Hacker News Reader

Comment by chaps | Hacker News Reader

Heh, years ago I wanted to see if some mental health info of mine was accessible over the internet of a major university. Nothing fancy, just did a port scan of their IP range. I found that they had dozens of their psychology department's printers accessible over the internet.

So, I contacted their office, telling them that PII was likely accessible through these printers (through exploits), and asked that they look into why so many internal machines were accessible over the internet, and to at least remove the printers from the internet.

They responded by telling me that there were no internet-accesible printers and that their scans would have detected something like that.. and then asked that I send them any PII. I didn't, but... it truly felt like they were trying to set me up for throwing the blame my way.

It's really bad out there.

View on HN

Similar thing with my doctors in the UK . I found their online prescription renewal system allowed me to access other people’s prescriptions. I warned them about this and they threatened to report me to the police. I found this out because I couldn’t click the link in my mail client on my phone at the time so I typed the URL in incorrectly on my desktop PC.

So I moved doctors and reported them to the ICO. Never heard anything back but their web site disappeared for a month after a couple of weeks. I’d like to think they were fined but I don’t think that actually happened.

This was some piece of shit they had paid a local web design company, the lowest bidder, to put together. It was PHP, hosted in the USA on a shared server and didn’t even have TLS enabled.

You certainly seem to have had reasons to be concerned but suggesting that a piece of software is inherently vulnerable because it's written in PHP has no basis in fact.

It was scene setting. While you can do it, there’s a lot of terrible terrible nasty hellish PHP out there. The whole thing is a foot gun.

I spent 5 years fixing various messes written in it for people as a contractor in the mid 00’s.

I sometimes get these messages from people claiming my systems are open, but they're just new to port scanning "hurr hurr your port is open big bounty pls"

Make sure to display your knowledge when doing this, and honestly it couldn't hurt to have some evidence.

> honestly it couldn't hurt to have some evidence.

Yes it could. Often the well-meaning people who find and report vulnerabilities are the ones who get reported to the authorities.

Don't report anything at all if you're concerned about that.

So... just give up?

This mentality really bothers me -- your "don't bother me with your trifling banalities" snooty attitude is what makes it impossible for people like me to feel safe in reporting major leaks of health information. If you don't want to deal with it, find a new job.

If you think the other end is going to blame you for the data leak.. yeah? What other options are there?

You could report it anonymously but I'd have thought a HN user would come up with that option by themselves. Just in case though, you could report it anonymously.

Blame for a leak isn't the problem if a leak never happened, since the goal is to _prevent_ a leak through disclosure. Your snark makes it clear that you have little to no interest in trying to see the issue from the side of the person disclosing the issue, who at the end of the day is just trying to prevent lives from being ruined through simple negligence. Yes, people obsessed with bug bounties is a thing, but in contrast to the risk of ignoring a legitimate disclosure email, who cares?

The issue here isn't that someone would be blamed for a data leak - not even a bit. The issue is that there's a good chance that panicked management won't consider the disclosure as helpful, but instead as a genuine attack on their infrastructure and will get non-technical lawyers involved. Tons and tons of people have been sued from doing this.

Giving as little information as possible is _necessary_ to reduce the risk of being sued. That you, and people like you, think that little information is a waste of time is just sad, man. Think about it from the shoes of those who try to disclose, and the lives of people whose information is in the systems that you maintain. Get off your lazy high horse, spend the hour to review their email, do your fucking job, or get out.

Ok it really feels like you're either misinterpreting what I've said to vent some anger or I've misspoke. In any case the opinion you hold of me is not representative of my attitude towards security.

Of course I want to know about security issues. Actual security issues. I don't want some script kiddie pinging me about a port that's open trying to fish for a few grand because I'm the cunt that opened it! It's not an open printer or whatever nmap is telling you, it's probably a non-standard SSH port. Something someone with skill would figure out in a second.

If you find an open printer on my networks - send a printout to it. Say hello.

Have a good day.

I often wonder about this, does it help if you report a vulnerability as an LLC instead of as an individual?

If the printers are accessible from the internet, it should not be hard to demonstrate there being a problem.

For example, once a day, make them all print a page saying "Your printers are accessible over the public internet, which puts patient information at risk."

It's still very likely they'll try to shoot the messenger though.

Our perception is biased with bug bounty rewards covered by news articles, but in real life communicating some vulerabilities can trigger problems or being ignored at best. Institutions are hopelessly arrogant.

I would have printed the message using their printers. Maybe that would have been more effective?

I think the grandparent comment made the right call. It could have worked out well. Or perhaps the university would have taken disciplinary action against him for "hacking" the university computer system.

No good deed goes without punishment.

More effective, perhaps, but it's also dancing on the edge of the law. In the Netherlands the public prosecutor doesn't pursue cases of ethical hacking (afaik the other party can still file a civil case if there are damages though, and I would assume reputational damage counts), but they totally made a case against a person that claimed to be white hat but offered to fix the problem for around 20'000 euros. Specifically:

> De man nam contact op met de praktijk en meldde dat een kwetsbaarheid toegang bood tot de persoonlijke gegevens van artsen, waaronder e-mailadressen, gebruikersnamen, wachtwoorden en bankrekeningnummers. Vervolgens stuurde hij een offerte met het aanbod om voor 16.500 tot 23.000 euro de kwetsbaarheid te verhelpen. In die offerte stond volgens het OM een 'dreigende mededeling': "Er zal waarschijnlijk een boete betaald moeten worden wanneer dit openbaar is en er zal een flinke reputatieschade plaatsvinden." Het OM schrijft dat de politie na onderzoek constateerde dat op de laptop van de man de gevoelige persoonsgegevens stonden en dat zijn ip-adres te relateren was aan de inbraak.

From https://tweakers.net/nieuws/167792/om-eist-twee-maanden-cel-...

Summary translation: he found an issue in a doctor's office, told them "you'll probably get fined if this becomes public and there will be large reputational damage" and sent an offer for 16.5-23k euros for a fix. The public prosecutor saw the message as threatening (blackmail) and therefore decided this wasn't simply a white hat reporting an issue and offering legitimate services. Upon investigating, sensitive personal data was found on his laptop.

So is hacking into their printers to send a message proportional to the issue? I would say yes, but one might also argue this goes beyond what is strictly necessary to prove the issue. (Another guideline is that downloading your own PII to confirm an issue is fine, and that it can also be fine if you accidentally find PII but don't request more than that first record, but nothing beyond that.) You might argue that they didn't listen, but I don't know if that's an argument a judge finds compelling.

Different countries can have different systems, not sure how white hat hacking is treated in Iran, the USA, Brazil, or other countries that seem to enjoy putting a lot of citizens behind bars.

That's how security is at essentially every company but it's extra grim in the mental health/medicine world :\

Reply on news.ycombinator.com