Privacy Breach In Canadian Passport Application Site

Joanna Karczmarek sends us news of a massive privacy breach in the Government of Canada passport website. "A security flaw in Passport Canada's website has allowed easy access to the personal information — including social insurance numbers, dates of birth and driver's license numbers — of people applying for new passports. ... The breach was discovered last week by an Ontario man completing his own passport application. He found he could easily view the applications of others by altering one character in the Internet address displayed by his Web browser."

Trash the World

[Smordnys s'regrepsA]

3...
2...
1...

Breaking News, a L33t Canadian Hacker broke into a national security site, stealing millions of Dollars worth of personal information.

No word yet on any arrests.

More at 11.

31337 h4x0r

[martinX]

That's some leet hakking going on there...

http://www.freedom-to-tinker.com/index.php?p=780 [freedom-to-tinker.com]
http://www.tjmcintyre.com/2005/06/morris-tribunal-learns-pitfalls-of.html [tjmcintyre.com]
http://blogs.zdnet.com/threatchaos/?p=464 [zdnet.com]

Bad Monkey!!!!

[TheeBlueRoom]

Sounds like some web monkey needs a beating....

Re:Bad Monkey!!!!

[chuckymonkey]

*Waves hand in the air* I am not the monkey you are looking for.

Re:25% of Canadians not born in Canada.

[meringuoid]

It's not unusual to go to a mall, and see 45% to 50% of the people who are clearly not born in Canada. This is evident from their clothing, their mannerisms, and especially their near-complete lack of knowledge of English or French.

I wouldn't say Americans are that bad at English...

Re:Wow

[tttonyyy]

Who wants to bet that the 'unrelated problem' that resulted the the site shutting down was SQL injection. If you're stupid enough to allow access to other people's details via slight URL changes, you're probably also stupid enough not to check or parameterise form fields.

I blame that Canadian called '; drop table passport_info -- ' and password = ''; myself.

Irresponsible name to have these days.

Re:fixed AND old news.

[Yetihehe]

What is it with IIS installations and dodgy security?

If you make a server even idiot can run, idiots will be running it.

Re:Accidentally on purpose

[Anonymous Coward]

"ignored by the clueless management to save money?"

As a Canadian citizen, allow me to assure you that they were most certainly not concerned with saving money.

Re:Accidentally on purpose

[schon]

incompetent MCSE techies

Umm, you realize you put a redundant term and an oxymoron in three words?

I'm not surprised

[Pope]

Note the capitols

Well you did say it was a government contract.

give us a break...

[steveaustin1971]

Its damn hard to perfect code with all these polar bears trying to eat our igloos, and mashing the keyboards in mittens makes for some pretty long debugging sessions. Also someone spilled beer on the one copy of "html for dummies" the government makes us share. So soon as we come down from the marijuana and finish the cheetos we'll go over the code again. Has anyone seen my keyboard de-icer? (Hope you can read comments in Frenglish, it was written in Ottawa)

Re:Any site that documents these breeches?

[1u3hr]

Lots of breeches listed here. [doversaddlery.com]