7 ms·
Australian Government’s Bureau of Meteorology Can’t Do HTTPS
- iveqy 6y agoso what are we afraid of here? That a MiM attack would give us the wrong weather data?
- KnightHawk3 6y agohttps://www.abc.net.au/news/2016-10-12/bureau-of-meteorology-bom-cyber-hacked-by-foreign-spies/7923770 https://www.abc.net.au/news/2016-10-12/bureau-of-meteorology... "Bureau of Meteorology hacked by foreign spies in massive malware attack, report shows" Clearly someone has an interest in targeting it - who knows if HTTPS would actually mitigate the risks though. Doubt it would hurt and would not be that difficult. It shows the lack of maintaince in BOM that leads to events like this.
- oaiey 6y agoWhich again might be a reason why their upgrade from a old (hackable) OpenSSL to a newer version with limited budget might take a longer while. And the short term fix: Let us do only HTTP. Just an educated guess ;)
- umanwizard 6y agoMore realistically: inject shady/spammy ads, or malware.
- ratww 6y agoAlso cause DDoS on third-party websites, as seen here: https://arstechnica.com/information-technology/2015/04/ddos-attacks-that-crippled-github-linked-to-great-firewall-of-china/ https://arstechnica.com/information-technology/2015/04/ddos-...
- deleted 6y ago[deleted]
- imglorp 6y agoMaybe, given their thirst for domestic surveillance, the govt demands an mitm feed and they can't provide it as easily.
- KineticLensman 6y agoWell, it might be indicative of wider issues with keeping their systems / data up to date, or the wider govt IT infrastructures that support them. If they are getting this wrong, what other problems are there, in the Met Bureau or across Govt IT. I'm reminded of the COVID reporting fiasco we had in the UK in October [0] where Public Health England - an agency of the NHS - lost COVID data because they were using .xls files to log data rather than .xlsx - the former was silently truncating critical datasets because of a hard row limit. The .xlsx format first appeared in 2007, so the NHS have only had 13 years to get their act together. [0] https://www.theregister.com/2020/10/05/excel_england_coronavirus_contact_error/ https://www.theregister.com/2020/10/05/excel_england_coronav...
- spacemanmatt 6y agoI wish people would stop downplaying security, as if it took attention from an individual at a malicious agency to screw up your digital life.
- globular-toast 6y agoAt first I clicked and thought, so what? Then I got it and had a good chuckle. Edit: looks like most readers don't get it either...
- nickthemagicman 6y agoI didn't get it what am I missing?
- petrosagg 6y agoThe OP link is over https, which appears to work fine but only for redirecting you back to http
- globular-toast 6y agoCheck the output from curl. HTTPS is working but is merely redirecting to a page saying HTTPS is not working. $ curl -v https://www.bom.gov.au/ * Trying 104.78.177.116... * TCP_NODELAY set * Connected to www.bom.gov.au (104.78.177.116) port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/certs/ca-certificates.crt CApath: /etc/ssl/certs * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Client hello (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 * ALPN, server accepted to use http/1.1 * Server certificate: * subject: C=AU; ST=VIC; L=Docklands; O=Bureau of Meteorology; CN=*.bom.gov.au * start date: Jun 10 00:00:00 2020 GMT * expire date: Sep 9 12:00:00 2021 GMT * subjectAltName: host "www.bom.gov.au" matched cert's "*.bom.gov.au" * issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=GeoTrust RSA CA 2018 * SSL certificate verify ok. > GET / HTTP/1.1 > Host: www.bom.gov.au > User-Agent: curl/7.58.0 > Accept: */* > < HTTP/1.1 307 Temporary Redirect < Server: AkamaiGHost < Content-Length: 0 < Location: http://www.bom.gov.au/akamai/https-redirect.html < Date: Wed, 02 Dec 2020 13:03:03 GMT < Connection: keep-alive < Server-Timing: cdn-cache; desc=HIT < Server-Timing: edge; dur=1 < * Connection #0 to host www.bom.gov.au left intact
- adrian_mrd 6y ago> “The Bureau of Meteorology (BoM) has been undertaking what it has called a comprehensive rebuild of its IT systems and related business processes and applications, focused on addressing security and resilience risks. ... The component operations contract is expected to start December this year and run through June 2022.” [1] Now that it’s December, time to get moving BoM! [1] https://www.zdnet.com/article/bom-seeks-robust-cloud-and-wan-partner-for-it-overhaul-project/ https://www.zdnet.com/article/bom-seeks-robust-cloud-and-wan...
- baybal2 6y agoWow, 1 year "IT Project" to get a single certificate??? Wait, the do have a correct cert on port 443... some fool play is happening!!!
- Gustomaximus 6y agoThey seem to need some help around IT, the new-ish Android BOM app is basically a list of people saying 'we prefer the old one' Someone approved a shiny new design but functionality is more inefficient now.
- fabioborellini 6y agoWhy is there /akamai/ in the first redirection target URL? Isn't Akamai, the company, already infamous for blocking deployment of TLS?
- ratww 6y agoGood question. No idea why it was downvoted. They seem to be behind Akamai. Their current https server at https://www.bom.gov.au https://www.bom.gov.au returns AkamaiGHost in the Server Header: HTTP/1.1 307 Temporary Redirect Server: AkamaiGHost Content-Length: 0 Location: http://www.bom.gov.au/akamai/https-redirect.html Date: Wed, 02 Dec 2020 12:23:22 GMT Connection: keep-alive Server-Timing: cdn-cache; desc=HIT Server-Timing: edge; dur=1 Also their IP address (for me 104.108.145.63) belongs to Akamai: NetRange: 104.64.0.0 - 104.127.255.255 CIDR: 104.64.0.0/10 NetName: AKAMAI NetHandle: NET-104-64-0-0-1 Parent: NET104 (NET-104-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Akamai Technologies, Inc. (AKAMAI)
- mytailorisrich 6y agoIt probably takes as much time to have one of their engineers implement that notice page as it does to enable https...
- bonzini 6y agoUnlikely. They probably run on something too old to support TLS 1.2. Since modern browsers generally refuse to use TLS 1.0/1.1 unless an option is set manually in the configuration to do so, it would be an even worse experience for their users if they switched to https.
- giantDinosaur 6y agoWhy wouldn't you at least just reverse proxy the popular pages or hell, put them on S3 or something? The ones checked by the general public, at least, could be statically generated and stored in s3 with a simple schedule!
- ratww 6y agoThis is incorrect. They already have an HTTPS server that supports TLS 1.2, it's just being used to redirect to their HTTP server. This is verifiable by typing `curl -v https://www.bom.gov.au/ https://www.bom.gov.au/` in your terminal.
- cesarb 6y agoIt's not the same server. A "curl --head https://www.bom.gov.au/ https://www.bom.gov.au/" answers with "Server: AkamaiGHost", while "curl --head http://www.bom.gov.au/ http://www.bom.gov.au/" answers with "Server: Apache".
- mytailorisrich 6y agoThat does not seem to be the issue as others have commented. In large organisations technical issues are often not the blocker. Process, approval chain, etc. often are.
- 6y ago
- philshem 6y agoAnother one: the Italian Health Ministry doesn’t support https. http://www.salute.gov.it/ http://www.salute.gov.it/
- eecc 6y agoWell, I’m on mobile so I can’t check but does the website run JavaScript? Third parties could inject malicious code with little difficulty
- deleted 6y ago[deleted]
- posix_me_less 6y agoBetter than "can't do HTTP" which seems to get more common every year. I prefer this kind of info site being HTTP-only to being HTTPS-only. HTTPS causes occasional problems with certificates and some people can't use HTTPS.
- ben_w 6y ago> some people can't use HTTPS This is surprising, can you go into more depth?
- coddle-hark 6y agoI guess if you don’t have direct internet access then sniffing wifi traffic at the local coffee shop might be the only way to get weather updates.
- sgt 6y agoOne example would be running a client on hardware not capable of performing encryption fast enough. I think would be particularly relevant to web browsers on Amiga.
- mnw21cam 6y agoTo be honest, the decryption burden is fairly small compared to the layout burden. I don't think this is much of an excuse.
- propelol 6y agoIs encryption banned in Australia, or is it non-encrypted so they don't need to add backdoors?
- dwd 6y agoThey can't do mobile friendly either, which is a pain when you're trying to determine how quickly a storm is moving in on your phone.
- sundvor 6y agohttps://weather.bom.gov.au/onboarding https://weather.bom.gov.au/onboarding - funnily enough this is both easier to read on mobile AND supports HTTPS.
- dwd 6y agoThanks for the link - do they actually promote that anywhere as it's perfect on a mobile. The rain radar map seamlessly combining radars is awesome.
- sundvor 6y agoThanks! I can't even remember how I found it originally - however I found it again by searching "bom mobile site". There's no mention of it on their main site at all.
- cm2187 6y agoThey probably don’t have the budget for a certificate!
- bonzini 6y agoMore likely that the machine running the HTTP server doesn't support TLS 1.2. The landing page would be on some kind of proxy that isn't able to access the database.
- maratc 6y agoThe connection to https://www.bom.gov.au/ https://www.bom.gov.au/ is done over TLS1.2 and they DO have a certificate.
- bonzini 6y agoBut the HTTP and the HTTPS page are not served by the same server: https://news.ycombinator.com/item?id=25275816 https://news.ycombinator.com/item?id=25275816
- MrStonedOne 6y agohttps://reg.bom.gov.au/cgi-bin/reg/reg_login.cgi https://reg.bom.gov.au/cgi-bin/reg/reg_login.cgi works fine here.
- laurensr 6y agoWhat's remarkable here is that they do serve a valid certificate: https://www.ssllabs.com/ssltest/analyze.html?d=www.bom.gov.au&latest https://www.ssllabs.com/ssltest/analyze.html?d=www.bom.gov.a... That's a different situation to that of the Italian Health Ministry mentioned in another comment.
- mwcampbell 6y agoIs calling out a random government agency for not meeting our standards really the best use of the HN front page?
- LittlePeter 6y agoIsn't this what the voting is for? If it weren't interesting for the front page, it wouldn't be there, no?
- mwcampbell 6y agoI think it's kind of mean for us to find this story interesting. If I merely found it uninteresting, I wouldn't have commented.
- globular-toast 6y agoIt's not calling them out, it's meant to be humorous but unfortunately the joke seems to be lost on everyone.
- contingencies 6y agoI was informed in the late noughties, first hand by the author, that their entire climate model covering all Australian territories and airspace to a high altitude ran once every few seconds as a single SQL stored procedure.
- spacemanmatt 6y agoI just recently got my company's moneymaker app into HTTPS, and it was no small feat. So much totally screwed up browser automation (read: DOM/JS interaction) and ad-hoc URL construction kept disrupting the HTTPS experience by attempting to redirect or fetch HTTP. I did have the certificate and reverse proxy ready to go a full 18 months before I could finish the app migration. Someone previous developer was REALLY against relative URLs. "http://".$host.$urlPath http://".$host.$urlPath everywhere.
- spacemanmatt 6y ago...there is still a tiny bit of cleartext access, because some clients have URLs embedded in spreadsheets and support would rather not hear from all of them at once.
- crashbunny 6y agoA few years ago if you typed bom.gov.au in your address bar it wouldn't load. You'd have to type www.bom.gov.au . It took them many years to add the redirect. It's long over due for an overhaul. I'm glad to hear it has already started.