Hacker News Reader

Comment by NamTaf | Hacker News Reader

TWO file photos of shady hooded figures with obscured faces and glitch art effects or other digital overlays put over the pic! Truly, this is a very comprehensive report about hacking indeed.

On a serious note, I'm not at all surprised that my government's screwed up some sort of online database of private information. We had the famous census night access issues due to a DDoS and I am just waiting for that data to leak. It doesn't surprise me whatsoever when our government mismanages IT projects in particular and I suspect more of this sort of data leak is going to inevitably happen as a result.

ITifying all of the things isn't necessarily a good idea. Some things are honestly worth the extra hassle of being left to pen and paper.

View on HN

I'd encourage Australians to submit a privacy complaint. Every chance it will be "just for laughs", but never know, it might get a coherent response.

The URL with the Department of Human Services is:

https://www.humanservices.gov.au/customer/contact-us/submit-...

If they haven't responded to your satisfaction within 30 days, you can escalate the complaint to the Office of the Australian Information Commissioner.

https://www.oaic.gov.au/individuals/how-do-i-make-a-privacy-...

In a catch-22 move, the DHS complaint form tries to get you to submit your compliant via a MyGov account, but there is a button for submitting without an account, the direct URL being:

https://feedback.humanservices.gov.au/mcasite_feedback/feedb...

I mean, if the us can't keep its tools for hacking citizens safe, how can yours

> We had the famous census night access issues due to a DDoS and I am just waiting for that data to leak

That wasn't a DDoS, that was a few million Australians trying to use a poorly implemented system.

Risk Biz has more details [1].. Recommend the podcast!

* IBM and the ABS were offered DDoS prevention services from their upstream provider, NextGen Networks, and said they didn't need it.

* This plan was activated when there was a small-scale attack against the census website.

* Unfortunately another attack hit them from inside Australia. This was a straight up DNS reflection attack with a bit of ICMP thrown in for good measure. It filled up their firewall's state tables. Their solution was to reboot their firewall, which was operating in a pair.

* They hadn't synced the ruleset when they rebooted the firewall so the secondary was essentially operating as a very expensive paperweight. This resulted in a short outage.

[1] https://risky.biz/censusfailupdate/

I thought they blamed a DDoS by unknown parties in addition to the unexpectedly high load of us all trying to access it?

They tried blaming it on that, but it was just incompetence. They didn't even buy DDoS protection services.

There's more details on the inside story of the Census here: https://risky.biz/censusfailupdate/

"DDoS protection services" are a racket. Build the thing right and you don't want or need them.

You haven't worked in a govt department have you. In one meeting the BA Ministry lead fell asleep and actually started snoring. In another, the ministry infrastructure architect said, "oh, that thing, I've lost the word, what is it?" - "a server?".

As an ex antipodean govt contractor, I'm not even kidding. Many other stories of complete fuckwits who had no right to touch a keyboard, never mind run things. My conclusion was anyone with any smarts was completely bamboozled by the abject incompetence and left to the private sector, leaving behind the above characters. Unbelievable, but true. Saying that, don't believe me, get a job there and I see for yourself :)

Requiring them to buy DDoS protection would be part of the problem, not the solution.

My guess, based on what's publicly available, is that this incident is quite possibly just a set of stolen or misused creds for a fairly widely available Medicare card lookup database used by doctors. In which case, this is less of a "cyber security" issue and more an issue with fundamental system design/requirements. But we'll see.

One way to avoid this would be to limit the access of a doctor to patient records. Unless you give permission at a doctor/hospital to have them access your record, they won't be able to do a lookup. Retract the permission automatically/renew it once every X months. This would make stolen/misused creds a much smaller risk.

This runs into problems when the patient can't give permission e.g. because they are unconscious.

This is a problem that can be solved in a low tech way using a medical bracelet / necklace for patients who have chronic diseases that doctors might need to know about.

Somebody with sickle cell disease or otherwise transfusion dependent greatly benefits from electronic records, which help minimize antibody reactions (not just ABO and Rh, but Duffy, Kell, Kidd, MNS, etc)

So, this isn't access to patient records as such - it's merely access from a name to a Medicare number.

Additionally, how exactly are you going to get the patient to give permission beforehand? Patients will expect to walk into a medical clinic, hand over their card, and have it all just work.

This is just as likely to be a rogue employee/sysadmin as it is a actual hack. I wouldn't start placing blame until it's determined what the actual cause is.

If it is an employee or sysadmin, they are an idiot.

Its $30 a pop for small volume and large risk. If you have a job with access to this data you should be charging a hell of a lot more. But its enough to get someone in a poorer country with little at risk to create a fake gmail account and use it to bootstrap access to an online self service portal or whatever approach they are using.

Indeed. Assuming they have some kind of logs for legitimate use in place (X was logged in and requested X), how hard would it be to add a bogus record, request it and see who looks it up. If it's accessed and the logs are avoided, there's probably something leaky.

Assumption is a dangerous thing, however...

> If it is an employee or sysadmin, they are an idiot. Its $30 a pop for small volume and large risk

In this scenario, I expect a bad egg would've sold the records in bulk to a middleman for a high price.

Some blame can be placed up-front, at least potentially. Regardless of the _nature_ of the breach, if the data ought not to have been stored, the fault lies with those who decided to store it.

Privacy has never been a priority for the Australian government - its citizens simply don't have the right.

So there really shouldn't be much surprise over this. More importantly is that this story should educate Australians as to just how much their government values their privacy - sure, this will be hailed as a reason for even more political oversight over technological processes, but only for as long as there isn't a "legitimate corporate customer" for the Australian government, itself, to negotiate with, over ownership and control of this data.

Australia has much stricter privacy laws than many countries, and has had them for a relatively long time (starting in 1988 and updated since).

The privacy laws apply to government agencies and any non-government organisation with > $3m in turnover.

https://www.oaic.gov.au/privacy-law/privacy-act/australian-p...

Cool. All I need to get around this is a <$3m shell company and a few cronies in parliament.

(Until its in a Bill of Rights, its not protected. Also: see the Australian Constitution - not worth the paper its printed on)

You might wish to consult a lawyer about your theories.

In general, the legal opinions of non-lawyers are not worth the paper they're printed on.

Is there at least ONE country where IT projects are successful and with a normal price tag?

The lesson there is that people have unrealistic budget and schedule expectations of large IT projects. Same with defense, medicare, etc.

I think it's just with everything. I saw a tweet once that was something like: "If you ask a programmer how long an hour will take they'll tell you 45 minutes"

That's because they only count the part that they're working on. The rest of the Hour project includes standups, testing, documentation, deployment, retrospectives and post-mortems, team happy hours, ...

You forgot browsing HN -)

Estonia[0].

[0] - https://e-estonia.com/

I actually own the e-residency card, but forgot about the country. :-D

EDIT: Nevermind, the URL was changed my mod.

---

> TWO file photos of shady hooded figures with obscured faces..

Where are these photos? I see only one of a medicare card, and another of the 'auction'.

Reply on news.ycombinator.com