5 ms·

> Foreign Affairs Minister Penny Wong has asked Optus to cover passport application fees for anyone caught up in last week's massive data breach, which affected

by kiwih 4y ago

> Foreign Affairs Minister Penny Wong has asked Optus to cover passport application fees for anyone caught up in last week's massive data breach, which affected millions of Australians. I wonder if this is actually intended to be an "ask", or if this is polite language for "we will legally compel them to". >Passport numbers are among the personal details accessed in what the federal government has described as a "basic hack". >Optus says the data breach was due to a "sophisticated" operation. It would be good to know more details of the hack itself.

grecy 4y ago
Why does a phone company store a customer’s passport number?
- anakaine 4y ago
  And why is it stored in clear text. And why was it exposed to a regular API. And why was real data being used on a dev API. And why wasn't that API secured at all? These are all really good questions.
  - nineteen999 4y ago
    Why was unscrubbed customer data being used in a dev system that was connected to the internet at all.
    - sumedh 4y ago
      Perhaps they wanted test data similar to their Prod data.
      - 2muchcoffeeman 4y ago
        So obfuscate the data before exporting it.
        nineteen999 4y ago
        ... or don't connect it directly to the internet.
  - waste_monk 4y ago
    The answer for pretty much all of these are "woeful incompetence". Knew a guy who used to work for Optus, he said their business SIP service was constantly getting hacked and their strategy for dealing with it was just to eat the losses and give out account credit like water, because their infrastructure was so outdated and poorly designed that it was functionally impossible to secure. Honestly, Ausgov should rip Optus to shreds for this... not only for the data breach specifically, but also as a critical infrastructure operator they should be held to a far far higher standard than an ordinary business.
- Aerroon 4y ago
  And this is why they should be made to pay for it. Companies should only collect data that they really need. One way to encourage this behavior is to punish them when a breach happens based on the amount of data they collect. A data breach on a service that only has an email address on it matters a lot less to me than one that has my name, phone, address or picture of my id.
  - ecdavis 4y ago
    > Companies should only collect data that they really need. Collecting and keeping this data is a regulatory requirement for Optus. The problems with this breach have their roots in how identity is proven and verified in Australia. Far too much relies on possession of a physical document.
    - collegeburner 4y ago
      in America i usually prove identity for postpaid services with something like a utility bill which is at least not a government id document. i understand a telco wants some identity before extending credit for any postpaid plan but can y'all not do the same?
      - ecdavis 4y ago
        You can see Optus' ID requirements here: https://www.optus.com.au/for-you/support/answer?id=9438 https://www.optus.com.au/for-you/support/answer?id=9438 Here are the ID requirements for their major competitor, Telstra: https://www.telstra.com.au/support/account-payment/id-check-for-new-account https://www.telstra.com.au/support/account-payment/id-check-... These are legislated: https://www.legislation.gov.au/Details/F2022L00548 https://www.legislation.gov.au/Details/F2022L00548
- tlyleung 4y ago
  To have an account with Optus, you need to provide a Primary ID such as an Australian Drivers Licence or current passport. (See: https://www.optus.com.au/for-you/support/answer?id=9438 https://www.optus.com.au/for-you/support/answer?id=9438) They probably kept it on file, instead of verifying and discarding, potentially due to regulatory requirement.
  - ryan-allen 4y ago
    My understanding is that it's a regulatory requirement, the Govt wants to know who specifically owns what SIM. If I remember right, this was introduced post 9/11. I may be spectacularly wrong on both fronts, though!
    - jackvalentine 4y ago
      You are correct, but I’m pretty sure for prepaid services under a low threshold (4 SIMs?) a bank card is sufficient. That doesn’t stop these companies just going for the big ID though, and for postpaid they are offering credit and will definitely require 100 points of ID.
      - tmnvix 4y ago
        That's news to me. I've purchased two prepaid sims in Australia within the past ten years and each time a passport or driver's licence was required.
        jackvalentine 4y ago
        Actual law is here: https://www.legislation.gov.au/Details/F2017L00399/Html/Text#_Toc478627161 https://www.legislation.gov.au/Details/F2017L00399/Html/Text... and you can see what Amaysim requires here: https://www.amaysim.com.au/help/mobile/getting-started/acceptable-forms-identification https://www.amaysim.com.au/help/mobile/getting-started/accep... The ACMA determination is pretty hard to parse unfortunately.
    - HKH2 4y ago
glaucon 4y ago
> It would be good to know more details of the hack itself. Not much but there's this article from the ABC (Australian Public Service broadcaster) https://www.abc.net.au/news/2022-09-23/optus-rejects-claim-hack-likely-result-of-human-error/101468846 https://www.abc.net.au/news/2022-09-23/optus-rejects-claim-h... QUOTE STARTS "[They] wanted to make integrating systems easier, to satisfy two-factor authentication regulations from the industry watchdog, the Australian Communications and Media Authority (ACMA)." The process allegedly involved opening up the Optus customer identity database to other systems via what's known as an Application Programming Interface, with the assumption that the API would only be used by authorised company systems. QUOTE ENDS Also this one https://www.theregister.com/2022/09/23/cyberattack_optus/ https://www.theregister.com/2022/09/23/cyberattack_optus/ although it's six days old. This is a summary of the statements made by Optus https://whirlpool.net.au/wiki/optus_sept_2022_breach https://whirlpool.net.au/wiki/optus_sept_2022_breach . There's been some chatter on Twitter that at some point an Optus flack characterised the attack as "sophisticated" because the attackers "used Postman" so that's obviously caused a few laughs https://twitter.com/search?q=optus+postman+until%3A2022-10-01+since%3A2022-09-01 https://twitter.com/search?q=optus+postman+until%3A2022-10-0... .
ryan-allen 4y ago
I would like to know why the alleged hacker backed down, stating that they have withdrawn the ransom request and deleted the stolen data. It sounds like a convenient caveat to an agreement to pay ransom to the hackers, and I wouldn't put it past a big company here in Australia to pull that kind of PR trick. We live in the Lucky Country after all, I doubt we'll ever know the truth.
- AlexThrowAway 4y ago
  Probably someone at ASD called the kid responsible at home and had a polite and friendly chat. Might have told him to make his bed, clean up his room and throw out his cumsock while they were at it. ASD and ASIO have despised Singtel since they bought out C&W in the late 90's and want them out of the country. This whole media fiasco is a blessing for everyone. Might be able to finally cancel their carrier licence.
chillfox 4y ago
Well, both sides of politics are talking about updating the privacy act with a significant punitive component, and it can always be made retroactive if Optus is not feeling sorry enough.

by kiwih 4y ago

grecy 4y ago

Why does a phone company store a customer’s passport number?

anakaine 4y ago
And why is it stored in clear text. And why was it exposed to a regular API. And why was real data being used on a dev API. And why wasn't that API secured at all? These are all really good questions.
- nineteen999 4y ago
  Why was unscrubbed customer data being used in a dev system that was connected to the internet at all.
  - sumedh 4y ago
    Perhaps they wanted test data similar to their Prod data.
    - 2muchcoffeeman 4y ago
      So obfuscate the data before exporting it.
      - nineteen999 4y ago
        ... or don't connect it directly to the internet.
- waste_monk 4y ago
  The answer for pretty much all of these are "woeful incompetence". Knew a guy who used to work for Optus, he said their business SIP service was constantly getting hacked and their strategy for dealing with it was just to eat the losses and give out account credit like water, because their infrastructure was so outdated and poorly designed that it was functionally impossible to secure. Honestly, Ausgov should rip Optus to shreds for this... not only for the data breach specifically, but also as a critical infrastructure operator they should be held to a far far higher standard than an ordinary business.
Aerroon 4y ago
And this is why they should be made to pay for it. Companies should only collect data that they really need. One way to encourage this behavior is to punish them when a breach happens based on the amount of data they collect. A data breach on a service that only has an email address on it matters a lot less to me than one that has my name, phone, address or picture of my id.
- ecdavis 4y ago
  > Companies should only collect data that they really need. Collecting and keeping this data is a regulatory requirement for Optus. The problems with this breach have their roots in how identity is proven and verified in Australia. Far too much relies on possession of a physical document.
  - collegeburner 4y ago
    in America i usually prove identity for postpaid services with something like a utility bill which is at least not a government id document. i understand a telco wants some identity before extending credit for any postpaid plan but can y'all not do the same?
    - ecdavis 4y ago
      You can see Optus' ID requirements here: https://www.optus.com.au/for-you/support/answer?id=9438 https://www.optus.com.au/for-you/support/answer?id=9438 Here are the ID requirements for their major competitor, Telstra: https://www.telstra.com.au/support/account-payment/id-check-for-new-account https://www.telstra.com.au/support/account-payment/id-check-... These are legislated: https://www.legislation.gov.au/Details/F2022L00548 https://www.legislation.gov.au/Details/F2022L00548
tlyleung 4y ago
To have an account with Optus, you need to provide a Primary ID such as an Australian Drivers Licence or current passport. (See: https://www.optus.com.au/for-you/support/answer?id=9438 https://www.optus.com.au/for-you/support/answer?id=9438) They probably kept it on file, instead of verifying and discarding, potentially due to regulatory requirement.
- ryan-allen 4y ago
  My understanding is that it's a regulatory requirement, the Govt wants to know who specifically owns what SIM. If I remember right, this was introduced post 9/11. I may be spectacularly wrong on both fronts, though!
  - jackvalentine 4y ago
    You are correct, but I’m pretty sure for prepaid services under a low threshold (4 SIMs?) a bank card is sufficient. That doesn’t stop these companies just going for the big ID though, and for postpaid they are offering credit and will definitely require 100 points of ID.
    - tmnvix 4y ago
      That's news to me. I've purchased two prepaid sims in Australia within the past ten years and each time a passport or driver's licence was required.
      - jackvalentine 4y ago
        Actual law is here: https://www.legislation.gov.au/Details/F2017L00399/Html/Text#_Toc478627161 https://www.legislation.gov.au/Details/F2017L00399/Html/Text... and you can see what Amaysim requires here: https://www.amaysim.com.au/help/mobile/getting-started/acceptable-forms-identification https://www.amaysim.com.au/help/mobile/getting-started/accep... The ACMA determination is pretty hard to parse unfortunately.
  - HKH2 4y ago

glaucon 4y ago

> It would be good to know more details of the hack itself. Not much but there's this article from the ABC (Australian Public Service broadcaster) https://www.abc.net.au/news/2022-09-23/optus-rejects-claim-hack-likely-result-of-human-error/101468846 https://www.abc.net.au/news/2022-09-23/optus-rejects-claim-h... QUOTE STARTS "[They] wanted to make integrating systems easier, to satisfy two-factor authentication regulations from the industry watchdog, the Australian Communications and Media Authority (ACMA)." The process allegedly involved opening up the Optus customer identity database to other systems via what's known as an Application Programming Interface, with the assumption that the API would only be used by authorised company systems. QUOTE ENDS Also this one https://www.theregister.com/2022/09/23/cyberattack_optus/ https://www.theregister.com/2022/09/23/cyberattack_optus/ although it's six days old. This is a summary of the statements made by Optus https://whirlpool.net.au/wiki/optus_sept_2022_breach https://whirlpool.net.au/wiki/optus_sept_2022_breach . There's been some chatter on Twitter that at some point an Optus flack characterised the attack as "sophisticated" because the attackers "used Postman" so that's obviously caused a few laughs https://twitter.com/search?q=optus+postman+until%3A2022-10-01+since%3A2022-09-01 https://twitter.com/search?q=optus+postman+until%3A2022-10-0... .

ryan-allen 4y ago

I would like to know why the alleged hacker backed down, stating that they have withdrawn the ransom request and deleted the stolen data. It sounds like a convenient caveat to an agreement to pay ransom to the hackers, and I wouldn't put it past a big company here in Australia to pull that kind of PR trick. We live in the Lucky Country after all, I doubt we'll ever know the truth.

AlexThrowAway 4y ago
Probably someone at ASD called the kid responsible at home and had a polite and friendly chat. Might have told him to make his bed, clean up his room and throw out his cumsock while they were at it. ASD and ASIO have despised Singtel since they bought out C&W in the late 90's and want them out of the country. This whole media fiasco is a blessing for everyone. Might be able to finally cancel their carrier licence.

chillfox 4y ago

Well, both sides of politics are talking about updating the privacy act with a significant punitive component, and it can always be made retroactive if Optus is not feeling sorry enough.