{"id":86311,"date":"2013-09-09T10:00:27","date_gmt":"2013-09-09T08:00:27","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=86311"},"modified":"2013-09-09T10:01:36","modified_gmt":"2013-09-09T08:01:36","slug":"joburg-hacking-case-why-you-may-get-angry","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/86311-joburg-hacking-case-why-you-may-get-angry.html","title":{"rendered":"Joburg hacking case: why you may get angry"},"content":{"rendered":"

The Police\u2019s Hawks commercial crimes unit confirmed that it is investigating the City of Joburg<\/a> website security issue which exposed its ratepayers\u2019 personal information.<\/p>\n

This news drew sharp criticism from online commentators, saying taxpayers\u2019 money is wasted trying to cover up incompetence.<\/p>\n

The security flaw was first reported online on Tuesday, 20 August 2013. The City of Joburg initially said the information about the discovered flaw was helpful to them, but later began to describe the incident as a malicious hack.<\/p>\n

The City of Joburg then decided to open a criminal case against the person who \u201chacked into its billing system\u201d.<\/p>\n

It is debatable whether the incident can be described as a hacking. In fact, a security analyst told MyBroadband that the security flaw is a very common mistake made by developers.<\/p>\n

He said that the City of Joburg\u2019s security flaw points to a lack of knowledge about online security, sloppy design, and a poor security evaluation of a system.<\/p>\n

City of Joburg cover up, argue online commentators<\/h3>\n

Many online commentators argued that the City of Joburg\u2019s criminal case is merely an attempt to cover up their poor system design and own incompetence, and try to blame it on a \u201chacker\u201d.<\/p>\n

There are also arguments that, rather than opening a police case, the whistle-blower should have been rewarded for highlighting this security flaw.<\/p>\n

The whistle-blower, BidorBuy<\/a> CTO Gerd Naschenweng<\/a>, first tried to alert the City of Joburg directly, but they were unable to assist. He then turned to MyBroadband to ensure that the problem was addressed.<\/p>\n

Trying to stop people from reporting such security flaws means that systems may remain vulnerable for years. It means that cyber-criminals can exploit these flaws, but concerned citizens may not report them to draw attention to the fact that something must be done.<\/p>\n

Gerd Naschenweng responds<\/h3>\n

Naschenweng said that he currently does not have much information about the case. \u201cMy legal team has asked CCU for extra information yesterday, and we are unsure when we will get it,\u201d he said.<\/p>\n

\u201cWe have no insight into the actual complaint, but do know that I seem to be the only person named in the COJ complaint lodged with SAPS,\u201d said Naschenweng.<\/p>\n

In a post on MyBroadband, Naschenweng made the following comments about the issue:<\/p>\n