Overclock.net › Forums › Industry News › Technology and Science News › [SMH] First State set police on man who showed them how 770,000 accounts [...]
New Posts  All Forums:Forum Nav:

[SMH] First State set police on man who showed them how 770,000 accounts [...]

post #1 of 24
Thread Starter 
First State set police on man who showed them how 770,000 accounts could be ripped off

Quote:
When Patrick Webster told First State Super he found a flaw exposing the personal details of its 770,000 members - including NSW Police officers, politicians and magistrates - he thought he was doing a good deed.

But before long, Webster, a private security consultant, received a knock on the door from police and a legal letter from the superannuation firm threatening legal action. First State Super has disabled his account, asked to check his computers and said he may be liable for any costs in fixing the breach.
Source

Apparently, sometimes white hat hackers get lumped in with the baddies.

[UPDATE]

http://www.financialstandard.com.au/news/view/12419801/

Quote:
First State Super has told Financial Standard it will not be pursuing legal proceedings against the 'goodwill hacker' who exposed a security flaw in its system, with the two parties to instead resolve any issues together.

Michael Dwyer, chief executive of First State Super (FSS), told Financial Standard the super fund will not be continuing its legal case against Patrick Webster.

"We have made an offer to Mr Webster to work jointly together towards resolving the issues, to which he has agreed. We are yet to have the meeting," said Dwyer.

Edited by Bluescreen_Of_Death - 10/18/11 at 9:37pm
post #2 of 24
Wow... someone is basically doing work for you for free and you throw the police at them?

Quote:
He noticed that the URL contained the unique ID number for each account and by tweaking the number in the URL, he was able to easily access other people's statements.
Fail...
    
CPUMotherboardGraphicsRAM
i5 2500K MSI P67A-G43 MSI GTX 460 Cyclone Ripjaws X 
Hard DriveHard DriveOptical DriveOS
Vertex 2 WD Green ASUS Windows 7 
PowerCase
Antec TruePower New 750 HAF 922 
  hide details  
Reply
    
CPUMotherboardGraphicsRAM
i5 2500K MSI P67A-G43 MSI GTX 460 Cyclone Ripjaws X 
Hard DriveHard DriveOptical DriveOS
Vertex 2 WD Green ASUS Windows 7 
PowerCase
Antec TruePower New 750 HAF 922 
  hide details  
Reply
post #3 of 24
The ignorance of some companies/people. They should be grateful that one of the few times a security breach is found, it was found by someone good, and not selfish and malicious. This is why we can't have nice things...
It. Gets. Better.
(16 items)
 
  
CPUMotherboardGraphicsRAM
2500k@4.6Ghz ASUS P8Z68/Gen3 Radeon HD 5870 16 GB G.skill 1600mhz 
Hard DriveHard DriveHard DriveCooling
750GB Hitachi Crucial M4 128GB Seagate Barracuda 2 TB Corsair H100 
OSPowerCase
Windows 7 Corsair TX 650 HAF X 
  hide details  
Reply
It. Gets. Better.
(16 items)
 
  
CPUMotherboardGraphicsRAM
2500k@4.6Ghz ASUS P8Z68/Gen3 Radeon HD 5870 16 GB G.skill 1600mhz 
Hard DriveHard DriveHard DriveCooling
750GB Hitachi Crucial M4 128GB Seagate Barracuda 2 TB Corsair H100 
OSPowerCase
Windows 7 Corsair TX 650 HAF X 
  hide details  
Reply
post #4 of 24
Quote:
He said several of First State's staff contacted him to say thanks for alerting them to the breach.

Not long after, a page on First State's website was defaced in a separate breach with a message that read "stop war USA & Israel".

"But then three and a half weeks later the police just knocked on the door and said we're here to speak to you about downloading files about First State Super,"
"Self-incrimination is the act of accusing oneself of a crime for which a person can then be prosecuted." - wiki

Don't do it
workstation
(14 items)
 
  
CPUMotherboardGraphicsRAM
i5 2500K EVGA Z68 SLI GeForce 670 GTX G.Skill 32GB 1600Mhz 
Hard DriveCoolingOSMonitor
OCZ Agility 3 60GB Zalman arch x86_x64 U3011 + U3014 
PowerCaseMouseAudio
PCPowerCooling 860w Chenbro server G500 Asus D2X, Def Tech 5.3 
  hide details  
Reply
workstation
(14 items)
 
  
CPUMotherboardGraphicsRAM
i5 2500K EVGA Z68 SLI GeForce 670 GTX G.Skill 32GB 1600Mhz 
Hard DriveCoolingOSMonitor
OCZ Agility 3 60GB Zalman arch x86_x64 U3011 + U3014 
PowerCaseMouseAudio
PCPowerCooling 860w Chenbro server G500 Asus D2X, Def Tech 5.3 
  hide details  
Reply
post #5 of 24
next time let them burn
    
CPUMotherboardGraphicsRAM
X5680@4.8GHz 192x25x1.47v EVGA X58 Classified(E759) EVGA GTX980 Ti SLI @1515/8400 6x4GB GSkill Ripjaws@1540 8-8-8-20-2T-1.55v 
Hard DriveHard DriveHard DriveCooling
Corsair Force GT 120GB/OS Corsair Force LS 60GB/PAGE Toshiba 4TB/GAMES CPU-EK Supremacy 
CoolingCoolingCoolingCooling
MB-EK FB Classified GPU-EK FC TitanX/Backplates Rad-Swiftech 360mm MCR-320/Pump Rad-Barrow 280mm 
CoolingCoolingCoolingOS
Ram-Corsair 2x60mm Resevoir-Barrow 250x50mm Misc-6x120mm/2x140mm/NZXT Sentry,Barrow 3/8 fit... Windows 10 Pro x64 
MonitorKeyboardPowerCase
Seiki 50'' 3840x2160 30hz Logitech G110 EVGA Supernova G2 1300 Lian Li PC-A77F 
MouseMouse PadOtherOther
Logitech G9x Xtrac Ripper XL Logitech G27 Logitech G940 
Other
Xbox One controller 
  hide details  
Reply
    
CPUMotherboardGraphicsRAM
X5680@4.8GHz 192x25x1.47v EVGA X58 Classified(E759) EVGA GTX980 Ti SLI @1515/8400 6x4GB GSkill Ripjaws@1540 8-8-8-20-2T-1.55v 
Hard DriveHard DriveHard DriveCooling
Corsair Force GT 120GB/OS Corsair Force LS 60GB/PAGE Toshiba 4TB/GAMES CPU-EK Supremacy 
CoolingCoolingCoolingCooling
MB-EK FB Classified GPU-EK FC TitanX/Backplates Rad-Swiftech 360mm MCR-320/Pump Rad-Barrow 280mm 
CoolingCoolingCoolingOS
Ram-Corsair 2x60mm Resevoir-Barrow 250x50mm Misc-6x120mm/2x140mm/NZXT Sentry,Barrow 3/8 fit... Windows 10 Pro x64 
MonitorKeyboardPowerCase
Seiki 50'' 3840x2160 30hz Logitech G110 EVGA Supernova G2 1300 Lian Li PC-A77F 
MouseMouse PadOtherOther
Logitech G9x Xtrac Ripper XL Logitech G27 Logitech G940 
Other
Xbox One controller 
  hide details  
Reply
post #6 of 24
Quote:
"While we were appreciative of him showing us a weakness in our security systems the size of the downloads concerned us greatly and the fact that it was a major breach of the privacy provisions of our members," Dwyer said in a phone interview.

"I'm confident that when we meet and discuss the matter we can resolve it to our satisfaction that he is actually not holding those files any longer."

...

NSW Police said it was not taking any further action on this matter. "There was no criminal offence committed and the company in question has been informed of the outcome. It was more a case of a civic-minded person reporting a potential security breach."
Seems like they understand what he did and only want to make sure that he does not have any personal information from his "test" of their system. Not actually going after him for the breach (which seems like a separate thing) as implied by the introduction.
    
CPUMotherboardGraphicsRAM
i5 2500K MSI P67A-G43 MSI GTX 460 Cyclone Ripjaws X 
Hard DriveHard DriveOptical DriveOS
Vertex 2 WD Green ASUS Windows 7 
PowerCase
Antec TruePower New 750 HAF 922 
  hide details  
Reply
    
CPUMotherboardGraphicsRAM
i5 2500K MSI P67A-G43 MSI GTX 460 Cyclone Ripjaws X 
Hard DriveHard DriveOptical DriveOS
Vertex 2 WD Green ASUS Windows 7 
PowerCase
Antec TruePower New 750 HAF 922 
  hide details  
Reply
post #7 of 24
Thread Starter 
Quote:
Originally Posted by Vlasov_581 View Post
next time let them burn
To be fair, the white hat hacker had an account with them, so it was within his own interest to let them know about the hole.
post #8 of 24
No good deed goes unpunished.
post #9 of 24
...and people wonder why the good guys go rogue...
Pit Stop
(35 items)
 
  
CPUMotherboardGraphicsRAM
1090T Gigabyte 990FXA-UD5 MSi ref. 6950 2GB unlocked 4GB STT WX200UB2G7 
Hard DriveHard DriveOptical DriveCooling
Samsung F3 Crucial M4 Teac slim slot load DIYINHK Toshiba pwm pump controller upgrade 
CoolingCoolingCoolingCooling
Yate Loon D12SH-12 Silverstone SST-AP181 Koolance DDC pump housing/heasink Sunon 60 mm cooling fan for pump housing 
CoolingCoolingCoolingCooling
Bitspower 7/16" Black Sparkle compression fitt... Bitspower Black Sparkle 90 degree double rotary... Bitspower 45 degree rotary fittings Primochill LRT UV blue tubing 
CoolingCoolingCoolingCooling
XSPC Rasa cpu block XSPC RX-240 radiator XSPC DDC res. top Laing DDC-1  
OSMonitorKeyboardPower
7 Professional Samsung EX-2220 Das Professional Seasonic's dead :( 
CaseMouseMouse PadAudio
Lian Li T60-B PureTrak Valor Ratpadz GS Auzentech X-plosion 7.1 
AudioAudioAudioOther
AKG K701's Lil Dot MK.III hp amp Burr-Brown OPA627SM opamp upgrade Custom built MTM style transmission line 
OtherOtherOther
Various amps. Custom built MTM style transmission line 15" Dayton Titanic MK.III 
  hide details  
Reply
Pit Stop
(35 items)
 
  
CPUMotherboardGraphicsRAM
1090T Gigabyte 990FXA-UD5 MSi ref. 6950 2GB unlocked 4GB STT WX200UB2G7 
Hard DriveHard DriveOptical DriveCooling
Samsung F3 Crucial M4 Teac slim slot load DIYINHK Toshiba pwm pump controller upgrade 
CoolingCoolingCoolingCooling
Yate Loon D12SH-12 Silverstone SST-AP181 Koolance DDC pump housing/heasink Sunon 60 mm cooling fan for pump housing 
CoolingCoolingCoolingCooling
Bitspower 7/16" Black Sparkle compression fitt... Bitspower Black Sparkle 90 degree double rotary... Bitspower 45 degree rotary fittings Primochill LRT UV blue tubing 
CoolingCoolingCoolingCooling
XSPC Rasa cpu block XSPC RX-240 radiator XSPC DDC res. top Laing DDC-1  
OSMonitorKeyboardPower
7 Professional Samsung EX-2220 Das Professional Seasonic's dead :( 
CaseMouseMouse PadAudio
Lian Li T60-B PureTrak Valor Ratpadz GS Auzentech X-plosion 7.1 
AudioAudioAudioOther
AKG K701's Lil Dot MK.III hp amp Burr-Brown OPA627SM opamp upgrade Custom built MTM style transmission line 
OtherOtherOther
Various amps. Custom built MTM style transmission line 15" Dayton Titanic MK.III 
  hide details  
Reply
post #10 of 24
hard not to be bitter about this
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Technology and Science News
Overclock.net › Forums › Industry News › Technology and Science News › [SMH] First State set police on man who showed them how 770,000 accounts [...]