Man there's gonna be some major fallout from this!
The I.T security at the largest government department here in NZ is found to be pretty much non existent.
Anyone and I do mean anyone was able to browse all the sensitive files of the ministry of social development (social welfare).
Story was busted open last night by this freelance journo/blogger.
http://publicaddress.net/onpoint/msds-leaky-servers/
Face meets palm............
MSD = Ministry of Social Development http://www.msd.govt.nz/
WINZ = Work and Income New Zealand http://www.workandincome.govt.nz/
CYFS = Child, Youth and Family Services http://www.cyf.govt.nz/
The I.T security at the largest government department here in NZ is found to be pretty much non existent.
Anyone and I do mean anyone was able to browse all the sensitive files of the ministry of social development (social welfare).
Story was busted open last night by this freelance journo/blogger.
http://publicaddress.net/onpoint/msds-leaky-servers/
Face meets palm............
For those unfamiliar with the departmental acronyms mentioned,This basically means you can grab any file that wasnt bolted down on the network, while standing in the middle of a WINZ office. And thats what I did.
So what wasnt bolted down? Lets start with the boring stuff. There were servers connected to their call centre systems, logging calls going in and out. They contained sound recordings which I couldnt open, but which I suspect (for various reasons) are NOT complete recording of calls. I guess Ill leave that for the Privacy Commissioner.
And then there were file server logs. Normally, they arent that exciting. Except that WINZ name their files quite well. For example:
s:\SharedData\wi_wites\Waikato\HAM\Fraud Investigations\[Name of investigator]\[Name of WINZ client] 23 Jun 2011 Case 640026-10.WMA
And so on. There were similar files for other special clients as well. There are probably a lot of personally identifying details in there, but I didnt spend much time going through them, because then I got tipped-off about the invoice server. It contains what appears to be all of MSD invoices for this year. Among all the invoices for milk and sausage rolls were invoices for:
MSD = Ministry of Social Development http://www.msd.govt.nz/
WINZ = Work and Income New Zealand http://www.workandincome.govt.nz/
CYFS = Child, Youth and Family Services http://www.cyf.govt.nz/