SANRAL E-TOLL WEBSITE VULNERABILITY

So there are going to multitudes of billing errors, as I have already seen happening ?

Yes there will be. They also said in a media statement it will be corrected. So, what I suspect is that they are working on implementing a newer version and will then correct the invoices.

Personally I think they kept using the old database mainly due to the time period in which invoices have to be issued.
 
The truth behind the whole e-Natis affair is that e-Natis is not able to offer them direct access to their system, due to the large number of queries, which will cause the system to fall over. Instead, it was decided that e-Natis will provide them with a copy of their database, which will be updated on a regular basis.

What happened after this is quite clear. Either they never received any updates or they do not have the technical expertise to keep the data updated. They are basically working from a 2-3 year old e-Natis database at this time.



Agreed, I would also like to see where they got their other data from. I am almost willing to bet a lot of money that they bought data from banking institutions and retail institutions. I know the sale of data between banks, insurance and retail companies is a huge business today.

Are You being Serious, if you don't know what you are talking about rather say nothing.

Do you honestly think that CPA members are going to risk selling data or even swop data, get real.
 
To no one in particular.

When you continually bash your head against the shoddy walls of an RDP dwelling, don't be surprised when the walls come crashing in, and if you expected a different result, the dwelling achieved its mission of driving you to insanity.

Pay no attention to the dwelling and it will have no effect on you.
 
Code:
"access" includes the actions of a person who, after taking note of any data, becomes aware of the fact that he or she is not authorised to access that data and still continues to access that data

1 You need to be a person. Difficult to prove you are not a person - rather accept this fact. :(
2 You need to have taken note of any/some/the data. It is quite easy to not take note of data: Just do not write it down jinne. :D
3 You need to become aware that you are not authorized to access said data. It is quite easy to not become aware that you are not authorized to access said data: The server served up the data with http 200 codes galore and not single 403 code or even an error page! :D

How on earth are you supposed to know when you do or do not have permission to access a particular piece of data? Should I be phoning the [insert Company name here] customer care line each time after accessing their website to establish what info I am allowed to access? Heckno. We use the mechanisms available to us to lead the user to what info we deem he may have access to or not.
 
Are You being Serious, if you don't know what you are talking about rather say nothing.

Do you honestly think that CPA members are going to risk selling data or even swop data, get real.

This happens on a daily basis, I know this from personal experience.

Code:
"access" includes the actions of a person who, after taking note of any data, becomes aware of the fact that he or she is not authorised to access that data and still continues to access that data

1 You need to be a person. Difficult to prove you are not a person - rather accept this fact. :(
2 You need to have taken note of any/some/the data. It is quite easy to not take note of data: Just do not write it down jinne. :D
3 You need to become aware that you are not authorized to access said data. It is quite easy to not become aware that you are not authorized to access said data: The server served up the data with http 200 codes galore and not single 403 code or even an error page! :D

How on earth are you supposed to know when you do or do not have permission to access a particular piece of data? Should I be phoning the [insert Company name here] customer care line each time after accessing their website to establish what info I am allowed to access? Heckno. We use the mechanisms available to us to lead the user to what info we deem he may have access to or not.

The court will simply apply the 'Reasonable man' test. The reasonable man is an average person who abides by laws. If the reasonable man accessed a statement containing personal identifiable information of another will he know whether he had permission? Obviously he knows he had no permission (Why does the reasonable man know he has no permission? Because the law says he may not). The reasonable man test is being used in almost 99% of all criminal cases, so, good luck with your version :)
 
Which seems to be what SANRAL is doing ???

You may have something there. POPI section 12, point 2d makes provision for information to be collected from a 3rd party by any public party for prevention, detection, investigation, prosecution and punishment of offenses. But the act is not effective yet.

Is there any current act that covers this?
 
You may have something there. POPI section 12, point 2d makes provision for information to be collected from a 3rd party by any public party for prevention, detection, investigation, prosecution and punishment of offenses. But the act is not effective yet.

Is there any current act that covers this?

Nope.

Had Popi been in effect, this would have been a total different ball game... added that if evidence was readily available that they illegally obtained information.
 
This happens on a daily basis, I know this from personal experience.



The court will simply apply the 'Reasonable man' test. The reasonable man is an average person who abides by laws. If the reasonable man accessed a statement containing personal identifiable information of another will he know whether he had permission? Obviously he knows he had no permission (Why does the reasonable man know he has no permission? Because the law says he may not). The reasonable man test is being used in almost 99% of all criminal cases, so, good luck with your version :)

A reasonable person will only know they don't have permission after accessing the data. :rolleyes:
 
Nope.

Had Popi been in effect, this would have been a total different ball game... added that if evidence was readily available that they illegally obtained information.

Huh, Sanral is able to gather third party info when the act becomes effective. That is what the provision if for in section 12, point 2d. If they are doing it currently and there is no provision in the law then it is illegal.
 
A reasonable person will only know they don't have permission after accessing the data. :rolleyes:

Precisely.

You are not charged when you access the data.

You are charged when you access the data, become aware you are not authorized, and still continue to access it.

See the extract of the specific sections I posted.
 
What newbies? That one-time poster is a fellow forumite. Hope his 'internet skills' are good, if not - we will soon know who he is in any event if Sanral decides to press charges.

The only newbs here are the dev's responsible for Sanral's site
 
Huh, Sanral is able to gather third party info when the act becomes effective. That is what the provision if for in section 12, point 2d. If they are doing it currently and there is no provision in the law then it is illegal.

Firstly, good luck finding evidence that they are obtaining data illegally. At this time no one knows where exactly they are getting the 'other data' from.

Secondly, while there still is a 2+ year time period before the act is enforced, good luck finding a court willing to institute prosecution.
 
This is almost better than Mafia.

I wonder if these debates are going to make it into the mainstream media.

The implications of the Act as presented here is horrifying, and dare I say it bordering on unconstitutional (just my non legal opinion before anyone gets their undergarments in a knot)
 
Top
Sign up to the MyBroadband newsletter
X