The security flaw which exposed the private information of\u00a0City of Joburg and Ekurhuleni Municipality client invoices is more widespread than these two municipalities.<\/p>\n
What is of even more concern is the fact that the flaw is nothing new.<\/p>\n
The latest security vulnerabilities which exposed private information reported to MyBroadband included the Merafong Municipality and the Ghana visa application system.<\/p>\n
In the case of Merafong Municipality, incrementing the invoice number made it possible for residents logged in to the system to view other resident’s invoices.<\/p>\n
The Merafong IT department was contacted about the vulnerability, and the concerned citizen said he was thanked for reporting the problem. The municipality is investigating the issue.<\/p>\n
The Merafong IT department confirmed that they have been notified about the problem. They passed this information onto their service provider who is working to resolve the problem.<\/p>\n
A well-known independent security research company also showed this week that the online visa application system for Ghana had the same security flaw.<\/p>\n
Anyone logged in to the visa system can simply change the number in the URL to view another person\u2019s application. This application contained a range of private information associated with a visa application.<\/p>\n
Innobiz Holdings, the company behind the Ghana online visa application system, was alerted about the problem.<\/p>\n
The company thanked MyBroadband for bringing it to their attention, and said it will investigate the vulnerability with their security partner.<\/p>\n
MyBroadband spoke to a security analyst about the problem, and he said that people can expect this problem to pop up again and again.<\/p>\n
In fact, this vulnerability is so widespread that it is currently listed as number 4 in the Open Web Application Security Project\u2019s (OWASP\u2019s) Top 10 security problems<\/strong><\/a> with web applications and web services.<\/p>\n The security flaw, called \u201cInsecure Direct Object References<\/strong><\/a>\u201d, occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key.<\/p>\n \u201cWithout an access control check or other protection, attackers can manipulate these references to access unauthorized data,\u201d the OWASP website states.<\/p>\n In simple terms it means that an attacker, who is an authorized system user, simply changes a parameter value (like a number in a URL) that directly refers a system object to another object the user isn\u2019t authorized for.<\/p>\n In the case of the City of Joburg the vulnerability was even worse because an attacker did not even have to be logged in to view unauthorised files.<\/p>\n According to the security analyst, this security flaw in a web system points to a lack of knowledge about online security, sloppy design, and a poor security evaluation of a system.<\/p>\n He said that a proper evaluation of the system by a qualified security analyst before launch will pick up these problems and assist to create more secure systems.<\/p>\n The OWASP report also states that the vulnerability is easy to detect, raising the question why it slipped through with high profile systems in South Africa.<\/p>\n The City of Joburg could not immediately comment on the security vulnerability.<\/p>\n Joburg security whistleblower responds<\/strong><\/a><\/p>\n City of Joburg opens criminal case against \u201chacker\u201d<\/strong><\/a><\/p>\n True story behind Joburg\u2019s online security problems<\/a><\/strong><\/p>\n Massive security flaw exposes Joburg residents\u2019 private info<\/a><\/strong><\/p>\nMore on the City of Joburg security issue<\/h3>\n