36 ms·
Governor vows criminal prosecution of reporter who found flaw in state website
- unethical_ban 5y agoI wish that a conservative outlet would call the governor out. I feel like a thousand articles from Wired, NPR, the New York Times, and the founder of the WWW could all describe in wonderful, simple terms how bombastic and willfully ignorant and hostile this action is, and it would be construed as partisan.
- 1270018080 5y agoI'm from Missouri, this might be the first embarrassment many of you've seen from him, but there have been alot more prior. Truly not a good look for the state that this guy got reelected.
- mcguire 5y agoAside from everything else, "According to the Post-Dispatch, one of its reporters discovered the flaw in a web application allowing the public to search teacher certifications and credentials. No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages." I expect there will be no consequences for the mindless idiot who put SSNs in the HTML output.
- Johnny555 5y ago“The state is committed to bring to justice anyone who hacked our system and anyone who aided and abetted them to do so,” Parson said I assume they'll start with the head of the Office of Administration Information Technology Services Division whose team allowed such a glaring vulnerability in the first place. If IT management held some responsibility for breaches, then maybe it wouldn't be so hard to get funding for security measures.
- Threeve303 5y agoDo not make yourself even suspected of anything computer related to state or federal authorities. It is never a good idea.
- Wistar 5y agoThe reporter hacked our water system, maliciously held his hand under the faucet and then revealed to us that the water was WET!
- giantg2 5y ago"... Social Security numbers were contained in HTML source code of the pages." "Gov. Mike Parson was labeling the Post-Dispatch reporter a 'hacker' and vowing to seek criminal prosecution." L O L. Everyone who has hit F12 in a browser is now considered a hacker. I hope the prosecutors and law enforcement come to the right conclusion quickly and tell the governor no crime was committed. My experiences have left me with little faith of that happening.
- AnimalMuppet 5y ago"You can look like idiots now. Or you can try to keep from looking like idiots, and look like even bigger idiots very quickly. Your choice."
- RHSeeger 5y agoAnd, in the process, double down and cost the reporter his career and entire life savings as he pays for a lawyer to keep himself out of jail.
- giantg2 5y agoUsually the better publications have, or pay for, counsel for work related issues like this. I don't think this will cost them their career. Every semi-intelligent person can see what's going on. It will certainly create some shortterm headaches though.
- tgdnt 5y agoThis is a matter of job security, the reporter is embarrassing the state and that's Parson's job. Fingers crossed he goes on strike after this.
- jorblumesea 5y agoFeels like the traditional foundation of US democracy, free press, is being constantly undermined more and more every year. Doing even basic investigative work puts you in the crosshairs of someone.
- ChrisMarshallNY 5y agoGosh ... this should end well. <call target="broker"> <communication command="buy"> <stock>Orville Redenbacher</stock> </communication> </call>
- raldi 5y agoWhat's the right analogy for this, graspable by the techo-illiterate? Maybe like, the state mails letters out, and a reporter realizes that if you slit the envelope open, you can see that sensitive information was accidentally printed inside?
- tentacleuno 5y agoTo be frank, I believe this is one of the factors driving people with such skills into black-hat hacking. If they're going to get slammed for using their skills, they may as well get paid in the process. It's a damn shame such political dinosaurs have such a major impact in hacking.
- dusted 5y agohanging the heroes..
- heavyset_go 5y agoThis is just standard fare for the governor to rile up his base by attacking the press.
- csense 5y agoProsecuting people for responsible disclosure? This governor is a fricking idiot.
- FpUser 5y agoWhen idiot directs prosecution it becomes a crime on its own.
- dylan604 5y agoThis seems to be a requirement these days for being a governor. I understand not everyone can know everything. The fact that it is deemed unacceptable to admit not having all of the information to make an informed decision/comment where someone in a position of authority makes shit up to just sound authoritative is a sad state of affairs. It's not like being a governor is the same as posting things on an internet forum.
- psychometry 5y agoFTFY: It's a requirement for being a governor in a red state.
- good8675309 5y agoPolarize much? Let's just go back to the general population not trusting the government or any politician regardless of party affiliation. They're all corrupt and ignorant, it's a basic requirement.
- psychometry 5y agoOh, you're one of those morons who thinks both parties are equally bad, huh?
- dang 5y agoCould you please stop posting flamewar comments? You've been doing it a lot lately, and we ban such accounts regardless of what they're flaming for or against. I don't want to ban you because you've also posted good things, but we've had to warn you about this multiple times in the past and that's not cool. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
- mdek 5y agoFrom the article, it sounds like nothing even remotely questionable was done by the reporter who found the flaw: > "According to the Post-Dispatch, one of its reporters discovered the flaw in a web application allowing the public to search teacher certifications and credentials. No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages."
- tomrod 5y agoOh that is so bad. It's events and negligence like this that give credence to credentialing requirements for software engineering.
- daviddever23box 5y agoImagine if we had credentialing requirements for elected office…
- solveit 5y agoWe do. It's called an election. What you want is credentialing requirements for voting.
- WkndTriathlete 5y agoI'm pretty sure I want credentialing requirements for anyone running for any public office. I'd settle for automatic exclusion of anyone displaying narcissistic, psychopathic, or sociopathic tendencies and inclusion of rational pragmatists.
- solveit 5y agoI would also "settle" for picking the people I like. Also, pretty sure that you have to be at least somewhat narcissistic to think that you should be president, and somewhat sociopathic to actually succeed.
- deleted 5y ago
- jahabrewer 5y agoTell me you don't understand computers without telling me you don't understand computers.
- calderarrow 5y agoSenators too! We must end finstas! https://www.youtube.com/watch?v=TGt1Ukg7q4Y https://www.youtube.com/watch?v=TGt1Ukg7q4Y
- mediumdeviation 5y agoSo that quote is actually taken out of context. The Senator knows that finstas are, and is using it to drive a different argument - that Instagram is incentivized to help teenagers bypass parental control https://www.theverge.com/2021/10/1/22704308/finsta-instagram-facebook-privacy-kids-safety-richard-blumenthal-blackburn https://www.theverge.com/2021/10/1/22704308/finsta-instagram... > “Finstas are fake Instagram accounts. Finstas are kids’ secret second accounts. Finstas often are intended to avoid parents’ oversight. Basically, Facebook depends on teens for growth,” Blumenthal said. “Facebook also knows that nearly every teen in the United States has an Instagram account; it can only add more users as fast as there are new 13-year-olds.”
- rory 5y agoEven with the added context, it's pretty clear he has a very limited grasp on how finstas work. It's reasonable to be concerned about that when he is demanding they be banned.
- psychometry 5y agoTell me you're the Republican governor of a deep red regressive shithole state without telling me you're the Republican governor of a deep red regressive shithole state.
- throwaway0a5e 5y agoAuthoritarian blue states do this crap too. This has nothing to do with the set of policy positions on your party's official platform and everything to do with being a totalitarian jerk, a characteristic that abounds among politicians and high level government officials in general across many parties and nations.
- jpmattia 5y ago> No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages. If it was in the HTML source code, then it was publicly visible, so it is unclear what the article is trying to say.
- eloisius 5y agoTo laypersons HTML comments or display:none is invisible. But I agree, this is like a blast from the 90’s when View Source was leet hacking.
- Isthatablackgsd 5y agoEvery browser have access to the HTML source, even it is merely right click here and there. If the SSN is in the HTML source, then the blame should be on the webmaster who designed that code. Of course, accountability is not part of their tenet, it is too foreign for them. And look at the age of the governor, clearly shows that he is inept with the fundamental of the internet. I forgot to add one more thing. Did they not realize that there are scrappers who will scrap every bit of information of everything including the HTML code. I wonder how mcuh scammers/ID theft scrapped the data before this come to light?
- retrac 5y agoI don't understand the age excuse, honestly. My mother is about the same age. She is not technical, but she has used computers for the last 30+ years. Just like anyone any other white collar worker. She would have wrangled with WordPerfect control codes to format insurance quotes in the 80s. Document markup (and stuff hidden in the markup) is not esoteric knowledge, or I wouldn't think it is. Except apparently it is.
- dragonwriter 5y ago> the blame should be on the webmaster who designed that code. “Webmasters”, where they exist at all anymore, tend not to “design code”. > Did they not realize that there are scrappers who will scrap every bit of information of everything including the HTML code. I “...scrapers who scrape...” should be the concern here, not “...scrappers who scrap...” > And look at the age of the governor, clearly shows that he is inept with the fundamental of the internet. Gov. Parsons is 12 years younger than Vint Cerf and the same age as Sir Tim Berners-Lee.
- FpUser 5y agoSo when do we start prosecuting for malicious prosecution and gross incompetence?
- alexfromapex 5y agoIs this how the Governor saves face?
- kizer 5y ago“Hacked our system” — LOL. Nothing like our conservatives for a great laugh. What a moron.
- joshenberg 5y agoQuote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.
- dylan604 5y agoIf it is served via https, it is encrypted. Edit: sorry, forgot the /s
- anm89 5y agoif it's in plain text in the html served, it isn't
- dylan604 5y agoBut if you're an idiot to believe viewing source is hacking, then you're clearly the type that viewing the source is viewing encrypted data. The actual quote states that the data was first "unencrypted" before viewing the source. This is in fact correct if not poorly phrased, but who'd expect proper terms used when we're talking about "these" people?
- anm89 5y agoI get what the article says and what the county claims. That doesn't make what the parent said right.
- throwawaycuriou 5y agoexpand the lawsuit to Apple, Google, other heathen browser makers
- quantified 5y agoJust wait. I wouldn’t be surprised.
- jmull 5y ago> Parson said...the reporter was “attempting to embarrass the state and sell headlines for their news outlet.” Literally a reporter's job.
- toomuchtodo 5y ago“I’m going to weaponize the law because you embarrassed us.”
- moate 5y agoI can't imagine that a large, national organization like the ACLU or CPJ would want to dump tons of money into making this a massive national story should that happen... Someone about to experience the Streisand effect in FULL force.
- mcguire 5y agoSomehow, I have the feeling the St. Louis Post-Dispatch's lawyers are thinking, "Bring it! We haven't had this much fun in ages."
- merpnderp 5y agoI'm sure the judges likely to see this case are giggling over what they'll say to the state prosecutors.
- InitialLastName 5y agoHaving read opinions by federal circuit court judges on technical matters, it's not clear to me that the judges who will see this case are likely to understand the matter any better than the governor.
- wonderwonder 5y agoIn a state like Missouri getting sued by the ACLU is probably something that can be used to win an election and is seen as a badge of honor. They probably welcome it and all it costs them is tax payer dollars. They really just need to publicize any controversial party the ACLU represented and claim to be standing up to the sorts of people that would defend that behavior. If they lose in court it turns into a two for one as they get to rail against 'activist judges' and whip their base to go out and vote.
- josefresco 5y agoFYI the "Governor" is Mike Parson "As governor, Parson signed a bill criminalizing abortion after eight weeks of pregnancy and opposed Medicaid expansion. He oversaw the state's response to the COVID-19 pandemic, where he issued a temporary stay-at-home order in April 2020, allowed schools districts to decide whether or not to close, and limited postal voting during the 2020 U.S. elections. Parson also oversaw Missouri's reaction to the George Floyd protests, during which he pledged to pardon Mark and Patricia McCloskey, the couple involved in the St. Louis gun-toting controversy, if they were convicted of any crimes; he issued their pardons in August 2021." Sounds like a great guy.
- mmmpop 5y agoSoapbox much? The dude's clearly a moron but this isn't a thread about any of the topics mentioned in your quote. You're actively making HN a shittier place with comments like this.
- sophacles 5y ago> You're actively making HN a shittier place with comments like this. Please find your way to the nearest mirror and take a very hard, long look.
- josefresco 5y agoThe title only said "Governor" so I was like "gee, who is this guy/gal?" and so I RTFA and went back to the comments. Many were still referring to him as "Governor" and not by name so I thought it would be useful to mention his name. I then started reading his Wikipedia page and discovered he's a real piece of crap (IMHO) and decided to include that summary in my post. Am I starting crap? Maybe, but I think some background on his recent decisions in his role as Governor would be relevant to an article questioning a recent decision in his role as Governor.
- deleted 5y ago[deleted]
- logicalmonster 5y agoWhat is the source of the pasted quote? I have no idea what kind of person the Governor is (outside of being technically illiterate) and am not interested in a partisan bickering match, but despite disagreeing with some points there, some of the actions listed there are arguably great moves (with the devil being in a lot of nuanced details that your list didn't go into)
- thewileyone 5y agoThis is probably unpopular, but I want to see this go to court so that this moron can be exposed for all to see.
- fabianhjr 5y agoBest outcome would be for the courts to dismiss the case outright. (Bonus points for snark against the governor)
- buitreVirtual 5y agoThe news is not only the lack of understanding of what hacking is and what a security fuck up is. The news is the cowardice of this clown of a governor trying to deflect blame to those reporting the vulnerability. If he is too embarrassed to admit his government's fault, he will be rewarded with twice the embarrassment for reacting like a corrupt despot.
- _0ffh 5y agoI don't think I can blame a politician for being technically illiterate, especially one that old. But what the heck is up with the state bureaucrats who report to that guy? I mean someone it the freaking state bureaucratic hierarchy should at least be lucid enough to consult someone who has an actual clue about things as these.
- handrous 5y agoIt is my understanding that Parson is not the kind of fellow to give a shit what a state bureaucrat tells him, if it's not what he wants to hear, assuming he'd listen to them in the first place.
- prepend 5y agoI’m guessing it went like this… Politician: Socials are on the web site, who fucked up? IT: the web page is encrypted, we didn’t fuck up, the hacker decrypted the source Politician: sounds good to me, no fuckup on our part, let’s call the cops and prosecutors
- lotsofpulp 5y agoPolitician [intentionally looking to pass the buck to entities outside their purview and choosing not to research further]: sounds good to me, no fuckup on our part, let’s call the cops and prosecutors
- laserlight 5y agoWhy should age excuse incompetence? If they are incompetent in tech, they should at least know that and shut up.
- duxup 5y agoYeah this should be a "get a the computers guy in here" moment. Then someone explains and everyone moves on.
- cle 5y ago> I don't think I can blame a politician for being technically illiterate, especially one that old. Given the impact of technology on society, we absolutely can and should blame politicians who are technically illiterate.
- vngzs 5y agoThe EFF will likely take this case. Have the reporters contacted them?
- danso 5y agoOne thing a newspaper has is lawyers (including plenty of places that will do pro bono on 1st Amendment cases)
- JohnTHaller 5y ago'Parson said Thursday that he wasn’t sure why the reporter accessed the information. He claimed it was part of a “political game by what is supposed to be one of Missouri’s news outlets.”' Yes, everything that makes us look bad is part of a conspiracy by the other team. Ignore the facts, please. Pressing CTRL-U is hacking!
- CivBase 5y agoThe weird thing is even if this was a conspiracy to discredit an administration... it's a really bad one. Perhaps you could link the security flaw to a budget issue, but I can't imagine something like this seriously affecting a governor's chance for re-election. His response has obviously done more damage than the flaw ever could.
- codegeek 5y agoOf course he would. It is the typical political response these days. Double down on your mistakes and never accept responsibility on your end. So what if a bunch of SSN's were exposed ? It was only in "View Source" which is hacking . Come on now. /s
- yingbo 5y agoThe reporter should prosecute the government: not suitable for their jobs.
- giaour 5y agoNobody tell the gov how savagely he’s being raked over the coals in these comments, or tomorrow’s headline will be about a RICO case launched against the hacker collective known as “Hacker News.”
- codegeek 5y agoSomeone should tweet this discussion to him or his office. #stopclickingviewsource
- DeWilde 5y agoI wonder what his reaction will be when people start hacking the state's websites and outright leaking stuff to just spite him. Dumb move on his part.
- avgDev 5y agoSeriously, the government should have experts on hand who can translate tech into concepts they can understand. This is unacceptable. Imagine HTML is a TV in Social Security office. The way the storage of SS numbers was designed, is that they are hidden in a backroom, however, anyone can come into the office and scream a persons name to view all the information on the screen. The flaw is clearly in the system. I found flaws in Costco system before, I guess I should be in prison for letting them know and saving them thousands of dollars.
- tigerwager 5y agoThe states Chief Information Security Officer left the post on Friday https://www.govtech.com/workforce/missouri-ciso-stephen-meyer-leaves-post-for-private-sector https://www.govtech.com/workforce/missouri-ciso-stephen-meye... didnt see anyone mention that elsewhere in relation to this story. getting a 403 here without a vpn, but https://cybersecurity.mo.gov/ https://cybersecurity.mo.gov/ doesn't look like its been updated since 2018 The last CISO left in 2018 (~3months after the current governor took office), and the current ciso was appointed by interim then https://www.govtech.com/blogs/lohrmann-on-cybersecurity/missouri-ciso-michael-roling-leaves-a-legacy-of-excellence-in-government-cybersecurity-leadership.html https://www.govtech.com/blogs/lohrmann-on-cybersecurity/miss...
- DeWilde 5y agoTweet from the governor: "Through a multi-step process, an individual took the records of at least three educators, decoded the HTML source code, and viewed the SSN of those specific educators." >Through a multi-step process >decoded the HTML source code Somebody has been watching B-list hacker movies.
- mminer237 5y agoStep one: Press Ctrl Step two: Press U
- suzzer99 5y ago1. Click View in menu bar 2. Hover over developer menu item 3. Click View Source Three-step process - even more nefarious!
- bastardoperator 5y agoY'all are going to prison now, I hope it was worth it! =]
- Buttons840 5y ago1. Rest finger softly on the F12 key 2. Press finger downward
- adrr 5y agoDo they even have jurisdiction to go after the reporter. My guess is the site is cloud hosted in a state other than Missouri. Cross state boundaries is a federal matter.
- codegeek 5y agosshhh. The Governor would prosecute you for saying "Cloud Hosted". How dare you find this info that is hidden in the clouds ? Literally only the Gods can see the clouds.
- salynchnew 5y agoTFW the governor doesn't realize that HTML is a document that they proactively published on the internet. "The hacking is coming from inside the (state) house!" /s
- samuelizdat 5y agoRemember when a guy "Hacked" AT&T when the new iPad came out in 2010? I wonder what happened to that guy? lol
- cantbudgeit 5y agoIf you have an f12 key on your keyboard, you are now a hacker. Bad ass.
- ianhawes 5y agoIf the scenario being proposed is that the reporter publicly searched teachers on the site and then noticed that SSNs were returned in hidden HTML or an endpoint returned it from an API directly, that is a facepalm and they’re fine. If the reporter searched teachers and located (for example) their teacher ID, then discovered an endpoint (from looking at the JS) that took the ID as input and returned an SSN, they have potentially violated the CFAA (as written). Do I agree that they should be prosecuted? No. Is the CFAA a terrible law that criminalizes most netsec research? Yes.
- ball_of_lint 5y agoUntil the US has dramatically clearer and more sane laws around hacking and responsible disclosure our security will not improve.
- gdsdfe 5y agoWhy it's always the dumbest people that are elected to govern ?!
- wonderwonder 5y agoThis is what happens now when the media is portrayed as a political actor and everything can be "the other sided". “political game by what is supposed to be one of Missouri’s news outlets.” Now they get to ignore any and all responsibility and the governor is seen as standing up to the liberal media. It did not even have to be a big deal, just fix it, say its been resolved and move on. Everything is gamified and politicized now; to the point they are willing to send someone to jail over their own flaw. Its not even about being good leaders and helping citizens its just about winning elections and owning the libs or conservatives or your favorite brand of "snowflake". Human decency has left the building. I wish we could go back to business as usual but we have really entered a post truth society.
- didibus 5y agoI'm not American, just got interested in how their politics devolved to that, and apparently this was an intentional power play which started from republicans: > "a race to the bottom to see who can be meaner and madder and crazier. It is not enough to be conservative anymore. You have to be vicious." The viciousness doesn’t necessarily reside in the individual souls of Republican leaders. It flows from the party’s politics, which seeks to delegitimize opponents and institutions, purify the ranks through purges and coups, and agitate followers with visions of apocalypse I feel this article summarize it well: https://www.theatlantic.com/ideas/archive/2018/12/how-did-republican-party-get-so-corrupt/578095/ https://www.theatlantic.com/ideas/archive/2018/12/how-did-re... Newt Gingrich seems to be responsible for that more recent attempt at this, and everything happening now seems to be the end game of what he started, though the party seems to have a history of it to some extent. I know some people might say that the Atlantic is partisan and maybe Democratic leaning (I think?), but personally except for the part where the article seems to say they don't like what the Republican party is making of democracy, everything else seems pretty accurate and factual to me. I'd love to hear counterpoints, like is there anyone who doesn't think this characterizes the Republican party properly?
- stack_framer 5y ago> Parson said he had referred the matter to the Cole County Prosecutor and has asked the Missouri State Highway Patrol to investigate. Was this a drive-by "view source"? Why is the highway patrol investigating?
- dragonwriter 5y ago> Was this a drive-by "view source"? Why is the highway patrol investigating? In a number of states, the “Highway Patrol” is—either through role expansion, merger with a preexisting State Police, or otherwise—the general-jurisdiction law enforcement agency of the State.
- WarOnPrivacy 5y agoCompeting with Florida looks weird.
- atmin 5y agoAny sufficiently advanced search engine is indistinguishable from hacking.
- jonnycomputer 5y agoThe governor is making a fool of himself.
- nonesuchluck 5y agoWhy is everyone here acting like the governor is merely stupid? He is not arguing from ignorance, he is arguing in bad faith. Mike Parson wants to feed the narrative that the American free press is the "enemy of the people" because it suits his politics, nothing more. The only message here is "be careful embarrassing fascists."
- SamPatt 5y agoNearly all politicians act like this when they're in power. The general public is easily mislead. HN notices it when it's a tech issue, but it happens in economics, medicine, basically everywhere. They have zero incentives to accept responsibility.
- jeremyjh 5y agoNearly all politicians prosecute reporters? No, I'm pretty sure that is just the fascists.
- SamPatt 5y agoSubstitute whistleblower for reporter and yes, nearly all politicians will use the criminal justice system to silence their critics. Was Obama a fascist? I have no desire to engage in whataboutism, they all show their true colors when they're in power and shown corrupt or incompetent.
- jeremyjh 5y ago>I have no desire to engage in whataboutism Then don't. I think Snowden should be pardoned and considered a national hero, but he unquestionably committed a very serious crime. There was no crime committed in the State of Missouri on this matter.
- kmlx 5y ago> pretty sure that is just the fascists. i’m not from the US, but is it common in the US to use these kinds of accusations? seems ultra far fetched.
- kgeist 5y agoIf I witness a crime and tell police about it, am I an accomplice according to Mr Parson?
- deleted 5y ago[deleted]
- mullingitover 5y agoIt's only a matter of time before the inevitable class action lawsuit settles the question of culpability for this breach and assigns it 100% to the state. The teachers are going to get at minimum state-sponsored credit protection services for a few years, and the governor is going to get some egg on his face since it was his employees who created this breach. I honestly pity him a bit, because he has no clue about any of the technical details, but on the bright side he's about to get a crash course. I have to wonder what he's thinking, though, with the brazen slander. He must have some very deep pockets.
- CivBase 5y ago> "A hacker is someone who subverts computer security with malicious or criminal intent," the statement continued. “Here, there was no breach of any firewall or security and certainly no malicious intent. [...]" Then I guess HN better find a new name. Seriously though, this defense bugs me because it outright dismisses the idea of ethical hacking by re-defining "hacker" as someone with "malicious or criminal intent". They should embracing the label and explaining the difference between white hat hackers and black hats (the actual criminals). Our world needs more white hat hackers. All it takes is one security flaw to compromise a system and the deck is always stacked against those securing it. Re-defining "hacker" as a term to describe criminals stacks that deck even worse by dissuading future would-be white hats.
- yummybear 5y agoIf responsibly reporting a flaw is as bad as using it for evil, you might as well just sell it on the dark web.
- michael_michael 5y agoAfter the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I shopped a few other companies to see how our plans compared, I notified the marketplace operator via the only link on the website for customer service. Within about an hour, someone from their IT department rang me on the phone and started grilling me about how many other plans I browsed, and insisted that I clear my cache and browsing history, and notified me that they would be watching to make sure nobody at our IP address didn't access any other plans while the issue was being fixed. I was pretty surprised at his response, and assumed they would be more grateful for exposing a pretty basic flaw, but I guess a natural human tendency in these situations is to try to externalize the blame. Perhaps it's more difficult to hold yourself accountable than it is to assume that others who've found your shoddy work are malicious actors.
- invisible 5y agoWhat's bonkers is that _your own data_ was also accessible. Who's to say other users didn't get that data and choose to not report and kept the data? Your own outrage to your data being exposed would have been perfectly reasonable.
- mcguire 5y agoI don't know, that sounds like a pretty valid response given that you "shopped a few other companies to see how our plans compared".
- klyrs 5y agoIf I ask you to show me a document, and you willingly show me the document, who exactly is responsible for the disclosure?
- kamkazemoose 5y ago
- WarOnPrivacy 5y ago* The newspaper said it found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved. In other words, the information was available to anyone with a web browser who happened to also examine the site’s public code using Developer Tools or simply right-clicking on the page and viewing the source code.* The state's website was sending SSNs to the browser of every visitor. Visitors didn't ask for that info but got it anyway. Everything the state sent was viewable thru View Source.
- jll29 5y agoThe distribution of the SSNs to the client, where they can be seen by everyone using a Web browser by clicking on a standard menu function is clearly the government's fault. They are obviously trying to deflect their incompetence - nobody audited the design nor the resulting implementation. If the journalist acted as described it is professional behavior (notify and postpone publication to give the Website operator a chance to fix things), it is ethical and complies with security disclosure best practices.
- ROARosen 5y ago> No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages How is an HTML page source not considered "publicly visible"?!
- mmazing 5y agoDo you want to stop responsible disclosure of bugs like this in your state, Missouri? Just leave it for people who will actually misuse it? Because that's what you seem to want ... quit electing morons.
- skeeter2020 5y ago"... teachers’ Social Security numbers were contained in the HTML source code of the pages involved..." My bet is the SSN was used as the GUID for a table row or list item.
- suzzer99 5y agoI'm going to guess a value in a hidden form field.
- droptablemain 5y agoCan't determine if this allegation is malicious in nature or simply based on technological incompetence. Maybe some combination of the two.
- black_puppydog 5y agoGood. Let this go all the way to the top, this is someone who at least in theory should be backed by an institution (and various amendments...) so this should establish a nice precedence that no, you can't shoot to the messenger. The only "tiny" detail would be how to shield the individual reporter from the fall-out in the meantime. And while we're at it, holding an office should not protect you from personal liability for the harm done to said messenger during the process. Terribly idealistic, I know. One can dream... :|
- MereInterest 5y agoNow that they've shot the messenger, I'm sure that everything will be perfectly fine, right?
- mindcrime 5y agoI try to be an optimistic person, I really do. I try to remind myself that the sky isn't literally falling, and that the world is a more generally pleasant and peaceful place today than what it has been throughout much of history. But. Every time I see something like this, it just about drains my spirit to nothingness. I want to embrace nihilism and just quit giving a fuck about anything or anybody when I see stupidity on this level, and displayed by somebody who managed to get elected governor of a %@%#ng US state. It really is hard sometimes, to not just withdraw into a shell of isolation and decide "fuck it, this world is too damned stupid for me to bother with." I don't like feeling that way mind you, and I actively try to fight the urge to give in to that kind of thinking, but it seems to get harder and harder with every passing year. Am I weird in this regard, or are other people experiencing this as well?
- merpnderp 5y agoIt isn't stupidity. Government officials know this kind of thing will ultimately be a loser for them. But they know the mere threat of putting someone through the process of prosecution is punishment enough. This is what we need to work on correcting. If a judge laughs your case out of court, there should be a severe penalty, especially if you're the government.
- hn_throwaway_99 5y ago> It isn't stupidity. Hard disagree. If you're arguing that it's malice, and not stupidity, on the part of governor and others that put out this nonsense, then at least they are surely depending on the stupidity of their constituents at large for not laughing them out of office. And to be clear, I'm not at all taking the position that people who don't have a deep depth of technology are stupid. But pretty much everyone in the US knows how to use a web browser these days, and believing people will buy the governor's completely lobotomized argument [1] is totally embarrassing, either for the governor or his constituents that elected him. 1. https://twitter.com/GovParsonMO/status/1448750830857904129 https://twitter.com/GovParsonMO/status/1448750830857904129
- natechols 5y ago
- matt123456789 5y agoRecently, I had to submit a bunch of information (name, address, DOB) into a Google Forms page in order to request a COVID-19 vaccine CDC card from my state’s health department. This Google Form was run by a contractor for the state’s health department and was misconfigured to allow viewing all previous responses after submitting. One click on “view previous responses” on the post-submission Google Forms page and you can view everyone else’s names, addresses, DOBs, and information like which vaccine they received and in what arm. I almost didn’t report it, since the kind of shit as described in the link above gets reported so regularly. But I did, and it got fixed quickly. Now I’m just sat here hoping I don’t get served a lawsuit next week by some idiot hoping to cover their ass and make me out to be some kind of malicious actor. (Advice welcome...)
- betwixthewires 5y agoThis governor is an idiot and should be removed from office for this.
- comeonseriously 5y ago> ... unencrypted the source code from the webpage So now 'View Source' is an decryption tool use by those pesky "hacker" types?
- scc 5y agoThis news should not surprise anybody who has used government websites in Missouri. Here is an example: https://mydssapp.mo.gov/CitizenPortal/application.do https://mydssapp.mo.gov/CitizenPortal/application.do The website takes a LONG time to load because of how many javascripts it loads!!
- frumper 5y agoyou aren't kidding, that's pretty impressive really
- basedbertram 5y agoHoly cow, that's incredible
- suzzer99 5y agoI gave up, and my browser was still semi-borked for a while after clicking back to HN.
- Buttons840 5y agoI commented days ago about a state website that was returning all kinds of nicely formatted NPI in JSON from an API response, but the NPI was not displayed. I donned my black hat and other hacker attire and pressed F12 to open the browser's developers tools (a tool created by a shifty company named Google most people have never heard of), and there it was, plain as day, SSNs, addresses, etc. I closed the page and never touched it again. I knew what's happening in this story could happen to me. I knew my side of the story would rarely be told and that my fate would lie in the hands of a judge who views the F12 key with distrust and fear and a jury of my "peers" who are not actually my peers in any skill or know-how related to the case.
- onychomys 5y agoAt least make a throwaway email account somewhere and email the state's IT department to let them know. I doubt it'd ever get fixed (given state budgets), but still.
- dragonwriter 5y agoIn states that have state-level IT departments (usually, in addition to opposed to agency-internal ones), the state-level one mostly does IT project and contracting policy and oversight (often limited to large projects for active overisght), and maybe executes enterprise contracts for infrastructure that is used across agencies. For an in-production system, there is a good chance that they have no responsibility for ongoing maintenance, and no special information beyond what is on the website as to who is responsible for maintenance. You are better off contacting (anonymously or otherwise) the responsible agency. But, sadly, probably the most effective way to get it changed (after the flurry of butt covering) is to anonymously notify the media.
- Buttons840 5y agoOther comments are talking about how Missouri will spend millions investigating this "hack". I don't know how to reliable mask my identity against a million dollars worth of criminal investigators. This was many years ago, a few years after it first happened I looked again and it had been fixed.
- deleted 5y ago[deleted]
- croes 5y agoSomething similar happened in Germany. A programmer found a bug his customers shop system, he disclosed the bug to the shop provider and they reported him, there was a house search at his company and his computers were confiscated.
- TrispusAttucks 5y ago[1] Parson commits $50M to investigate alleged hack of Missouri educator database. Includes video press conference by Parson himself. [1] https://fox2now.com/news/missouri/missouri-education-department-website-hacked-teachers-data-exposed/ https://fox2now.com/news/missouri/missouri-education-departm...
- jjkaczor 5y ago$50m? Wouldn't that be better spent on the actual education system and educators itself? Talk about corruption - spending taxpayer money to cover-up mistakes made by government employeers - AND libellous statements made by government officials...
- TrispusAttucks 5y agoMaybe with $50M they could fix the website flaw.
- Wistar 5y agoI notice a "Suggest Corrections" button at the bottom, of that article. Perhaps a suggestion that the Governor's entire story is a load of crap?
- vbo 5y agoThere are developers out there that look like you and me, use the same tools and speak the same (programming) languages, yet have absolutely no concept of access control. I feel there's an enormous education/awareness gap when it comes to basic security practices and it's going to hurt all of us sooner or later by having our private information leaked, sold, abused, maybe ultimately deemed irrelevant in itself -- ie what would the world look like if all (or a significant chunk) of private information was leaked and you couldn't trust the old tokens of identity?
- tyingq 5y ago"No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages." So "view source" is now hacking.
- codingclaws 5y ago"...decoded the HTML source code..."
- jhinra 5y agoI know, right? By that logic, I've just decoded your comment by reading it.
- blunte 5y agoWhen the "leaders" show themselves to be so proudly ignorant, it makes you wonder what other decisions they have made which are completely wrong and fully executed. In this case, I'm not terribly surprised since that governer is from the party which frequently equates educated people as being "elite" - a characteristic to be avoided.
- allemagne 5y ago>Republican state Rep. Tony Lovasco, who according to his legislative biography has worked in software deployment and maintenance, tweeted Thursday that “it’s clear the Governor’s Office has a fundamental misunderstanding of both web technology and industry standard procedures for reporting security vulnerabilities. >“Journalists responsibly sounding an alarm on data privacy is not criminal hacking,” he said. I worry that we're heading in a direction where somebody like Lovasco won't be willing to break with somebody of the same political party even for something like this. It's already incredibly easy to code this story as a PR "win" for Democrats by embarrassing a prominent Republican. So then isn't giving a common-sense perspective in this circumstance kind of just a betrayal of everything your side stands for? I mean it's pretty unlikely that anything of legal import actually happens to the reporter, so for the "greater good" of accomplishing your wider agenda, or perhaps even more importantly preventing the other side's agenda, it might be better to just stay quiet and let this blow over as partisan bickering.
- jaywalk 5y agoThe fact that it happened here should calm your worries at least a little bit.
- dredmorbius 5y agoThe fact that it happening is a notable exception to recent political practice should jangle those worries right back up.
- weddpros 5y agoNo better than patent trolls
- dr_orpheus 5y ago"No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages." They definitely have a different definition of "publicly visible"
- heavymark 5y ago"In a press release Wednesday, the Office of Administration Information Technology Services Division said that through a multi-step process, a “hacker took the records of at least three educators, decoded the HTML source code, and viewed the social security number of those specific educators.” Ha, or summarized a user clicked "View Source" in their browser. Well I guess the first of the multi-set process is open said browser.
- cortesoft 5y agoI mean, everything is a multistep process if you are pedantic enough.
- rossdavidh 5y agoThe usefulness of having state legislators from a variety of backgrounds: Republican state Rep. Tony Lovasco, who according to his legislative biography has worked in software deployment and maintenance, tweeted Thursday that “it’s clear the Governor’s Office has a fundamental misunderstanding of both web technology and industry standard procedures for reporting security vulnerabilities. “Journalists responsibly sounding an alarm on data privacy is not criminal hacking,” he said.
- otrahuevada 5y agoJudging by his tweets, the governor seems under the impression that "decoding" the HTML is a multi step process and breaking it constitutes unlawful access. He does not, however, feel like expanding on what that means. Several people tried to reach him on that, without success. Does anyone have "lawful" access to the site? I want to see for myself how those bits of PII showed up in the markup.
- wanderingmind 5y agoCan someone with knowledge of law explain if the reporter can now file a lawsuit against the government for violating his 1A rights or does he need to wait for this case to get thrown out first.
- stewx 5y agoWe should be treating Social Security Numbers as usernames, not passwords, since SSNs can't be revoked when exposed in a leak.
- bastardoperator 5y agoThe only crime here is that this uninformed governor is going to spend taxpayer dollars and time to chase ghosts. His staff are either terrible, or this is all political theatre. I don't expect everyone to understand the internet at a technical level but no one under this guy could explain that this is a Missouri problem not a hacker problem?
- fak3r 5y agoOnce again, Gov Parsons makes me embarrassed to be a Missouri resident.
- C19is20 5y agoWhy?
- TheSpiceIsLife 5y agoI remember being more free during the Cold War. Many politicians are much older than me. At their brains just hard-wired to see an enemy everywhere?
- deleted 5y ago[deleted]
- JangoSteve 5y agoSo they included the SSNs in the HTML source, and then said the reporter hacked and unencrypted the HTML by reading the non-displayed SSNs in the source. That's like taping the SSNs up to the inside of a tinted window and then saying the reporter committed breaking and entering by shining a flashlight on the window.
- akomtu 5y agoHelping authorities with such matters is like feeding alligators: they'll bite you if they can and they won't be grateful.
- ripe 5y agoAs a hobby, I have been writing little explainers for non-technical people on my blog. I wrote one for this particular incident: https://www.robotsinplainenglish.com/e/2021-10-14-blame-shame.html https://www.robotsinplainenglish.com/e/2021-10-14-blame-sham... I hope HN readers will (gently) correct any mistakes or provide clarifications to make it better. Thanks!
- MrWiffles 5y agoWith “leaders” this goddamn stupid, it’s no wonder Russia pulls off so many hacks against us.
- nimbius 5y agoGovernor Parson, While in the Army, attended night classes at the University of Maryland and the University of Hawaii, without completion of a degree. Its not hard to see how someone with only a rural sixties highschool education might conflate this particular revelation with treasonous intent.
- exporectomy 5y agoWorth realizing that a lot of pre-internet systems like bureaucracies and phone networks were full of known and actively exploited vulnerabilities but they relied on obscurity and the law to discourage excessive exploitation so white-hat hacking didn't make sense. Somebody who's been out of touch for the past 20 years could easily see responsible disclosure as the beginning of an extortion attempt. "I can access your data and I'll publish sensitive information about it in 30 days." sounds like it's about to be followed up with "...unless you send me a pile of money in unmarked bills".
- arbuge 5y agoThis story just gets worse and worse: https://news.stlpublicradio.org/government-politics-issues/2021-10-14/missouris-governor-vows-to-prosecute-a-reporter-who-told-the-state-about-a-data-security-risk https://news.stlpublicradio.org/government-politics-issues/2... "Missouri Gov. Mike Parson on Thursday launched a criminal investigation of a St. Louis Post-Dispatch reporter... The investigation begins today, and Parson said the investigation could cost taxpayers as much as $50 million but did not detail those costs or take questions at a news conference Thursday." $50m over this now? They say never to assume malice when outright incompetence will do, but I'm beginning to wonder if some corrupt dealings involving IT contractors might be going on under the table. Whichever one it is, at this point I think the governor should just apologize and resign immediately. Not holding my breath. Edit: Looks like the governor is tweeting about this now. Straight from the horse's mouth: https://twitter.com/GovParsonMO/status/1448697768311132160 https://twitter.com/GovParsonMO/status/1448697768311132160 Really couldn't make this stuff up if I tried: "This individual did not have permission to do what they did. They had no authorization to convert and decode the code."
- dbish 5y agoYet another example of how political leaders are completely out of the loop on all things tech. Software is such a large part of the world nowadays that we need to change this or the US is going to have even more issues going forward. I don’t think the current parties are amenable to making changes and bringing in tech-savvy people anymore, and I firmly believe the only way forward is going to be to find a way to create a new party that can get traction at the grassroots level that is tech-forward and led by people who aren’t career politicians/lawyers. The two party system makes this very hard though
- SMAAART 5y ago"Shoot the messenger" what a great strategy! /-s
- TigeriusKirk 5y agoSo is this illegal? I'm not asking if it should or shouldn't be. I'm asking if it is, with the laws as written and interpreted today.
- diego_sandoval 5y agoThis article reminded me that I had to report a data leak I found on an ecommerce website from my country some months ago, so I just did that. I reported it to a government agency responsible for cybersecurity in my country, which apparently accepts reports about private companies. Any precautions that you recommend when reporting this kind of vulnerability/data leak? (Apart from "do not access other people's data if you can avoid it")
- rbanffy 5y agoI can’t wait for the time politicians will be people with at least a rudimentary grasp on modern technology.
- wnevets 5y agoRight Click -> View Source is now a multistep hacking process according this man.
- dreamcompiler 5y agoOne time I walked down a little-used alley and noticed my neighbor had left his garage door open. The open door was not visible from the street but anyone who happened to walk down the alley would have seen it. I called the neighbor to tell him he might want to close his garage door. He accused me of burglary and called the cops. No this didn't actually happen but it's the analogy that came to mind.
- evan_ 5y agoIt’s more like your neighbor put his social security number on a big sign in his window and then another sign that said “please don’t look at the other sign.”
- woopwoop 5y agoThe governor of Montana battered a reporter for asking him a question he didn't like [0]. There exist a number of politicians who feel that these are reasonable responses to adversarial press, and apparently a large number of voters who agree with them. [0] https://en.wikipedia.org/wiki/Greg_Gianforte#Election-eve_assault_on_journalist https://en.wikipedia.org/wiki/Greg_Gianforte#Election-eve_as...
- e-clinton 5y agoSomeone once took a photo in a hospital waiting room. There was a screen in the photo with a browser window that listed the queue of patients waiting to be seen (first name + last initial). I zoomed into the photo, typed the URL in my home machine and sure enough, the list of patients actively waiting to be seen loaded up. To make matters worse, incrementing a number in the URL cycled through different hospital waiting rooms. I emailed the vendor who build the tool about the issue and they responded letting me know that system worked as it was designed, and that no HIPPA violations existed since there was no full last name. I meant to make a bigger deal about this, but then got busy.
- fpgaminer 5y agoSimilarly, but much smaller potatoes: Went to pick up an order at Ikea and their online queue system lists your place in line. Nice. Except it also lists everyone else in line. Including their first name, last initial, and make and model of car. And I could still access the list after we left.
- kova12 5y agoPost a URL here, then I'm sure vendor would reconsider
- cheesecake_luvr 5y agoUse a secure service to report these things. For example here is one from the Guardian: https://www.theguardian.com/securedrop https://www.theguardian.com/securedrop. Here is one from the Washington Post: https://www.washingtonpost.com/anonymous-news-tips/ https://www.washingtonpost.com/anonymous-news-tips/
- cratermoon 5y agoPeople in power seem to confuse actual security designed to prevent unauthorized access with security by obscurity, and are shockingly willing to believe that calling a system secure makes it so. Remember when the state of Florida labelled an epidemiologist, who they had previously fired for not cooking the books on covid cases to make the state look less bad, a "hacker" because she sent email to a state-run mailing list? https://www.tampabay.com/news/health/2020/12/07/florida-police-seize-computer-of-covid-data-whistleblower/ https://www.tampabay.com/news/health/2020/12/07/florida-poli... The mailing list was claimed to be "secure", but there was nothing secure about it. Other than the fact that merely by convention only certain people were supposed to know about it and use it, it was completely unsecured.
- sysihyk 5y agoFound and *exploited*. Hence belongs behind bars.
- roguecoder 5y agoOkay, but it is hilarious that the governor is accusing the person here of “converting” and “decoding” “the code”, when what they actually did was decline to convert or decode the document the government delivered & just read it instead.
- beezischillin 5y agoThe government of my country passed a law requiring all companies to provide some documentation yearly under the threat of giant fines for noncompliance. Unfortunately the first year it was due was last year, and that complicated things so as governments do they opened up their pockets and paid bug for this upload form. My friend attempted to submit his and when he tried to download the paperwork that needs filing he discovered that not only was it very slow but they basically threw a webserver at a Windows PC’s C drive and turned indexes on and proxied it into a subfolder. So he could browse the entire computer and similarly could access the private data of every employer and their employees in the country. He wrote a few emails to relevant places and by the next day the entire thing was offline. I believe they never put it back up, and I know for sure they delayed applying the law by an entire year, maybe through some emergency decrees or idk. They didn’t really publicise it outside of saying that it’s been delayed. You now have to submit it in person.