8 ms·

I'd be careful about posting stuff like this as a young person in Australia. The modern situation is incredibly hostile towards this sort of disclosure. Especia

• mimentum 5y ago
  Na you'd be alright -we're not authoritarian here
• AdamJacobMuller 5y ago
  That's really sad. I've never been there but definitely romanticized the beers and beaches and kangaroos motif. Oh well.
  • Handytinge 5y ago
    It's also really untrue, don't believe the doom and gloomers!
• derekbaker783 5y ago
  The same applies in the US, unfortunately.
  • reuben364 5y ago
    See: this ad from Gov Parson in response to a disclosure about a state website leaking social security numbers of teachers https://m.youtube.com/watch?v=9IBPeRa7U8E https://m.youtube.com/watch?v=9IBPeRa7U8E
    • ascar 5y ago
      "the hacker[/journalist] decoded the HTML source code" and must be prosecuted. I can't believe what I just watched.
    • dhimes 5y ago
      For others: The ad claims that the news outlet that published the fact that the state website had teacher SSNs was part of the "fake news media" exploiting privacy for political gains. Apparently the SSNs were embedded in the pages html. The ad makes it sound like a huge reverse-engineering job.
    • greggsy 5y ago
      The two situations aren’t really comparable. The ABC, or the minister responsible for selecting it’s CEO (it’s owned and funded by the gov as a corporate entity, but not run by it) would be laughed out of the room if they suggested that the author should be charged.
• Oberbaumbrucke 5y ago
  Completely agree. The AU Gov would probably call this hacking
  • nomilk 5y ago
    The "ctrl + alt + u" attack vector.
  • greggsy 5y ago
    No, the Australian Cyber Security Centre would consider this responsible disclosure and advise the ABC to uplift their review processes. On the other hand, Sky News (the current government’s right wing mouthpiece) would use this as an opportunity to discredit the ABC.
  • michaelt 5y ago
    Quite a few countries have laws from the 1980s that basically say "gaining unauthorised access to computer systems is a crime" Which is of course a very expansive definition. Think you've found a leaked database credential and you test it before reporting, so as not to create a false alarm? That's illegal hacking. Almost any persistent XSS? That's illegal hacking. Access an admin panel by entering a default password? You guessed it, illegal hacking. We might get the impression these laws don't exist, because they aren't enforced internationally or if the hacker can't be identified - so black-hat hacking, cryptolockers, tech support scams, giant data breaches and suchlike go completely unpunished. But a white-hat hacker who identifies themselves in hopes of getting their security report taken seriously might well get a visit from the cops.
    • gonzo41 5y ago
      In Australia the goto for dropping a legal hammer on a digital crime is "misuse of a carriage service" which is just a big lasso that puts crimes like fraud that happen on the internet into a simple basket so they can attach sentences as they see fit.
    • nerdawson 5y ago
      Both the first and third example you gave would strike me as crossing the line. Without permission to test the security of a system, you shouldn't be trying credentials you've stumbled upon or defaults. If you randomly try my front door and find that it's unlocked, don't expect me to be thanking you.
• spellsaidwrong 5y ago
  Thankfully, I already disclosed the issue to iView's engineer team back in December 2021, and a lot of the original data has since been removed from the site. I do try to take care of this issue by censoring a lot of information about the security issue in the write-up, but I'm not sure if that is enough.
  • Grimburger 5y ago
    I certainly understand, hopefully you see my point though that being right sadly isn't enough for many/most in our country anymore :/ Good luck with things, it was just a warning and hopefully not a dissuasion from continuing on. https://www.theguardian.com/australia-news/2020/mar/08/melbourne-professor-quits-after-health-department-pressures-her-over-data-breach https://www.theguardian.com/australia-news/2020/mar/08/melbo...
  • mimentum 5y ago
    It has been censored enough, given the timeframe and previous disclosure to ABC. Good article though.
• OJFord 5y ago
  I booked a hotel stay (in Canada, not Australia) and got an error page at some point that dumped out all env vars including database credentials. Tried my best to report (not publicly disclose) it, including asking the front desk for contact information for IT; no response. I think we're (on HN) often in quite a bubble of being (or striving to be) hot on this sort of thing, or frankly far trickier to exploit sorts of things, when really the bar for a lot of ('IT is a cost centre') stuff out there is extremely low. I don't think this sort of leak or vulnerability is anywhere near as rare (which isn't even that rare) as it seems - I think an awful lot must just get quietly exploited or go unnoticed. We're only hearing about this one because someone thought it was 'lolz', I didn't publicize the one I noticed (in my normal user behaviour of just trying to book a room!) nor did I see if I could connect to the database and book myself in for free or something. And I only noticed it because it a) experienced an error; b) dumped env vars in the event of an error - i.e. I didn't have to look for it. How many other sites have I used since with similar problems but which just didn't happen to serve it up on a silver platter for me?
  • mkl95 5y ago
    Most C-level people couldn't care less about security. I'm yet to work for a SaaS that implements 2FA, yet at some point all of them have had passwords that a script kiddie could brute force within an hour. The only time I've seen security become a top-level priority was when some customer demanded some kind of checkbox compliance like SOC / ISO27001.
    • janstice 5y ago
      You call it checkbox compliance, but it does at least make vendors think about pretty much the bare minimum in all-around security posture, and then have an external audit - as someone who has to approve SaaS vendors it makes my life much easier.
  • someotherperson 5y ago
    Leaks are everywhere. I went to a certain country and needed to register my phone, somehow ended up in a workflow that allowed me to enter any national registration number (similar to a social security number) and it would output the person's name, phone number, address and other details for me to confirm that that was me :) No rate limiting on the endpoint, doesn't require auth, didn't block my VPN, doesn't even set cookies (very privacy conscious devs apparently). I could have mined the entire country's data. Insane.
• greggsy 5y ago
  They’ve been reasonable by waiting four months from initial contact, but in vulnerability disclosures it’s polite to add a better timeline of events. There’s still some detail that hasn’t been fully resolved, but it’s not clear what the residual impact is. This particular post doesn’t really seem to go into too much depth about what these keys are used for, or the damage that could be done, but I’m erring on the side of ‘meh’ until proven otherwise. It’s freely viewable content if you’re in Australia. They’ve obviously stuffed up on multiple fronts, and my money is on these issues being introduced by an integrator, rather than ABC employee. Lastly, the ABC is a corporate entity that is fully owned by the commonwealth (and beloved by most Australians) - tue article describes it as ‘state media’, which has sinister propaganda connotations of broadcasters in some other countries.
  • 3np 5y ago
    > beloved by most Australians That doesn't say much either way and isn't relevant - could just be that the propaganda is doing its job.
  • aspenmayer 5y ago
    > Lastly, the ABC is a corporate entity that is fully owned by the commonwealth (and beloved by most Australians) - tue article describes it as ‘state media’, which has sinister propaganda connotations of broadcasters in some other countries. I’d compare ABC to PBS in America. They both are state media. I think more liberal usage of accurate terms in this way is needed. Folks ought to know who funded and produced the reporting that they consume, especially when it’s those same folks doing the funding. It seems like you’re saying that calling it “state media” is something like spreading FUD, but to object to it being said in neutral terms entirely? I don’t see who benefits from leaving that info out either. I think the larger issues is these terms being used as dog whistles for propaganda in the first place. Those who have the power to label others as propaganda are not themselves subject to such labeling. Curious.
    • greggsy 5y ago
      Both PBS and ABC are independent of the ‘state’ though. They’re public broadcasters funded by public funds, which are administered by a federal agency (Dep of Industry in Australia).
• femto 5y ago
  The current Prime Minister would be torn between "law and order" and "sticking it to the ABC". His head would explode.
• mardifoufs 5y ago
  But why is the Australian government so "police state" minded? Is that really what the Australian people want? I'd guess they just don't care either way, but in that case why would the Australian politicians push for that? Canada has a pretty similar apathy towards politics but even then we don't see the government forcing Canadian citizens to implement backdoors or raiding the offices of a broadcaster. (Yes the recent C-36 and C-10 bills are pretty disastrous in that regard but they are very recent and face quite a bit of opposition) It's such a peaceful country too, so the entire "hard on crime" policy does not make sense to me. Is it a partisan issue in Australia or is it something both parties agree on?
  • dylan604 5y ago
    Seeing as Australia was used as a prison colony, I'd have thought they'd be much more likely to be against a strong ruling class.
    • cookie_monsta 5y ago
      In the same way that you would expect most people in the US to adhere to puritan Calvinist beliefs?
    • KyeRussell 5y ago
      Yeah, because a country with over 100 years of post-invasion history would base its worldview purely on the one fact most Americans know about it.
  • jandrese 5y ago
    Propaganda works, Rupert Murdoch has known it for decades. Keep the people scared and they won't question what you are doing.
    • 0xdeadb00f 5y ago
      This is so true. And something sadly I don't think enough Australians are aware of.
  • 5y ago
• jacobsenscott 5y ago
  Also in the US, where you can be sentenced to 41 months in prison for browsing a public URL at AT&T, and where the the Governor of Missouri wants to make it illegal to view the html source of a web page (because some state web site leaked all the SSNs of their teachers in some hidden html or something). If I found something like this on a site I don't think I would notify anyone. Too risky. Maybe over TOR if they have a contact page or something. But it is hard to be anonymous these days.
  • legalcorrection 5y ago
    weev didn’t just “browse a public url at AT&T”. That is dishonestly reductionist. He noticed the bug and then used it to retrieve and make public the private data of over a hundred thousand people.
    • aspenmayer 5y ago
      The data was already publicly available. Didn’t he just publicize the url?
      • deleted 5y ago
        [deleted]
    • jacobsenscott 5y ago
      My understanding was they just sent random icc-id codes as a query parameter to a public url, and if you hit a valid id it returned an email address. It was working as "designed", and not a bug.
    • getcrunk 5y ago
      You are equivocating. Iirc this bug you refer too WAS the public urls
      • legalcorrection 5y ago
        So? You access a few accounts that way, realize you're accessing people's private info, and then stop. No one is gonna charge you for that. Write a script and download a hundred thousand people's private data, that's a whole different thing.
• asojfdowgh 5y ago
  Any sources to these claims, other than "it feels that way so it is"?
  • cormacrelf 5y ago
    It's true in terms of Bernard Collaery / Witness K, but this is not the same at all. The entity being "hacked" is the ABC, which is an independent broadcaster that the government of the day is constantly trying to claim is biased against it. There is no reason to think that the CDPP or the Attorney General would try to defend the ABC from something like this. If anything they would point and laugh, and use it to justify another huge budget cut. In terms of responding to criticism in the digital realm, you can get a pretty illustrative view of the situation by looking at how the Digital Transformation Office handled feedback to its pile of steaming shit of a coronavirus proximity alert app. Numerous researchers found serious flaws constantly from its first release. It took like 6 months for them to even recognise that any outside researchers had even been helpful, IIRC. Release notes were like "fixed bugs" and then the researchers decompile the .JAR again and say "nope, you absolutely did not fix this huge problem" and then find another one. Meanwhile the government sank millions more dollars into BCG consulting to review it, while these people were working for free and getting no credit. I think their campaign to cast doubt on the app's safety, efficacy and security was successful, and it did not get taken up, and then the report that was due to be published about the project was never released, and it was all swept under the rug. Overall I think it was about $10 million spent for in the vicinity of 5 covid cases identified, I don't remember exactly but I think all of them were also identified by phone interviews. They did not, however, prosecute the researchers. So, ignorant and unkind, but mostly not like that journalist in the US who enraged a governor to the point of being criminally investigated for opening a webpage.