11 ms·

Setting aside the release of this information, why was anyone able to get ahold of it? That's where the responsibility (and breach of public trust) starts.

blhack 15y ago
Some of my friends work for Phoenix DPS. According to them, their "IT Department" (in quotes because according to them they don't really have an IT dept.) is...horrifyingly incompetent. Like really, really bad.
- sunchild 15y ago
  Like "negligent" bad?
  - jordan0day 15y ago
    It might depend on your definition of negligent. Imagine building out a city, streets, alleyways, highways, etc. The imagine paying one guy to put up all the street signs, paint the lanes on the roads and highways, tow broken down cars, and handle street cleaning duties. When a wreck happens because a particular intersection was missing stop signs, would you consider that one guy negligent?
    - Andrew_Quentin 15y ago
      Yup. Him or her and his/her employer. That is according to the law. Negligence is merely falling below the standard of the reasonably competent sign poster/programmer/doctor/ etc.
      - jordan0day 15y ago
        That's my point -- a single reasonably competent sign poster couldn't be expected to handle the duties for an entire city. The responsibilities placed upon the sign poster in my example went way above and beyond anything reasonable. I'm not trying to defend the IT folks who do a terrible job of security for municipal/state governments, but in my experience there's a lot more work to be done than resources provided to do it.
  - flyt 15y ago
    probably "like every understaffed, underbudgeted IT department in the world" bad
- joshmlewis 15y ago
  The smaller town where I live is the same way. Most government agencies like this are way behind in the tech world unless the city pours a lot of money into making it better. Otherwise, there really is no IT staff except the "county" staff that cover several departments. I could be wrong, but that's how it goes in smaller towns.
- woodall 15y ago
  Called my local Sheriffs department about an sql injection in their prisoner look up system. He is actually an on duty police office who just does the work because others cannot. I feel sorry for them as the application in question is used by many departments across the nation. They did take the site offline; hopefully for a fix.
astrodust 15y ago
Sharepoint is going to be the end of us all. It's always just jammed full of juicy stuff like this.
- woodall 15y ago
  Not just SharePoint. Crawling a machine for special files is pretty simple. Here is a little script I used for a while. Could be modified to look for file headers(more specific) but who is going to change a .doc to a .pdf for security reasons? #!/usr/bin/python import os,shutil exts = [".txt",".doc",".docx",".xls",".xlsx",".ppt",".pptx"] startpath = os.environ['HOMEDRIVE'] def find(none, directory, filenames): for file in filenames: for ext in exts: if file.endswith(ext): fullfile = os.path.join(directory,file) try: shutil.copy(fullfile,file) except IOError: pass # access denied os.path.walk(startpath,find, None)
  - mikle 15y ago
    So how many law enforcement agencies have the Python interpreter installed on their machine? Of course you can always py2exe this, write it in C/C++ (/C#). Hacking is easy, it just takes time and dedication.
    - woodall 15y ago
      >you can always py2exe That's exactly what I did! You can do the same through cmd, but most machines do not have permissions for that.

blhack 15y ago

Some of my friends work for Phoenix DPS. According to them, their "IT Department" (in quotes because according to them they don't really have an IT dept.) is...horrifyingly incompetent. Like really, really bad.

sunchild 15y ago
Like "negligent" bad?
- jordan0day 15y ago
  It might depend on your definition of negligent. Imagine building out a city, streets, alleyways, highways, etc. The imagine paying one guy to put up all the street signs, paint the lanes on the roads and highways, tow broken down cars, and handle street cleaning duties. When a wreck happens because a particular intersection was missing stop signs, would you consider that one guy negligent?
  - Andrew_Quentin 15y ago
    Yup. Him or her and his/her employer. That is according to the law. Negligence is merely falling below the standard of the reasonably competent sign poster/programmer/doctor/ etc.
    - jordan0day 15y ago
      That's my point -- a single reasonably competent sign poster couldn't be expected to handle the duties for an entire city. The responsibilities placed upon the sign poster in my example went way above and beyond anything reasonable. I'm not trying to defend the IT folks who do a terrible job of security for municipal/state governments, but in my experience there's a lot more work to be done than resources provided to do it.
- flyt 15y ago
  probably "like every understaffed, underbudgeted IT department in the world" bad
joshmlewis 15y ago
The smaller town where I live is the same way. Most government agencies like this are way behind in the tech world unless the city pours a lot of money into making it better. Otherwise, there really is no IT staff except the "county" staff that cover several departments. I could be wrong, but that's how it goes in smaller towns.
woodall 15y ago
Called my local Sheriffs department about an sql injection in their prisoner look up system. He is actually an on duty police office who just does the work because others cannot. I feel sorry for them as the application in question is used by many departments across the nation. They did take the site offline; hopefully for a fix.

astrodust 15y ago

Sharepoint is going to be the end of us all. It's always just jammed full of juicy stuff like this.

woodall 15y ago
Not just SharePoint. Crawling a machine for special files is pretty simple. Here is a little script I used for a while. Could be modified to look for file headers(more specific) but who is going to change a .doc to a .pdf for security reasons? #!/usr/bin/python import os,shutil exts = [".txt",".doc",".docx",".xls",".xlsx",".ppt",".pptx"] startpath = os.environ['HOMEDRIVE'] def find(none, directory, filenames): for file in filenames: for ext in exts: if file.endswith(ext): fullfile = os.path.join(directory,file) try: shutil.copy(fullfile,file) except IOError: pass # access denied os.path.walk(startpath,find, None)
- mikle 15y ago
  So how many law enforcement agencies have the Python interpreter installed on their machine? Of course you can always py2exe this, write it in C/C++ (/C#). Hacking is easy, it just takes time and dedication.
  - woodall 15y ago
    >you can always py2exe That's exactly what I did! You can do the same through cmd, but most machines do not have permissions for that.