9 ms·
Missouri website that leaked SSN
- threatofrain 5y agoThe website actually asks for SSN to identify teachers? https://news.ycombinator.com/item?id=28866805 https://news.ycombinator.com/item?id=28866805 https://news.ycombinator.com/item?id=28867562 https://news.ycombinator.com/item?id=28867562
- pacbard 5y agoMost states allow you to lookup teacher licenses using last name and they have a “secure” version of the same site for employers and employees to update data. Most of the secure sites use a combination of last names, dob, and/or SSNs to authenticate teachers.
- threatofrain 5y agoBut isn't this a front-facing site?
- pacbard 5y agoI don't get what you mean by front-facing website. Do you mean accessible by the public? Isn't that the point of websites that allows the public to look up professional licenses? I would imagine that there are similar websites for all other licensed professionals. BTW, California has a similar website that allows employers to put in SSN and DOB to lookup a teacher's license: https://www.ctc.ca.gov/commission/lookup https://www.ctc.ca.gov/commission/lookup It seems that Missouri had a similar setup that required a teacher's last name and the last 4 SSN digits.
- threatofrain 5y agoWhen you say secured version of a site, I had assumed that you were talking about something that's meant for administrative employees and only internally visible, not something that is open to any visitor. I can't imagine the workflow in allowing a random user to make these queries.
- ManBlanket 5y agoIf only there were legislation in place to subject those breaching this misinformation to legal recourse, so the current administration can enforce which problems exist in the public's eyes. Some real legal tools the government can use to enforce truths from falsehoods, wired right into the platforms that disseminate this kind misinformation. After all, elected representatives are known for their intellectual honesty and predictably virtuous behavior.
- CamperBob2 5y agoIf only there were legislation in place to subject those breaching this misinformation to legal recourse The SSN wasn't supposed to be used for identification at all, at first. [1] But the government decided that didn't apply to them, and then they decided that it didn't apply to anyone else. 1: https://www.nytimes.com/1998/07/26/weekinreview/the-nation-not-for-identification-purposes-just-kidding.html https://www.nytimes.com/1998/07/26/weekinreview/the-nation-n...
- pugworthy 5y agoTo be clear, it asks for last 4. This is not uncommon, with some sites asking for last name, birthday and last 4 of social to identify someone.
- progbits 5y agoBut if everyone asks for last four then it also means everyone has it. You are one shitty site leak away from having all the info needed to identify you available publicly.
- anoonmoose 5y agoAnyone wanna break down the vulnerability, now that we've got source? Edit: that massive string on line 203 is awfully suspicious... Double edit: there's another massive string a few lines above that, and the script on line 1188 is pretty interesting too
- spydum 5y agoThats just ViewState (throw it in http://viewstatedecoder.azurewebsites.net/ http://viewstatedecoder.azurewebsites.net/ if curious) of the schools array. Nothing special on the page. I suspect whats suspect is the lookup portion on the server side.
- mikeyouse 5y agoBased on the description in the original article: > Though no private information was clearly visible nor searchable on any of the web pages, the newspaper found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved. And the layout of that site - I suspect when you clicked through to look at a teacher, it would display the Name + last 4 of their social security number with their teaching credentials. I suspect that if you viewed source on that page, the full SSN was in the retrieved data but the page was just displaying the last 4 digits. Can't confirm without the Archive site actually pulling live data but it seems to line up.
- flatiron 5y agowhat they prolly meant is reporter went to the debugger network tab and saw the JSON response which had the full social returned. "HTML source code" is lingo for "I have no idea whats going on"
- jeroenhd 5y agoFrom the looks of the page I doubt the output was anything as fancy as JSON. This looks like a classic pre-rendered page from the early 00s, made by the nephew of the CEO or equivalent. I'm actually surprised there's JS running on these pages at all. There's a bunch of <input type="hidden"> elements in the search page, so I guess they did something similar to hide the information from their `select *` that wasn't meant for public consumption. Edit: looking at the code (directly referencing XMLHttpRequest etc.) it might also be raw HTML being injected into a table somewhere... Edit 2: based on the "base64" comments, I'm guessing the "view state" (ASP term?) was not encrypted and contained some secret info. There are other systems from other states running on similar tech, but they seem to encrypt their viewstates...
- chizhik-pyzhik 5y agoSo this archive page doesn't seem to contain any SSNs directly, right? you'd have to query for a teacher to actually see it.
- kisamoto 5y agoWhile not immediately visible, all the names and SSNs are in embedded javascript so if you inspect the source they're all there. I presume this is a poorly executed attempt to be fast and responsive by "pre-loading" all of the data required and then using the search box as a filter on the client. Edit: My mistake - I misinterpreted wrong IDs, these are not immediately here.
- tantalor 5y agoWhere? The only ids I see in the HTML are for districts: <option value="048914">ACADEMIE LAFAYETTE - 048914</option> etc.
- anoonmoose 5y agoI think it is possible that there was SSN data poorly encoded into the source of the page or one of the scripts From the original Post-Dispatch article: "Though no private information was clearly visible nor searchable on any of the web pages, the newspaper found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved."
- tyingq 5y agoFunny, with the Governor first doubling down on his "leet hackers" drivel, but now trying to bury it with new unrelated tweets to push his earlier rants down.
- WillPostForFood 5y agoYou know the guys who made the site were telling their bosses: We got hacked, but we're in control of the situation. They weren't saying, we screwed up and made private info public.
- tyingq 5y agoYes, though he got plenty of immediate public feedback with his first rant. Then chose to ignore it all and escalate/double-down.
- amznthrwaway 5y ago[dead]
- dogman144 5y agoi just hacked it
- dlivingston 5y agoDid you decode the encrypted HTML?! I think I saw that on Mr. Robot once.
- dogman144 5y agoi got a few 0 days ya
- unicornporn 5y agoFun fact. In Sweden it's available to anyone. Anyone can also find out find out where you're living, whom you're living with and what vehicle you're driving (among other things). It's a part of offentlighetprincipen[1]. [1] [PDF] https://www.regeringen.se/4a76f3/contentassets/2c767a1ae4e8469fbfd0fc044998ab78/public-access-to-information-and-secrecy.pdf https://www.regeringen.se/4a76f3/contentassets/2c767a1ae4e84...
- sucrose 5y agoThis is the main reason PewDiePie (game streamer) moved out of Sweden.
- Jolter 5y agoI doubt it. More likely he didn’t enjoy the tax rates…
- jimbob45 5y agoDoes that not lead to the potential sticky situations that my mind immediately jumps to? Edit: I read through your link and did some light browsing of my own (later stonewalled by the fact that I don't speak any of the Scandinavian languages). I don't see anywhere that a citizen can re-assert their right to privacy but that would seem to be necessary in some cases (e.g. Twitch streamers wanting to remain incognito to avoid getting SWATted or otherwise frequently visited by police).
- bob1029 5y agoCan we provide some examples?
- anchpop 5y agocelebrities getting harassed at their houses
- unicornporn 5y ago
- mwcampbell 5y agoIt strikes me as irresponsible to redouble the harm of the original oversight on the part of the developers by disseminating a link to an archived copy of the leaked PII. And no, I haven't taken a look.
- tantalor 5y agoAfter looking at this for a while, I don't see any SSN in the source or any external scripts. The original stltoday article said the information was "contained in the HTML source code" but that seems to be not the case.
- stefan_ 5y agoWhy would there, you haven't searched for anything. Even ASP.NET isn't terrible enough to send over the entire freaking database when just loading the form.
- tantalor 5y agoIt matters because it contradicts what the newspaper published. In my opinion, the "html source" means the document as it was sent over the wire before JavaScript modifies the document.
- amznthrwaway 5y agoYou’re not looking at the page served as a response to a search.
- willvarfar 5y agoCan’t see a contradiction. It’s easy to imagine that ssns are in search results. Eg it’s plausible that when you search for a teacher, the returned html contains tags with id where that is the primary key in the DB, which happens to be the Ssn etc.
- tyingq 5y agoThis is the search form. The problem is most likely in the page this posts to, with the search results. Still interesting, but this page doesn't answer many questions.
- TigeriusKirk 5y agoAs far as I've seen, no one has given a clear description of the actual vulnerability. Just what they imagine it was based on 3rd or 4th hand relayed descriptions.
- hinkley 5y agoI think we as a profession have made a fundamental error of not internalizing the idea that we have different “colors” of data that need to be treated as such at all times. At rest, and in motion. We have bespoke solutions to keep passwords and numbers out of logs by obscuring certain key, value pairs, but that’s exactly what it is. Bespoke. Those fields should be protected at all levels. I don’t know if I would go so far as calling it a cross cutting concern, but there is definitely a problem with stringly typed data that is a mix of PII, privileged data and common knowledge.
- bob1029 5y agoWe've started to treat anything that even sounds like PII as if it were high level radioactive waste. We have a single unified model for our problem domain with special attributes on those properties which are PII-sensitive. Any time our model is to be exposed to an unsecure context, it is reflected for these PII attributes and mapped into a special redacted variant of the same model. For purposes of troubleshooting, the redacted model properties receive the sensitive data as a hash after it has been passed through salted SHA256. This allows for us to correlate sensitive things like SSNs between multiple log entries for the same work item, but unable to correlate across different work items.
- codingdave 5y agoAbout half the places I've worked, and all the place with more than a couple dozen employees, have had formal security levels on emails, data, and documents. It is common enough practice that plugins exist to set the levels in MS Office tools. These covers PII as well as confidentiality and simply "internal only" levels of content. If you haven't worked in a large company in recent years, maybe you haven't seen it, but it feels fairly standard these days.
- kevinpet 5y agoMy guess from looking at this is once you select a district, it would have populated a dropdown with teachers. The teachers were keyed off SSN as the ids in the select element. Not clearly visible in source, but would appear right away if you did "inspect element" after selecting a district.
- denysvitali 5y agoPlease don't select "Inspect Element" or "View source". You're committing a crime.
- tyingq 5y agoIt does do a POST when you select a district, but not as ajax/xhr. It just tries to load a new page. It posts these form values: cpeSearchOne_ClientState: false ctlYearList$ddlYear: 2022 cpnlDistrict_ClientState: false ddlDistrict: 096098 cpnlEducator_ClientState: cpnlSSN_ClientState: cpnlSSNPublic_ClientState: true txtLastNamePublic: txtSSNPublic: I suspect the real problem is with the page that would be rendered as the results if it weren't currently shut off.
- e_commerce 5y agoPeople will look at abject incompetence and failure like this and use it as a *REASON* we should give more money to government!
- bellyfullofbac 5y agoAnd some others will look at the incompetence of 1 person/team and use it as a reason to takedown the whole government...
- steviedotboston 5y agoI'm not seeing any social security numbers in the source. I am seeing some six digit ID numbers though. For example, <option value="081097">PHELPS CO. R-III - 081097</option> Am i missing something here?
- deleted 5y ago[deleted]
- jessaustin 5y agoThis seems to be a front page without the database it requires to do its work. Which is sort of what one would expect to be on archive.org...
- ChrisArchitect 5y agoRelated giant thread from yesterday: https://news.ycombinator.com/item?id=28866805 https://news.ycombinator.com/item?id=28866805