3 ms·

The source code is the least of it! From the article: > citizen PII databases and electronic signing documents were also collected but are being sold separatel

The source code is the least of it! From the article: > citizen PII databases and electronic signing documents were also collected but are being sold separately

jetsetman192 7mo ago
Encryption keys are mentioned as well.
simonklitj 7mo ago
Man, you've got to be a real low-life to sell all of that.
- blell 7mo ago
  You've got to be a real low-life to collect all of that and put it in a database that is not air-gapped.
  - xorcist 7mo ago
    It's something akin to a service provider in SAML parlance, if we are to believe reporting. How can it be air-gapped? And if we are to believe the hacked company, it is a development environment with test data in it. That remains to be seen, but is a risky thing to lie about. If there is production data in the leak, we will surely know about it.
    - UltraSane 7mo ago
      At the high end you can use data diodes to isolate critical data.
  - lukan 7mo ago
    If you need the data, you cannot have it air gapped. And if it is air gapped, it is still easy to make misstakes.
    - dns_snek 7mo ago
      > it is still easy to make misstakes. That's not an excuse though, any system handling data like that should be continuously reviewed and pentested by professionals. Hopefully they can show that this has been done otherwise it's just negligence.
      - lukan 7mo ago
        It was mainly an explanation, that "airgapping" does not magically provides better security, or is required (or possible) to use at all here.
        dns_snek 7mo ago
        And it's pretty clear to me that they were criticizing storage of sensitive data in a database that isn't properly secured and they simply misused the term "airgapped". The database in question was easily accessible from poorly maintained development infrastructure. > Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize
      - fc417fc802 7mo ago
        Imagine if the bank took such a cavalier attitude with the contents of my account.
    - jjgreen 7mo ago
      "misstakes", love it, almost peotic
  - dijit 7mo ago
    The point of a system like this is specifically that it’s accessible and not air gapped. Being able to validate that a citizen is a citizen and their ID is valid inherently requires the system be accessible
    - deleted 7mo ago
      [deleted]
    - fc417fc802 7mo ago
      If you can't implement it securely then perhaps such an undertaking wasn't a good idea? In the vast majority of cases I don't see why PII ever needs to be available over the network for remote queries. For the purpose of verification isn't it sufficient to verify hashes or better yet to attest via smartcard?
      - dijit 7mo ago
        You can, they didn't; big difference.
        fc417fc802 7mo ago
        By "can't" I mean "not capable" or "not going to in practice".
AdamN 7mo ago
Yeah the source code isn't really such a big deal aside from helping to find vulnerabilities. The PII is a real disgrace.
- embedding-shape 7mo ago
  Seeming by other sources, it wasn't really information considered PII in Sweden (but would in other places), I'm not sure this is as a big deal as people try to make it out to be.
worldsayshi 7mo ago
I wonder if the focus on source code makes Swedish news slower to jump on this. I haven't seen it in domestic news yet. (Haven't looked too wide though)
- ACS_Solver 7mo ago
  I saw it on SVT a few hours ago. DN and Expressen have also reported. The details about what exactly it is that got leaked are unclear (some report it's basically the code and certs responsible for BankID SSO) but this is certainly being reported domestically.
  - worldsayshi 7mo ago
    In Aftonbladet comments from CGI they seem to think that no production related data has been leaked: https://www.aftonbladet.se/nyheter/a/ArvG0E/cgi-sverige-uppges-vara-hackade-flera-myndigheter-aktiva https://www.aftonbladet.se/nyheter/a/ArvG0E/cgi-sverige-uppg...
    - yaris 7mo ago
      As if it ever happened that a breached company admitted immediately that they've just been fucked.
    - deleted 7mo ago
      [deleted]
    - zyberzero 7mo ago
      But a copy of production data in the test environment isn't production data... It's test data! :)
  - einr 7mo ago
    some report it's basically the code and certs responsible for BankID SSO No. CGI has nothing to do with BankID. IMO the most credible reports suggest that the source code and data involved are related to these four services: https://www.cgi.com/se/sv/business-process-services/e-tjanster/mina-engagemang https://www.cgi.com/se/sv/business-process-services/e-tjanst... "Mina engagemang offers a user-friendly and flexible solution that allows your customers to manage their cases directly through a personal portal. Here, users can view, track, and interact with their ongoing cases, which enhances both transparency and efficiency in the communication process." -- some kind of ticket/case management system for gov't agencies https://www.cgi.com/se/sv/business-process-services/elektronisk-identifiering-och-underskrift https://www.cgi.com/se/sv/business-process-services/elektron... "With our secure end-to-end e-ID and eSign services, we can help you streamline document and contract management, gain access to all desired e-ID issuers, and improve cost efficiency." -- this sounds like a bad thing to compromise, but is to the best of my understanding a system for digital signatures on documents, and has no relation to BankID https://www.cgi.com/se/sv/business-process-services/e-tjanster/foretradarregistret https://www.cgi.com/se/sv/business-process-services/e-tjanst... "Gain better control over your organization’s representatives with our easy-to-use representative registry. By automating the identification and verification of representatives, you’ll gain a clear overview and enhance the security of your processes." -- sounds like some bullshit CRUD app for managing who can "represent" a gov't agency https://www.cgi.com/se/sv/business-process-services/e-tjanster/shs https://www.cgi.com/se/sv/business-process-services/e-tjanst... "SHS is Sweden’s common standard for information exchange, enabling secure and efficient communication between government agencies, businesses, and organizations." -- this might be bad if real data was leaked These are services used by various Swedish government agencies and it's pretty bad to have even a test instance of them hacked, but let's calm down. The entire Swedish state has not been compromised here.
deleted 7mo ago
[deleted]
ptx 7mo ago
What does "electronic signing documents" mean? Keys used for signing? Or merely some documents that were signed with electronic signing?
- nunobrito 7mo ago
  If that is case, then it would have been wrong from the beginning for any government to keep hold of the private keys for the signature on my citizen card. Because in that case they can sign documents on my behalf without my permission. In a court case, it would be near impossible for me to prove that the government gave my private key to someone else and that it wasn't me signing an incriminating document.
  - ptx 7mo ago
    I apparently didn't phrase that very well. If what is the case? I was trying to ask which case was the case, not trying to claim that something specific was the case. I'm familiar with electronic signatures, and I know what documents are, but I have never heard the phrase "electronic signing documents" and don't know what that is supposed to mean. What kind of documents? Documents about signing, documents that were signed, documents in the sense that files containing keys could be considered documents, or what?
    - nunobrito 7mo ago
      In Portugal we were early adopters for digital signatures on citizen cards. You use the card reader, insert your gov-issued identification and can sign PDF papers which have legal validity since the private key from the citizen card was used. Now imagine someone signing random legal documents with your ID for things like debts, opening companies or subscritions to whatever.
    - pastage 7mo ago
      Signed documents can be as simple as an ID of the transaction, a statement in text, PII data that identify what you sign, or a store of larger PDF files for download and verification. We do not know. I base this on how signing works technically in Sweden. CGI is not the only supplier of these services.

The source code is the least of it! From the article: > citizen PII databases and electronic signing documents were also collected but are being sold separately

jetsetman192 7mo ago

Encryption keys are mentioned as well.

simonklitj 7mo ago

Man, you've got to be a real low-life to sell all of that.

blell 7mo ago
You've got to be a real low-life to collect all of that and put it in a database that is not air-gapped.
- xorcist 7mo ago
  It's something akin to a service provider in SAML parlance, if we are to believe reporting. How can it be air-gapped? And if we are to believe the hacked company, it is a development environment with test data in it. That remains to be seen, but is a risky thing to lie about. If there is production data in the leak, we will surely know about it.
  - UltraSane 7mo ago
    At the high end you can use data diodes to isolate critical data.
- lukan 7mo ago
  If you need the data, you cannot have it air gapped. And if it is air gapped, it is still easy to make misstakes.
  - dns_snek 7mo ago
    > it is still easy to make misstakes. That's not an excuse though, any system handling data like that should be continuously reviewed and pentested by professionals. Hopefully they can show that this has been done otherwise it's just negligence.
    - lukan 7mo ago
      It was mainly an explanation, that "airgapping" does not magically provides better security, or is required (or possible) to use at all here.
      - dns_snek 7mo ago
        And it's pretty clear to me that they were criticizing storage of sensitive data in a database that isn't properly secured and they simply misused the term "airgapped". The database in question was easily accessible from poorly maintained development infrastructure. > Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize
    - fc417fc802 7mo ago
      Imagine if the bank took such a cavalier attitude with the contents of my account.
  - jjgreen 7mo ago
    "misstakes", love it, almost peotic
- dijit 7mo ago
  The point of a system like this is specifically that it’s accessible and not air gapped. Being able to validate that a citizen is a citizen and their ID is valid inherently requires the system be accessible
  - deleted 7mo ago
    [deleted]
  - fc417fc802 7mo ago
    If you can't implement it securely then perhaps such an undertaking wasn't a good idea? In the vast majority of cases I don't see why PII ever needs to be available over the network for remote queries. For the purpose of verification isn't it sufficient to verify hashes or better yet to attest via smartcard?
    - dijit 7mo ago
      You can, they didn't; big difference.
      - fc417fc802 7mo ago
        By "can't" I mean "not capable" or "not going to in practice".

AdamN 7mo ago

Yeah the source code isn't really such a big deal aside from helping to find vulnerabilities. The PII is a real disgrace.

embedding-shape 7mo ago
Seeming by other sources, it wasn't really information considered PII in Sweden (but would in other places), I'm not sure this is as a big deal as people try to make it out to be.

worldsayshi 7mo ago

I wonder if the focus on source code makes Swedish news slower to jump on this. I haven't seen it in domestic news yet. (Haven't looked too wide though)

ACS_Solver 7mo ago
I saw it on SVT a few hours ago. DN and Expressen have also reported. The details about what exactly it is that got leaked are unclear (some report it's basically the code and certs responsible for BankID SSO) but this is certainly being reported domestically.
- worldsayshi 7mo ago
  In Aftonbladet comments from CGI they seem to think that no production related data has been leaked: https://www.aftonbladet.se/nyheter/a/ArvG0E/cgi-sverige-uppges-vara-hackade-flera-myndigheter-aktiva https://www.aftonbladet.se/nyheter/a/ArvG0E/cgi-sverige-uppg...
  - yaris 7mo ago
    As if it ever happened that a breached company admitted immediately that they've just been fucked.
  - deleted 7mo ago
    [deleted]
  - zyberzero 7mo ago
    But a copy of production data in the test environment isn't production data... It's test data! :)
- einr 7mo ago
  some report it's basically the code and certs responsible for BankID SSO No. CGI has nothing to do with BankID. IMO the most credible reports suggest that the source code and data involved are related to these four services: https://www.cgi.com/se/sv/business-process-services/e-tjanster/mina-engagemang https://www.cgi.com/se/sv/business-process-services/e-tjanst... "Mina engagemang offers a user-friendly and flexible solution that allows your customers to manage their cases directly through a personal portal. Here, users can view, track, and interact with their ongoing cases, which enhances both transparency and efficiency in the communication process." -- some kind of ticket/case management system for gov't agencies https://www.cgi.com/se/sv/business-process-services/elektronisk-identifiering-och-underskrift https://www.cgi.com/se/sv/business-process-services/elektron... "With our secure end-to-end e-ID and eSign services, we can help you streamline document and contract management, gain access to all desired e-ID issuers, and improve cost efficiency." -- this sounds like a bad thing to compromise, but is to the best of my understanding a system for digital signatures on documents, and has no relation to BankID https://www.cgi.com/se/sv/business-process-services/e-tjanster/foretradarregistret https://www.cgi.com/se/sv/business-process-services/e-tjanst... "Gain better control over your organization’s representatives with our easy-to-use representative registry. By automating the identification and verification of representatives, you’ll gain a clear overview and enhance the security of your processes." -- sounds like some bullshit CRUD app for managing who can "represent" a gov't agency https://www.cgi.com/se/sv/business-process-services/e-tjanster/shs https://www.cgi.com/se/sv/business-process-services/e-tjanst... "SHS is Sweden’s common standard for information exchange, enabling secure and efficient communication between government agencies, businesses, and organizations." -- this might be bad if real data was leaked These are services used by various Swedish government agencies and it's pretty bad to have even a test instance of them hacked, but let's calm down. The entire Swedish state has not been compromised here.

deleted 7mo ago

[deleted]

ptx 7mo ago

What does "electronic signing documents" mean? Keys used for signing? Or merely some documents that were signed with electronic signing?

nunobrito 7mo ago
If that is case, then it would have been wrong from the beginning for any government to keep hold of the private keys for the signature on my citizen card. Because in that case they can sign documents on my behalf without my permission. In a court case, it would be near impossible for me to prove that the government gave my private key to someone else and that it wasn't me signing an incriminating document.
- ptx 7mo ago
  I apparently didn't phrase that very well. If what is the case? I was trying to ask which case was the case, not trying to claim that something specific was the case. I'm familiar with electronic signatures, and I know what documents are, but I have never heard the phrase "electronic signing documents" and don't know what that is supposed to mean. What kind of documents? Documents about signing, documents that were signed, documents in the sense that files containing keys could be considered documents, or what?
  - nunobrito 7mo ago
    In Portugal we were early adopters for digital signatures on citizen cards. You use the card reader, insert your gov-issued identification and can sign PDF papers which have legal validity since the private key from the citizen card was used. Now imagine someone signing random legal documents with your ID for things like debts, opening companies or subscritions to whatever.
  - pastage 7mo ago
    Signed documents can be as simple as an ID of the transaction, a statement in text, PII data that identify what you sign, or a store of larger PDF files for download and verification. We do not know. I base this on how signing works technically in Sweden. CGI is not the only supplier of these services.