Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Privacy Breach In Canadian Passport Application Site

Posted by kdawson on Wed Dec 05, 2007 05:26 AM
from the didn't-need-that-old-identity-anyhow dept.
Joanna Karczmarek sends us news of a massive privacy breach in the Government of Canada passport website. "A security flaw in Passport Canada's website has allowed easy access to the personal information — including social insurance numbers, dates of birth and driver's license numbers — of people applying for new passports. ... The breach was discovered last week by an Ontario man completing his own passport application. He found he could easily view the applications of others by altering one character in the Internet address displayed by his Web browser."
+ -
story

Related Stories

[+] Your Rights Online: EU Plans to Require Biometrics for Visitors 238 comments
bushwhacker2000 writes to tell us that the EU may soon be requiring travelers to provide biometric data before crossing into Europe. They are trying to soften the blow by offering "streamlined" services for frequent travelers but the end result seems the same. "The proposals, contained in draft documents examined by the International Herald Tribune and scheduled to go to the European Commission on Wednesday, were designed to bring the EU visa regime into line with a new era in which passports include biometric data. The commission, the EU executive, argues that migratory pressure, organized crime and terrorism are obvious challenges to the Union and that the bloc's border and visa policy needs to be brought up to date."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • Wonderful (Score:5, Interesting)

    by Grey_14 (570901) on Wednesday December 05 2007, @05:31AM (#21583145) Homepage
    Odd's are, lots of people are applying for passports nowadays too, since apparently we Canadians need them to cross the border into americaland in the near future.
  • by Smordnys s'regrepsA (1160895) on Wednesday December 05 2007, @05:36AM (#21583165) Journal
    3...
    2...
    1...

    Breaking News, a L33t Canadian Hacker broke into a national security site, stealing millions of Dollars worth of personal information.

    No word yet on any arrests.

    More at 11.
  • 31337 h4x0r (Score:4, Funny)

    by martinX (672498) on Wednesday December 05 2007, @05:41AM (#21583183)
  • by TheeBlueRoom (809813) on Wednesday December 05 2007, @05:43AM (#21583191) Homepage
    Sounds like some web monkey needs a beating....
    • *Waves hand in the air* I am not the monkey you are looking for.
    • Re: (Score:3, Insightful)

      Where do these people get educated anyways? And how much of my tax dollars are going to pay for this incompetence?

      This is such a simplistic error - it means that there are more simplistic errors hiding in the website as well, not only this one.

      passport security is so important, why don't they audit the website BEFORE it goes live?

      --jeffk++
      • Re: (Score:3, Insightful)

        passport security is so important, why don't they audit the website BEFORE it goes live?

        Because those directly responsible for the bad design have little, if any, liability for screw up. They aren't out any money. Their information isn't public/stolen. They don't face jail time, and it's unlikely their career will take any real hit assuming they can be identified at all.

        BTW, it *may* not be the coders that are responsible for the bad design. More than once I've been directly ordered by my past bosses

        • Re: (Score:3, Interesting)

          Consultants. Consultants. Consultants. Consultants. Consultants. *throws chair*

          Having previously worked there (the Passport Office), and it's probably the same in every other government branch, I think the big dumb gaping hole comes from outside consultants. Someone applying for a tenured job has to go through various screening processes, and while the screening isn't super-duper, it's still better than nothing. Consultants only need to win a bidding war (if at all), and of course the people who bid low o
          • Re:Bad Monkey!!!! (Score:5, Insightful)

            by Hotawa Hawk-eye (976755) on Wednesday December 05 2007, @09:53AM (#21584757)
            What if the boss had these options:

            Option A and B: A & B achieve identical functionality but B comes with an enormous security breach. Implementing A costs one million dollars more than implementing B.

            WWDPHBD? [What Would Dilbert's Pointy Haired Boss Do?]
    • Sounds like some web monkey needs a beating....

      While some grade D web monkey made a fundamental mistake, you have to look towards management for this. Or it will happen again. Where was the pen testing? Peer code review? Design review? (Assuming it was designed and not hacked).

      I am NOT a government insider but have visited the government web sites enough to know how it's I/T operates. It is operated by department level politics and fragmented so bad it has no effective leader or policies. Sort of l

  • Not so much a security flaw is it is incompetence. How could the developers miss this? Oh, here's the sweet part. They said the flaw was repaired on Friday. And from the article...

    But after the website resumed operation yesterday afternoon, a few keystrokes sufficed to reveal some of the personal information of passport applicants, including names, addresses and numbers for references and emergency contacts

    HAHA! "URL HACKING" is easy to protect against. Maybe they've gone so high tech in security
    • Most web developers know about url hacking but don't care at all. Especially externally contracted ones.
      Heh, i'm responsible for internal testing, and when i find such things, even our internal developers usually say: 'who cares' :)

    • Not so much a security flaw is it is incompetence. How could the developers miss this? Oh, here's the sweet part. They said the flaw was repaired on Friday. And from the article...

      And absolutely nothing in the management process to stop it.

      Code reviewed, probably not.

      Code designed, not likely,

      Security risk assessment, obviously not.

      Formal security model reviewed? Not likely.

      Project management? Incompetent.

      Software design process, absent.

      Specifications document? Probably not.

      Pen testing, obviousl

  • Wow (Score:5, Informative)

    by asifyoucare (302582) on Wednesday December 05 2007, @06:04AM (#21583307)
    This is a simple and fundamental error and I'm amazed that the 'security technique' made it into production on such a major site. Doesn't ANYONE know what they're doing. Geez, this is Web Security 101.

    A lot of sites were vulnerable to this sort of thing in 1995 ... If you're going to make URLs user or session specific you need very long random-looking strings.

    Who wants to bet that the 'unrelated problem' that resulted the the site shutting down was SQL injection. If you're stupid enough to allow access to other people's details via slight URL changes, you're probably also stupid enough not to check or parameterise form fields.

    • Re: (Score:2, Insightful)

      by Anonymous Coward
      Essentially all web development technologies are shit. It doesn't matter if they were using Perl CGI scripts, PHP, some JSP-based framework, ASP, ASP.NET, ColdFushion, Ruby on Rails, Django, or whatever other language/framework/technology you want to consider.

      The evolutionary nature of the web has lead to such technologies that just don't mesh well with one another. Bring SQL and JavaScript into the mix, and now you can be mixing four or five different languages in one web application. Most developers don't
          • I haven't developed commercially in a while, but it was my understanding that for these larger sites the job would be split up.

            One group is in charge of layout.
            Another group is in charge of content (graphics, sounds, text).
            Another one or two groups is in charge of client/server side scripting.
            Another group is in charge of security.
            And a final group is in charge of putting everything together.

            ...and the idea that 3 and 4 are separate and distinct is probably what caused this whole problem in the firs

    • Re:Wow (Score:5, Funny)

      by tttonyyy (726776) on Wednesday December 05 2007, @07:05AM (#21583615) Homepage Journal

      Who wants to bet that the 'unrelated problem' that resulted the the site shutting down was SQL injection. If you're stupid enough to allow access to other people's details via slight URL changes, you're probably also stupid enough not to check or parameterise form fields.
      I blame that Canadian called '; drop table passport_info -- ' and password = ''; myself.

      Irresponsible name to have these days.
      • Re:Wow (Score:5, Informative)

        by MMC Monster (602931) on Wednesday December 05 2007, @09:05AM (#21584327)
        ObXKCD link: http://xkcd.com/327/ [xkcd.com]
      • Re: (Score:3, Interesting)

        I've always wondered quite how far into unpronounceability (and indeed unprintability) names are allowed to venture. Merely giving your child a name with a formfeed in it would probably cause chaos enough.

        I've also long wondered what the perpetrators of these text-string-passing SQL bindings were on. That's an 'idea' that just isn't one!

    • Doesn't ANYONE know what they're doing
      No. Basically the majority of all Canadian government projects go badly and go overbudget, not just a wee little bit, but a whole metric fuckload - incompetence and lack of any accountability are systemic problems in virtually every government project. Possibly even corruption.

      One famous example is the gun registry - now I don't want to start a flame war about the registry, but I feel it is the best example of complete incompetence on the part of a Canadian government p
    • The article you link to was published yesterday. Exactly how recent does news have to be to escape your oldnews epithet?

      As an aside, I see we are dealing with yet another IIS server. What is it with IIS installations and dodgy security?
    • http://www.cbc.ca/consumer/story/2007/12/04/passport-security.html?ref=rss

      Yeah - but weird things start coming up when you change the ref=rss to ref=rsr.
  • Basic Encryption? (Score:3, Interesting)

    by LaskoVortex (1153471) on Wednesday December 05 2007, @07:11AM (#21583649)
    I'm guessing the database the info comes from is not even encrypted. One could come up with half-a-dozen schemes to prevent this. Here's one: every sensitive record in the database is encrypted with a unique key that is mapped to each session via a very long random number generated on a per-session basis. This random number would be used to decrypt the information in the database (combining, of course, with a server-side key to reconstruct a "permanent key"). So each client-side key would be able to decrypt one and only one sensitive record, making a one-session to many-record scenario impossible. Key-pairs would be generated on a per-session basis from a database of permanent keys that are themselves encrypted and served by a key server. I hereby patent this protocol. Please send me money if you use it or I will sue you.
    • Re:Basic Encryption? (Score:4, Interesting)

      by CastrTroy (595695) on Wednesday December 05 2007, @08:50AM (#21584191) Homepage
      I think the problem doesn't even go as far as encryption. From what I understand, it seems like they were using incremented integers as session codes, instead of using big randomly generated strings. Just doing this will make you system a lot more secure. It doesn't really matter if the information is encrypted on the back end. If you can guess the session code (by incrementing your own by 1), then you effectively become that user, and it doesn't matter if the data is encrypted in the database or not. Likely, the only thing encrypting the actual data would counter against is an internal attack. However, you'd still need to have a table somewhere linking the user session to the data encryption key. You could probably encrypt this table with some secret machine key, but still the data would be readable. You could probably make the internal hacker run around in circles to get the data, but you wouldn't really be too effective in stopping them.
  • by loraksus (171574) on Wednesday December 05 2007, @07:46AM (#21583813) Homepage
    Basically the majority of all Canadian government projects go badly and go overbudget, not just a wee little bit, but by a lot - incompetence and lack of any accountability are systemic problems in virtually every government project. Corruption too.

    One famous example is the gun registry - now I don't want to start a flame war about the registry, but I feel it is the best example of complete incompetence on the part of a Canadian government project and "how stuff like this can happen", so bear with me for a bit.

    The registry was supposed to cost 2 million (with a M) dollars when it was "sold" in 2000. They've so far spent well over a billion (with a B) and the CBC was leaked documents from a reputable source that place the cost at 2 billion dollars. BTW, there are still fairly significant fees for the license and registration portion - paid by the person who wants to own the firearm.

    I'm honestly not sure who got / gets the money, but clearly, a (2?) billion (plus?) dollars goes to someone, and they are getting a sweet, sweet deal. It's basically a complete failure too - while numbers vary, there is a significant discrepancy between the number of guns registered and the number believed to be in Canada. A frequently quoted statistic is "just under 7 million registered while estimates from the '70s indicated ~10 million firearms in Canada"
    At this point, only one province (Quebec) will prosecute people who didn't register their firearms (the decision to prosecute is left to the province), there are substantial problems with the quality of the data in the database (to the point where a number of high profile police chiefs have called for it's abolishment).
    Yes, we have 3 territories too, where firearm laws are pretty much ignored.

    Tying it in with this article - there are allegations that either the registry has been hacked - or (far more likely) some people with access to the registry are using the registry to find gun owners with large collections to rob. We've had a number of robberies of collectors homes recently.

    Other wonderful Canadian projects include buying dented (one apparantly hit a whale) and leaking submarines from the UK for far more than they were worth, a quarter-million dollars for a sculpture made of guns, $100,000 for a book about dumb blondes, and $250,000 to sculpt the face of St. Jean the Baptist on a hillside in Quebec by cutting and planting trees - the list goes on and on.

    Unfortunately, the Canadian government feels that it can just piss away public money without any repercussion - which it can. Nobody will get fired for this, and the folks who designed the passport site will continue to get contracts. I'd be willing to bet the same folks that did the gun registry worked on this project.
    • "Basically the majority of all Canadian government projects go badly and go overbudget, not just a wee little bit, but by a lot - incompetence and lack of any accountability are systemic problems in virtually every government project. Corruption too."

      Fixed version:
      Basically the majority of all government projects go badly and go overbudget, not just a wee little bit, but by a lot - incompetence and lack of any accountability are systemic problems in every government project together with corruption and bri

  • by Richard Kirk (535523) on Wednesday December 05 2007, @07:56AM (#21583867)

    This is not just a moan - it is a serious question.

    In the UK, every large computer project since the Navy sponsored the Babbige engine seems to end up running hugely over budget and time, and often delivering nothing. Often, many of these projects could have been done on standard equipment from the high street shop. Remember the 10 lb military wearable computer and radio that did little more than a mobile phone? The recent leak of disks with 25 million UYK residents' personal information, most of which was not wanted by the people it was going to was not removed because that was 'too labour intensive'. A few lines of perl, tops. If they want to send discs, then can send discs of random numbers, and do one-time pad encryption. If you have a proper source of random numbers, then provided the discs arrive with the seals intact, they can send the actual data XORed with the one-time pad. Not exactly rocket science, any of this.

    The usual explanation is a lack of market forces. State projects tend to get offered to contractors with vetted personnel, contractors who have done similar projects before. If you have a military requirement then your choice is restriced to positively vetted people who don't mind working on such stuff. Certainly, in the UK, there seems to be a cosy relationship between the state and the contractors. I am not sure I altogether buy this explanation. If there really is a free market, then more talented people ought eventually to come to the top if the contracts are so lucrative,

    Perhaps the problem lies with the national interest. The UK government would have to prever UK companies to overseas ones. Sometimes the competition has to come from outside a country. 20 years ago, prescription glasses used to be expensive and took a week to arrive. If you were going to the US, you could take your prescription, and get a pair made in an hour. Now you can get the same service in the UK. In the US, it is hard to get a mobile phone unlocked - it is looked on as illegal, but in the UK this is commonplace. IN both cases, I don't think there was anyhing that was actively preventing competition: it just wasn't happening.

  • We get "Service Alerts" with "helpful" information for how we're supposed to do business. Some of these "Service Alerts" contain information that, apparently, only certain people are supposed to know. As a result, they are password protected.

    If you save the webpage, the default filename that it will save as is also the password for the super-secret information.

    So, this story doesn't surprise me.
  • It's ASP.NET, which the Canadian Government has swallowed hook, line and sinker.

    And third-rate programmers using it.
  • by vinn01 (178295) on Wednesday December 05 2007, @03:09PM (#21589227)

    I recall at least a couple cases of guys getting charged with hacking for altering URLs.

    I'm not sure that I would have reported this if I had discovered it. Your mileage may vary.

      • by meringuoid (568297) on Wednesday December 05 2007, @06:53AM (#21583543)
        It's not unusual to go to a mall, and see 45% to 50% of the people who are clearly not born in Canada. This is evident from their clothing, their mannerisms, and especially their near-complete lack of knowledge of English or French.

        I wouldn't say Americans are that bad at English...

        • I wouldn't say Americans are that bad at English.

          The problem is not knowing when it's proper to insert "eh", and not always making things like "about" sound like "aboot".

          There's a lot more that goes into sounding Canadian than just making your whole head flap.
        • by kndyer (521626) <kndyer@gmai[ ]om ['l.c' in gap]> on Wednesday December 05 2007, @09:02AM (#21584289)
          As a fourth generation Canadian, I too have met a large number of Canadians. While I have no intention of defending the AC, I resent the absurd generalization that Canadians are uneducated and racist. With any large sampling of people, you will encounter the good and the bad. I am sorry to discover that you have clearly encountered only the bad, yet you are a sample of one.

          I work at a company with fifteen employees, representing eight distinct nationalities and we operate in perfect harmony. This place is not anomalous; I have lived through several similar situations at other companies.

          However, I am also a sample of one. Let us look at statistics. Immigration accounted for two-thirds of Canada's population growth in 2006/2007 (http://www.statcan.ca/Daily/English/070927/d070927a.htm/ [statcan.ca]) and has always been a significant contributor to our population (http://www40.statcan.ca/l01/cst01/demo03.htm?sdi=population%20growth/ [statcan.ca]).

          Does this trend pose difficulties? Certainly. However, were such a policy not embraced by the majority of Canadians, it certainly would not persist. The tolerance is real. Join us and see for yourself.
    • Re: (Score:3, Insightful)

      This flaw has nothing to do with the webserver or the language the pages are written in, but by an idiotic developer. And believe me, there are idiotic developers in every camp.
      • Re:.aspx (Score:4, Informative)

        by Jellybob (597204) on Wednesday December 05 2007, @07:16AM (#21583669) Journal
        I havn't looked at the article, but I doubt that's going to help against someone determined. Sure - Joe Blogs who found the bug this time probably wouldn't have, but that's just an URL encoded string, which are trivial to decode (I believe PHP has an urldecode function for just that).

        Never, ever, trust data provided by the user. If there's potential to cause trouble, somebody will do it, which is why the site should have been keeping track of who's application was being filled out on the server, probably in a session variable.
      • Some frameworks use a long alphanumeric ID to access objects, gnu enterprise does that, so they thwart this kind of attacks.
        But i prefer exposing parameters and ID, and check for validity when parsing the request so that a hacker would need to hijack the session to perform any operation.
      • I don't usually reply to ACs, but this is so unbelievably misguided I feel I have to.

        1. IIS won't run on Win ME.
        2. This sort of security hole could just easily happen on any web platform - ASP, PHP, .Net, Java, even Rails (yup - it is possible to build an insecure Web 2.0 site!)
      • by schon (31600) on Wednesday December 05 2007, @08:44AM (#21584131) Homepage

        incompetent MCSE techies
        Umm, you realize you put a redundant term and an oxymoron in three words?
    • Re: (Score:3, Insightful)

      I swear to god I hate the civil service. Basically as a government employee your only job is to not rock the boat too hard. Take your 2 hr lunch breaks, leave early on fridays, take expensive training classes [that nobody in private sector gets to attend], attend one useless meeting after another, and take 4 years to do what a bright 16 yr old could do over a weekend. That's ok. Because, hey, you're in a union, god forbid you actually have accountability and performance metrics that mean anything...

      Havi

    • Re: (Score:3, Insightful)

      Yes, because private companies NEVER have security problems or make web sites that only work with IE, and employees of private companies never waste time reading sites like Slashdot instead of debugging their code.