Gordon Campbell | Parliament TV | Parliament Today | Video | Questions Of the Day | Search

 


Labour alerts Justice Ministry to gaping security hole

Clare
CURRAN
Communications and IT Spokesperson

9 April 2013 MEDIA STATEMENT

Labour alerts Justice Ministry to gaping security hole in its website
Labour’s Information Technology spokesperson, Clare Curran, has today alerted the Ministry of Justice of a serious security flaw in its website.

The vulnerability leaves the personal and financial details of tens of thousands of New Zealanders potentially exposed, and might allow a malicious person to redirect payments to and from members of the public.

“This is a very serious matter. This is yet another gaping hole in the security of a major government site, with privacy and financial implications for a huge number of people,” says Clare Curran.

The security flaw allows access to Ministry of Justice passwords and databases, via a publicly accessible search engine on its website.

“The Ministry of Justice holds incredibly sensitive data – including information about the victims of crime. The Government has a fundamental duty to protect that information. This flaw, if exploited, could have a devastating effect on thousands of people.

“Earlier today I wrote to the Ministry of Justice, the Minister Judith Collins and the Privacy Commissioner alerting them to the issue, which must be addressed urgently.

“This matter was brought to my attention by a whistle-blower. That person has agreed to help the Ministry of Justice in any way they can to ensure the security flaw is fixed.

“This is the latest in a disturbingly long line of information technology security flaws and privacy breaches. There is clearly a major systemic problem with IT security.

“In the past two years more than 100,000 Kiwis have had their privacy breached by government agencies, including the ACC, MSD, IRD and EQC. This is an issue of public trust and confidence in government systems.

“The National Government needs to treat this matter with the seriousness it deserves, and stop hiding behind human error as an excuse for not protecting people’s private information,” says Clare Curran



Ministry of Justice security flaw Q and A

What is the nature of the security flaw?
The flaw allows access to what appears to be Ministry of Justice databases covering licences and fines. Those databases would likely include the personal details of many victims of crimes.

Access to the page containing passwords for the databases was found via a publicly accessible part of the Ministry of Justice website.

How serious is this vulnerability?
This is a serious flaw. The passwords were contained in a plain text file, and those passwords could be used to access incredibly sensitive information, and could potentially allow someone to alter fines payments and financial records.

The MoJ website is very vulnerable to anyone who is serious about trying to break into it. The MoJ website’s security is nowhere near an acceptable standard.

Potentially how many people’s information is at risk because of this problem?
That is not clear. But the databases in question could include information about people that the Courts have imposed a fine upon, and any victim of crime that is receiving reparations. At the very least the databases also hold the details of those with licences issued by the Ministry of Justice.

How did Clare Curran become aware of the issue?
Clare Curran was contacted by a concerned member of the public, who identified the vulnerability. That person contacted her in the hope that she could help expose the problem and get it fixed.

The whistle-blower did NOT access the Ministry databases, but did view the plain text file that contained the passwords. This confirmed the seriousness and extent of the security issue. This file has been passed on to the Ministry of Justice.

Clare Curran will not be publicly identifying her source, but they have agreed to help the Ministry of Justice to address this problem.


© Scoop Media

 
 
 
 
 
Parliament Headlines | Politics Headlines | Regional Headlines

Gordon Campbell: On First Time Voting (Greens)

For the last two days, I’ve turned my column over to a couple of guest columnists who are first time voters. They’ve been asked to explain why they were voting, for whom and what role they thought their parental upbringing had played in shaping their political beliefs ; and at the end, to choose a piece of music. Today’s guest columnist is Ana Avia-O’Connor, who will be casting her first time vote on Saturday for the Greens.

If I didn’t know any better, it would seem the world has conspired for me to be a Green Party voter. Parents, Green voters? Check. Participation in bilingual education that stressed the importance of inquiry, solidarity and the Treaty? Check. Some sort of vegetarian leanings (seven years and counting, jus’ sayin’)? Check. However, above all of that, I’m voting Green because I believe in supporting the importance of every New Zealander’s contribution to Aotearoa, from the hairdresser in Foxton to the fisherman in Bluff. You could say that I like the cut of the Greens’ jib. More>>

 

Parliament Today:

Big March: Call For An End To Domestic Violence

Hundreds of protesters marched down Lambton Quay to Parliament Monday calling for an end to domestic violence. Wearing white facemasks, waving banners and calling for “safety” for the women and children of New Zealand.. More>>

ALSO:

Meddling: Aussie Liberals Embroiled In Key Campaign

John Key needs to explain why Australia’s Liberal Party is interfering in New Zealand domestic politics and is encouraging Kiwi voters across the ditch to vote for National just days out from the election, Labour’s campaign spokesperson Annette King says. More>>

ALSO:

SURVEILLANCE:

Election Ad Soundtrack: Rapper Eminem Sues National Party Over Copyright Breach

US rapper Eminem is suing the New Zealand National Party for alleged copyright infringement over unauthorised use of the rapper’s ‘Lose Yourself’ song in an election campaign advertisement. More>>

ALSO:

Pre-Election Chartering: Four New Partnership Schools To Open

Education Minister Hekia Parata today announced the Government has signed contracts to open four new Partnership Schools in 2015. More>>

ALSO:

Werewolf 50 Out Now - The Election Issue: Loss Leaders

Gordon Campbell: A third term requires a mature decision, with eyes wide open. It calls for a conscious vote of confidence… Without trying hard here are about 19 reasons, in no particular order, for not ticking ‘party vote’ National. More>>

ALSO:

Not-Especially New Plans: All Prisons To Become Working Prisons Under National

All public prisons in New Zealand will become full working prisons by 2017, and ex-prisoners will receive post-release drug addiction treatment if National is returned to government, says Corrections Spokesperson Anne Tolley. More>>

ALSO:

Māngere: "False Claim Of Matai Title" - Labour

National must explain why its candidate for Māngere Misa Fia Turner appears to be using a Matai title she is not entitled to, Labour’s MP for Māngere and Pacific Islands Affairs spokesperson Su’a William Sio says. A Matai title is a legally-recognised ... More>>

ALSO:

CPAG Report: No New Zealand Child Should Grow Up In Poverty

Child Poverty Action Group's flagship policy publication Our Children, Our Choice: Priorities for Policy calls for cross party political agreement to underpin an action plan to eliminate child poverty in New Zealand. More>>

ALSO:

Gordon Campbell:
On National’s Phantom Tax Cut Package

Hmmm. So National’s tax cuts package turns out to be one of those television advertisements that screams a headline promise – perfect skin! a youth tonic that works! – while in very small print there’s an out clause: special conditions may apply. More>>

ALSO:

Water: New Marine Reserves On West Coast Opened

Five new marine reserves were officially opened by Conservation Minister Dr Nick Smith on the West Coast of the South Island to protect a range of marine ecosystems for conservation, science and recreation. More>>

ALSO:

Get More From Scoop

 

LATEST HEADLINES

 
 
 
 
 
 
 
 
Parliament
Search Scoop  
 
 
Powered by Vodafone
NZ independent news