding Flaw Exposes Voter Details for 6.5M Israelis

102 points by awb 7y ago

Aaronstotle 7y ago
Ironic given the amount of cyber-security companies/startups in Israel.
- ozkatz 7y ago
  While there's a lot of security firepower in Israel, talent tends to gravitate towards high paying and/or technologically interesting companies. a consulting firm developing one-off mobile apps used by political parties can offer neither (see the recent Iowa caucuses debacle)
  - bsaul 7y ago
    i'm sorry but the person who had the idea of exposing an api endpoint to get admin user and password in cleartext (and for something related to politics above that) hasn't ever set foot in a computer science class. The level of incompetence required to commit such a fault is beyond what i would expect from any "third world" country. So, the fact that it happened in a country that advertize itself as a startup nation, and is exposed to one of the highest level of terrorist threat in the world is beyond my comprehension. If i were israeli i would recognize this event as one of the most damaging one of the last decade in term of public image. Israel has a huge flourishing business related to cybersecurity, mostly based on the reputation the country has for having the best specialists. If you know anything about business, you know how much image is important, and how this issue should be treated as a PR disaster for the whole country.
    - deepspace 7y ago
      Agree, but I am going to make a prediction about what will happen to the executives of the company responsible for releasing this atrocious API. Absolutely nothing. They are going to continue to operate with nothing more than a slap on the wrist at worst. And that is why applications dealing with sensitive data are still being produced by people with no clue about security. Because there are never any consequences for leaking sensitive data, there is zero incentive for companies to spend the money on hiring competent developers.
    - techslave 7y ago
      the person? the level of process incompetence that would allow such a defect beggars belief. my vote is that this was intentional.
    - vkou 7y ago
      > i'm sorry but the person who had the idea of exposing an api endpoint to get admin user and password in cleartext (and for something related to politics above that) hasn't ever set foot in a computer science class. I've set foot in ~20 computing science classes, out of a ~134 credit-hour degree, and only one optional class ever mentioned that this sort of thing would be a bad idea. It also didn't actually rigorously teach best practices, only mentioned a laundry list of security blunders that you probably want to avoid, without proscribing any solutions. We also were not tested on this. And this degree wasn't in some middle-of-nowhere community college. Also, as anyone who has ever set foot in a computer science class ought to know, these kinds of failures aren't the fault of any one person. One person may be undereducated, ignorant, lazy, stupid, or just in a hurry to ship. It's the entire organization's responsibility to provide checks and balances that prevent this sort of thing from hitting production.
    - theflyinghorse 7y ago
      > ... but the person who had the idea of exposing an api endpoint to get admin user and password in cleartext .... I'd be hesitant to call out one person. A process failed. Where were the code reviews, design sessions, pentesters, QA, UAT, automated tests?
      - bsaul 7y ago
        in some cases no particular individual are able to see something's wrong, and only someone with a general overview of the system can see the pb. in this case, every single individual in the chain ( from backend dev to frontend dev to tester to enduser) are able to see that something's very wrong. Which means none of those people are competent. Not any of them.
- jkol- 7y ago
  As above poster noted, best talent isn't flocking to work for the bureaucratic arms of the govt. In fact I'd venture as far to say that a large portion of the Israeli population has a very negative view of the government itself.
  - untog 7y ago
    It's a self-fulfilling prophecy we see a lot in the US as well. Underfund the government, they become inefficient, use that inefficiency as the reason for cutting funding yet again because everyone is sick of the inefficiency.
    - zentiggr 7y ago
      And then there are the stories of the agency director that budgeted $50,000 for his own office renovation. Just his own, not the whole Office.
    - clumsysmurf 7y ago
      Known as "starving the beast" https://rationalwiki.org/wiki/Starve_the_beast https://rationalwiki.org/wiki/Starve_the_beast
dang 7y ago
Discussed yesterday: https://news.ycombinator.com/item?id=22286925 https://news.ycombinator.com/item?id=22286925 It seems this submission has new technical details, so we won't treat it as a dupe.
tcd 7y ago
I often wonder if we, as humans during this era, are really at the primitive end of the introduction of computers and big data. We're still incredibly new to the concept of storing PB's of easily searchable and accessible data, and can be accessed at the speed of light. At the same time, exposing this can do real human harm, depending on the motives (for example, Cambridge Analytica). I wonder what the next 100, 500 years will look like, after all this has 'settled' down. We're seeing this today with facial recognition and machine learning - new concepts today that will grow old with time. I wish I was capable of seeing all of this 'big tech' in that time to see how it matures. To say we have a long way to go is an understatement. Breaches like this should be impossible as there should be designs against it.
- fredley 7y ago
  I wonder if, or when computing will be superceded as the main driver of innovation. In 1950 computers existed but you couldn't have guessed that computation and the innovations derived from it would eat the World. What exists today that will transform the World again?
- vincentmarle 7y ago
  > I wonder what the next 100, 500 years will look like, after all this has 'settled' down. > Breaches like this should be impossible as there should be designs against it. I see it the other way around. Privacy is equal to security, it is only as strong as its weakest link, and there are many many “links” (attack vectors) and the amount of data you can breach with asymmetric attacks is unprecedented. By way of ergodicity, everything’s going to be leaked eventually, no matter how good our intentions are to protect it. If you take everything to its logical conclusion, it is inevitable that the concept of privacy is going to be absolutely destroyed in the future, and everyone will know everything about everyone at all times. The latest privacy laws are futile attempts to put the finger in the dike before it explodes; too little, too late.
  - PavlovsCat 7y ago
    IMO the logical conclusion of current trend is people don't knowing each other, themselves, or what's in front of them. At first I wanted to add that some elites know everything about the majority, while being opaque to them, but on second thought that's utterly irrelevant in light of the fact that even the elite of the elite won't know their asses from their elbows. We'll die of thirst in an ocean of data, for want of information.
cryptozeus 7y ago
"Embedded in the code was a file path labelled "get-admin-users." He simply copied and pasted that back into the URL bar, and then suddenly saw a list of admins, including their usernames and passwords." Its almost like you were asking for it. I dont even keep plain text password on my local machine.
- willis936 7y ago
  Why would anyone? The riskiest place I would keep passwords is in an encrypted archive. Barring unknown side channel attacks, my brain is less secure than that.
- ericmcer 7y ago
  How is that even possible? Beyond storing passwords unencrypted anywhere, why would you make a specific endpoint to return them. It feels suspicious that someone could be capable of building this app (requires some level of knowledge) and creating a publicly exposed endpoint that is almost designed for malicious purposes.
  - ThePhysicist 7y ago
    Maybe something that was quickly coded up in the beginning to allow testing by team members and later forgotten. Happens all the time, that’s why you do code review and have at least two people approve changes to master.
  - LinuxBender 7y ago
    Perhaps plausible deniability around selling data? If you outright sell data, that is illegal, but if your app "leaks" data maybe it is harder to prove malfeasance and instead say "negligence"? I am obviously not a lawyer and certainly don't know the laws of Israel. Does what I described ever happen?
    - awb 7y ago
      I'm not sure how you'd monitize publicly leaked data. If they accepted money for access to the data, then that's selling data. I don't think that happened here though.
AzzieElbab 7y ago
Maybe the international body of politicians will finally realize that while anyone can write a website, not everyone should, and certainly not their nieces and nephews
jacinda 7y ago
Relevant: https://xkcd.com/2030/ https://xkcd.com/2030/
- RHSeeger 7y ago
  > our entire field is bad at what we do I tend to think that if - everyone had access to military grade weaponry, and - their actions were close to anonymous, and - it was so obvious they were killing people by acting then a lot more planes and elevators would be a lot less safe. I think plane and elevator technology has had a long time to becomes more robust, and there's a lot less players in the field, with a lot more regulations, and a LOT less people actively trying to sabotage them. All things being equal, I don't think the people designing them are much more skilled than the people writing software for some of the better firms.
onyva 7y ago
“Startup Nation”. As any Israeli would tell you, that’s a joke.

102 points by awb 7y ago

Aaronstotle 7y ago

Ironic given the amount of cyber-security companies/startups in Israel.

ozkatz 7y ago
While there's a lot of security firepower in Israel, talent tends to gravitate towards high paying and/or technologically interesting companies. a consulting firm developing one-off mobile apps used by political parties can offer neither (see the recent Iowa caucuses debacle)
- bsaul 7y ago
  i'm sorry but the person who had the idea of exposing an api endpoint to get admin user and password in cleartext (and for something related to politics above that) hasn't ever set foot in a computer science class. The level of incompetence required to commit such a fault is beyond what i would expect from any "third world" country. So, the fact that it happened in a country that advertize itself as a startup nation, and is exposed to one of the highest level of terrorist threat in the world is beyond my comprehension. If i were israeli i would recognize this event as one of the most damaging one of the last decade in term of public image. Israel has a huge flourishing business related to cybersecurity, mostly based on the reputation the country has for having the best specialists. If you know anything about business, you know how much image is important, and how this issue should be treated as a PR disaster for the whole country.
  - deepspace 7y ago
    Agree, but I am going to make a prediction about what will happen to the executives of the company responsible for releasing this atrocious API. Absolutely nothing. They are going to continue to operate with nothing more than a slap on the wrist at worst. And that is why applications dealing with sensitive data are still being produced by people with no clue about security. Because there are never any consequences for leaking sensitive data, there is zero incentive for companies to spend the money on hiring competent developers.
  - techslave 7y ago
    the person? the level of process incompetence that would allow such a defect beggars belief. my vote is that this was intentional.
  - vkou 7y ago
    > i'm sorry but the person who had the idea of exposing an api endpoint to get admin user and password in cleartext (and for something related to politics above that) hasn't ever set foot in a computer science class. I've set foot in ~20 computing science classes, out of a ~134 credit-hour degree, and only one optional class ever mentioned that this sort of thing would be a bad idea. It also didn't actually rigorously teach best practices, only mentioned a laundry list of security blunders that you probably want to avoid, without proscribing any solutions. We also were not tested on this. And this degree wasn't in some middle-of-nowhere community college. Also, as anyone who has ever set foot in a computer science class ought to know, these kinds of failures aren't the fault of any one person. One person may be undereducated, ignorant, lazy, stupid, or just in a hurry to ship. It's the entire organization's responsibility to provide checks and balances that prevent this sort of thing from hitting production.
  - theflyinghorse 7y ago
    > ... but the person who had the idea of exposing an api endpoint to get admin user and password in cleartext .... I'd be hesitant to call out one person. A process failed. Where were the code reviews, design sessions, pentesters, QA, UAT, automated tests?
    - bsaul 7y ago
      in some cases no particular individual are able to see something's wrong, and only someone with a general overview of the system can see the pb. in this case, every single individual in the chain ( from backend dev to frontend dev to tester to enduser) are able to see that something's very wrong. Which means none of those people are competent. Not any of them.
jkol- 7y ago
As above poster noted, best talent isn't flocking to work for the bureaucratic arms of the govt. In fact I'd venture as far to say that a large portion of the Israeli population has a very negative view of the government itself.
- untog 7y ago
  It's a self-fulfilling prophecy we see a lot in the US as well. Underfund the government, they become inefficient, use that inefficiency as the reason for cutting funding yet again because everyone is sick of the inefficiency.
  - zentiggr 7y ago
    And then there are the stories of the agency director that budgeted $50,000 for his own office renovation. Just his own, not the whole Office.
  - clumsysmurf 7y ago
    Known as "starving the beast" https://rationalwiki.org/wiki/Starve_the_beast https://rationalwiki.org/wiki/Starve_the_beast

dang 7y ago

Discussed yesterday: https://news.ycombinator.com/item?id=22286925 https://news.ycombinator.com/item?id=22286925 It seems this submission has new technical details, so we won't treat it as a dupe.

tcd 7y ago

I often wonder if we, as humans during this era, are really at the primitive end of the introduction of computers and big data. We're still incredibly new to the concept of storing PB's of easily searchable and accessible data, and can be accessed at the speed of light. At the same time, exposing this can do real human harm, depending on the motives (for example, Cambridge Analytica). I wonder what the next 100, 500 years will look like, after all this has 'settled' down. We're seeing this today with facial recognition and machine learning - new concepts today that will grow old with time. I wish I was capable of seeing all of this 'big tech' in that time to see how it matures. To say we have a long way to go is an understatement. Breaches like this should be impossible as there should be designs against it.

fredley 7y ago
I wonder if, or when computing will be superceded as the main driver of innovation. In 1950 computers existed but you couldn't have guessed that computation and the innovations derived from it would eat the World. What exists today that will transform the World again?
vincentmarle 7y ago
> I wonder what the next 100, 500 years will look like, after all this has 'settled' down. > Breaches like this should be impossible as there should be designs against it. I see it the other way around. Privacy is equal to security, it is only as strong as its weakest link, and there are many many “links” (attack vectors) and the amount of data you can breach with asymmetric attacks is unprecedented. By way of ergodicity, everything’s going to be leaked eventually, no matter how good our intentions are to protect it. If you take everything to its logical conclusion, it is inevitable that the concept of privacy is going to be absolutely destroyed in the future, and everyone will know everything about everyone at all times. The latest privacy laws are futile attempts to put the finger in the dike before it explodes; too little, too late.
- PavlovsCat 7y ago
  IMO the logical conclusion of current trend is people don't knowing each other, themselves, or what's in front of them. At first I wanted to add that some elites know everything about the majority, while being opaque to them, but on second thought that's utterly irrelevant in light of the fact that even the elite of the elite won't know their asses from their elbows. We'll die of thirst in an ocean of data, for want of information.

cryptozeus 7y ago

"Embedded in the code was a file path labelled "get-admin-users." He simply copied and pasted that back into the URL bar, and then suddenly saw a list of admins, including their usernames and passwords." Its almost like you were asking for it. I dont even keep plain text password on my local machine.

willis936 7y ago
Why would anyone? The riskiest place I would keep passwords is in an encrypted archive. Barring unknown side channel attacks, my brain is less secure than that.
ericmcer 7y ago
How is that even possible? Beyond storing passwords unencrypted anywhere, why would you make a specific endpoint to return them. It feels suspicious that someone could be capable of building this app (requires some level of knowledge) and creating a publicly exposed endpoint that is almost designed for malicious purposes.
- ThePhysicist 7y ago
  Maybe something that was quickly coded up in the beginning to allow testing by team members and later forgotten. Happens all the time, that’s why you do code review and have at least two people approve changes to master.
- LinuxBender 7y ago
  Perhaps plausible deniability around selling data? If you outright sell data, that is illegal, but if your app "leaks" data maybe it is harder to prove malfeasance and instead say "negligence"? I am obviously not a lawyer and certainly don't know the laws of Israel. Does what I described ever happen?
  - awb 7y ago
    I'm not sure how you'd monitize publicly leaked data. If they accepted money for access to the data, then that's selling data. I don't think that happened here though.

AzzieElbab 7y ago

Maybe the international body of politicians will finally realize that while anyone can write a website, not everyone should, and certainly not their nieces and nephews

jacinda 7y ago

Relevant: https://xkcd.com/2030/ https://xkcd.com/2030/

RHSeeger 7y ago
> our entire field is bad at what we do I tend to think that if - everyone had access to military grade weaponry, and - their actions were close to anonymous, and - it was so obvious they were killing people by acting then a lot more planes and elevators would be a lot less safe. I think plane and elevator technology has had a long time to becomes more robust, and there's a lot less players in the field, with a lot more regulations, and a LOT less people actively trying to sabotage them. All things being equal, I don't think the people designing them are much more skilled than the people writing software for some of the better firms.

onyva 7y ago

“Startup Nation”. As any Israeli would tell you, that’s a joke.