Joburg billing leak not a hack: whistle blower

[rpm]

Joburg billing leak not a hack: whistle blower

The City of Joburg claims that its exposed online billing system is a result of a malicious hack, but the man who brought the issue to light tells a very different story.

 

[froot]

Lol.

All that happened was this:

To open a statement, ie www.123.co.za/statements/fetch.php?id=0123456 you need to be logged in. That worked fine.

However, it did not check that you are user 0123456 before allowing you to fetch statement 0123456. That's where their bug came in. It's a bug, not a hack.

 

[NomNom]

They are calling it a hack to cover their arses.

 

[Sinbad]

Lol.

All that happened was this:

To open a statement, ie www.123.co.za/statements/fetch.php?id=0123456 you need to be logged in. That worked fine.

However, it did not check that you are user 0123456 before allowing you to fetch statement 0123456. That's where their bug came in. It's a bug, not a hack.

You did not need to be logged in.
The location that held the pdfs was completely unsecured.

Best analogy I can think of:
You go to a council office. You ask to see your statement. They check your id and details and tell you "ok, your statement is in the building across the road, on the fourth floor, on table 27.
The building across the road has no entry control, no guards, and everybody's statements laid out on tables, not even in envelopes. Anyone can walk in off the street and look at anyone's statement because they're all laid out for the world to see.

No hack here at all.

 

[Jola]

No hack here at all.

That ^

Just sheer incompetence !

 

[froot]

You did not need to be logged in.
The location that held the pdfs was completely unsecured.

Best analogy I can think of:
You go to a council office. You ask to see your statement. They check your id and details and tell you "ok, your statement is in the building across the road, on the fourth floor, on table 27.
The building across the road has no entry control, no guards, and everybody's statements laid out on tables, not even in envelopes. Anyone can walk in off the street and look at anyone's statement because they're all laid out for the world to see.

No hack here at all.

I tried it that day, wouldn't let me view it if I hadn't logged in beforehand, and this was before they took it down.

 

[Sinbad]

I have never logged into eservices from my phone. I have 5 pdfs on my phone that say you are mistaken

 

[DJ...]

I tried it that day, wouldn't let me view it if I hadn't logged in beforehand, and this was before they took it down.

I'm not a CoJ customer and have never visited their website, let alone logged in. I too had full access to all statements. There was no login required whatsoever...

 

[dadecoza]

I have never logged into eservices from my phone. I have 5 pdfs on my phone that say you are mistaken

They now have your IP and is going to come after you.

 

[Jakes147]

I have never logged into eservices from my phone. I have 5 pdfs on my phone that say you are mistaken

+1

 

[Budza]

So, now we know who he is.

I thought he wanted to remain anonymous?

 

[ISP cash cow]

So, now we know who he is.

I thought he wanted to remain anonymous?

He did but unfortunately the witchhunt from CoJ has brought about him having to defend himself.

Also Kudos to My broadband for writing an article about the truth of the matter. Nice one RPM!!

 

[nfbs]

Changing source code is a hack. Changing the URL is not a hack.

BTW does that site use SSL?

 

[RichardG]

How do they call this a hack if it's freely available on Google indexed Robots do wonders

https://www.google.co.za/search?q=s...0.69i57j69i58.3369j0&sourceid=chrome&ie=UTF-8

 

[gregmcc]

They now have your IP and is going to come after you.

You are assuming they know what to do with said IP

 

[RichardG]

You are assuming they know what to do with said IP

A long auditing trial will be on the tables(At our expense). Just imagine sending out so many search warrants out, was quite surprised that it was freely accessible to everyone.

 

[rorz0r]

7 years later I notice the exact same vulnerability with another municipality that recently switched systems/providers. Is there a recommended way to report these things or is it not worth bothering (TIA)?