Website security flaws in SA: why shoot the messenger?

[House]

There is a reason for the US having a whistleblower protection act. In the mind of a government agency having a massive security flaw or a faulty multi-billion-Rand billing system it is obvious that anyone highlighting issues will be "on the wrong side of the law" and will be branded as malicious, or hacker or anything else to distract from the actual problem.

Forbes themed 2014 as the year of the whistleblower and recent incidents such as NSA are just the beginning where the internet community will take companies and governments to task. Just because a government believes something is right, does not mean it has to stay this way - otherwise we would still be stuck with apartheid in South Africa and nazi's roaming Europe. I think your view is very narrow-minded and wrong at best most of the times.

It is also very naive to think that just because no-one raises an issue, no problem exists. I can guarantee you that right at this moment thousands of hackers are targeting websites all over the globe - you are just not aware of it, as no-one informs the public about it. Any MyBB member working for an ISP or within networking at corporates will know about the number of DDoS attacks, phishing attempts and brute-force attacks targeting their companies having occurred at their premises within the last few weeks.

Good citizenship demands to inform the public and the government of issues and try to assist in resolving the problems at hand - unfortunately sheer arrogance does not allow for a proper conversation in this regard.

I totally agree with your statement, but again, there is a right way and a wrong way in doing this. Just compare the other two reports (Cell C and VC) with yours.

 

[biometrics]

I totally agree with your statement, but again, there is a right way and a wrong way in doing this. Just compare the other two reports (Cell C and VC) with yours.

Actually there is no right or wrong way. In your opinion maybe there is.

 

[House]

Actually there is no right or wrong way. In your opinion maybe there is.

You need not have a very high IQ to realize that there is a right and a wrong way in blowing the whistle.

 

[Shake&Bake]

It's time you reveal your identity and who you represent.

It is clear you are here with an agenda.

In fact you should register as a rep on this forum.

+100

I totally agree with your statement, but again, there is a right way and a wrong way in doing this. Just compare the other two reports (Cell C and VC) with yours.

What is to be done after numerous attempts to contact the CoJ fall on deaf ears?
And if you look at what Jannie said earlier - other flaws have been mentioned here before and they thanked the person reporting it.

Being of the opinion that the current revelations opened up a gateway for criminals to "suddenly swoop in and mine for data" is short sighted, if not chilidish - if one looks at the steps taken in retaliation.

If whistleblowers have no protection - who is going tell on government?
Are we in need of another Black Wednesday?

 

[biometrics]

You need not have a very high IQ to realize that there is a right and a wrong way in blowing the whistle.

In your opinion.

 

[rwenzori]

No criminal charges have been laid. A complaint was opened with Saps and is investigated. The complaint named me as the sole "hacker". A warning statement was issued by me almost 4 months ago and we are now all waiting

I wouldn't worry. In spite of House's bs, the only way that will ever get to court is if there is a corrupt paid-off prosecutor, or one who is a total flukwit. Not that those cannot be found, I suppose, but any "reasonable man" would fall on the floor laughing at the charge.

 

[DJ...]

In all fairness towards the companies involved, the article needed to emphasize the manner in which the incidents were reported:

CellC and Vodacom (No criminal charges)

- Reported to the companies - hacks not made public for others to follow

Sanral and COJ (Criminal Charge & Threat of Criminal Charge)

- Reported to companies and hacks published in public forums

I agree, COJ did not respond, their system was flawed, but the manner in which it was made public was the differentiating factor. Had CellC and Vodacoms' hacks been published on this forum, criminal charges would also have been laid.

I doubt it. It previously happened to Vodacom if I am not mistaken, and they also thanked the guy who posted it...

It is indeed my opinion and I am 100% sure that if a public forum post appeared anywhere on how the public can access their system and view other people's data they would indeed have pressed charges.

Vodacom would not have laid criminal charges. It'll be like kicking a landmine to get rid of it....

 

[HelterSkelter]

LOL, I wonder will will happen if someone, for example, post a security flaw of say Toyota Fortuners online, just whistle blowing, and post the complete method on how to open and start the engine and drive away. Or what to do with a key to open other locks, or how to use a gate remote to...

 

[House]

+100



What is to be done after numerous attempts to contact the CoJ fall on deaf ears?
And if you look at what Jannie said earlier - other flaws have been mentioned here before and they thanked the person reporting it.

Being of the opinion that the current revelations opened up a gateway for criminals to "suddenly swoop in and mine for data" is short sighted, if not chilidish - if one looks at the steps taken in retaliation.

If whistleblowers have no protection - who is going tell on government?
Are we in need of another Black Wednesday?

Don't get me wrong here, but the media knows how to report on such incidents, MyBB as well. They know what they are allowed to publish and what not. So, by reporting the incident to MyBB reporters would have been sufficient. The information would have been made public, but not in the way it was done by the whistleblower.

No, I know for a fact that criminals are constantly looking for information. Not only fraudsters, but people dealing in buying and selling of databases. This forum would become a criminal haven for these people to identify flaws and steal such information if MyBB would allow people to keep publishing flaws in public. In fact, sooner or later, government will jump in and act against MyBB if this is to happen.

Whistleblowers do have protection, but again they need to play by the rules. Being a whistleblower does not allow you to break any laws or take them into your own hands.

 

[Shake&Bake]

Don't get me wrong here, but the media knows how to report on such incidents, MyBB as well. They know what they are allowed to publish and what not. So, by reporting the incident to MyBB reporters would have been sufficient. The information would have been made public, but not in the way it was done by the whistleblower.

No, I know for a fact that criminals are constantly looking for information. Not only fraudsters, but people dealing in buying and selling of databases. This forum would become a criminal haven for these people to identify flaws and steal such information if MyBB would allow people to keep publishing flaws in public. In fact, sooner or later, government will jump in and act against MyBB if this is to happen.

Whistleblowers do have protection, but again they need to play by the rules. Being a whistleblower does not allow you to break any laws or take them into your own hands.

You sir, need:

 

[House]

You sir, need:

But I am right in saying that, unfortunately.

 

[biometrics]

But I am right in saying that, unfortunately.

In your opinion.

And we still don't know who you are, who you represent and what your agenda is.

Many of us are known here. Why would you not reveal yourself?

 

[Shake&Bake]

But I am right in saying that, unfortunately.

Criminal havens are on the ToR side of the web, not here.

I know a bit about syndicates and stolen information and the like.
And its not happening here.

Whistle gets blown, company takes heed, implements changes and Bob's there uncle.

If you think that this community is filled with the kinds of elements that you're alluding to in your prior posts.
You should really out yourself, title and position held and then register with those details please.

If you're of the opinion that there are such unsavoury characters here en masse, then your last 8 years spent here have shown you nothing and I would think that this entire forum takes great offense to your insinuations.

 

[koeksGHT]

In your opinion.

And we still don't know who you are, who you represent and what your agenda is.

Many of us are known here. Why would you not reveal yourself?

1st rule of acting. Never break character

[video=youtube;kKTMA_Kb9Zg]http://www.youtube.com/watch?v=kKTMA_Kb9Zg[/video]

 

[Paul Hjul]

Semantics.

Criminal charges have been laid and is under investigation. Once the investigation is completed the prosecutor will decide upon prosecution.

you really need to learn the meaning of the word semantics
the law is all about words and their meaning

a criminal complaint can be laid at the police who investigate, charges are brought by somebody with title to bring charges - ordinarily the prosecuting authority - the court adjudicates on charges. To speak of charges when there are none is to bring the administration into disrepute.

 

[House]

Criminal havens are on the ToR side of the web, not here.

I know a bit about syndicates and stolen information and the like.
And its not happening here.

Whistle gets blown, company takes heed, implements changes and Bob's there uncle.

If you think that this community is filled with the kinds of elements that you're alluding to in your prior posts.
You should really out yourself, title and position held and then register with those details please.

If you're of the opinion that there are such unsavoury characters here en masse, then your last 8 years spent here have shown you nothing and I would think that this entire forum takes great offense to your insinuations.

You are wrong. Criminal syndicates operate everywhere. There are many here on MyBB. In your past few years you may have seen a number of forumites being ripped off by fellow forumites. Syndicates do not participate in discussions. They monitor and work silently from there. But, if you know so much you should at least know that.

It appears you are just seeking justification for the way in which these incidents were reported, but there are none.

 

[biometrics]

You are wrong. Criminal syndicates operate everywhere. There are many here on MyBB. In your past few years you may have seen a number of forumites being ripped off by fellow forumites. Syndicates do not participate in discussions. They monitor and work silently from there. But, if you know so much you should at least know that.

It appears you are just seeking justification for the way in which these incidents were reported, but there are none.

Ha ha ha ha. Man you're funny.

 

[House]

you really need to learn the meaning of the word semantics
the law is all about words and their meaning

a criminal complaint can be laid at the police who investigate, charges are brought by somebody with title to bring charges - ordinarily the prosecuting authority - the court adjudicates on charges. To speak of charges when there are none is to bring the administration into disrepute.

LOL

 

[Shake&Bake]

You are wrong. Criminal syndicates operate everywhere. There are many here on MyBB. In your past few years you may have seen a number of forumites being ripped off by fellow forumites. Syndicates do not participate in discussions. They monitor and work silently from there. But, if you know so much you should at least know that.

It appears you are just seeking justification for the way in which these incidents were reported, but there are none.

So take down Gumtree while you're at it
Because that's the level of ripoff's that's happened here.

If we're talking sophisticated stuff like c/card theft and server access - its not happening here.
You're still avoiding you connection to these matters I (and others surely) notice.

 

[House]

So take down Gumtree while you're at it
Because that's the level of ripoff's that's happened here.

If we're talking sophisticated stuff like c/card theft and server access - its not happening here.
You're still avoiding you connection to these matters I (and others surely) notice.

No, you clearly do not understand what I am saying. Probably some cultural / linguistic difference between us. Let's try again.

There is a right and wrong way to blow the whistle on an unsecure website.

The wrong way is to go public and inform people thereof and showing them how to access the site and information. By doing this you open the door to criminals to stick around and wait for such reports. You are placing people at risk. No matter how you want to justify that.

The right way is to inform the public, but do not post full detail. If you are not sure, rather report it to the media. They will know how to report.

If you do it the wrong way you open yourself to prosecution. Companies are within their rights to press charges.

I cannot support a company who knows that someone posted a security flaw, which allowed the general public to access and view personal information and they refuse to investigate the incident. This is not right. If I was a client and a flaw was posted, I will open a criminal charge myself and force the company to become involved in the investigation, I will not leave that decision to them.

I think the COJ did the right thing taking the circumstances into account - no matter what the outcome will be.