In today's exploration of cybersecurity tech news, a journalist has only narrowly escaped
being sued for using F12 to view a website's HTML source code, this story is both scary
and hilarious at the same time, so grab some popcorn because you're about to witness the
most mindblowing example of technical idiocy you've ever seen.
So it all kicked off in October last year when a journalist working for "St. Louis Post-Dispatch"
- a local Missourian newspaper - found an incredibly embarrassing vulnerability in a
Missouri government website.
The website itself allows you to check whether a teacher in the state is qualified, just
type in the name of a teacher ... press search, and you can see their qualifications.
Fairly simple, straightforward and boring - or at least it was - until a journalist
came along, one "Josh" and pressed F12, which of course displays a web page's HTML source
code - within which, he found the social security number of the teacher he searched, and in
total 100,000 teachers SSNs were essentially public.
As in, every time someone loaded this website, social security numbers were sent to their
browser, but they weren't visible until you hit F12.
They were encoded in base64, so all someone needed to do was paste the encoded text into
a decoder to unscramble the SSNs.
Oh and, for the uninitiated, base64 is not encryption, it's just a way of displaying
text, like text can be displayed in morse code or binary, or French.
This error, seems to have been down to a misconfigured database query.
And so, our journalist, did the correct thing and reported the vulnerability to the government.
He didn't publish any articles or tweet about it until the problem was fixed.
Now, some organisations have bug bounty programs so they pay people who report flaws like this,
the organisations that don't will just thank whoever reported it.
In fact, the Dutch government will send T-shirts to people who report vulnerabilities in their
systems, it's become a bit of a meme.
According to leaked emails this is the response the Missouri government was going to take
- not a free T-shirt, but just a statement of thanks, saying "We are grateful to the
member of the media who brought this to the state's attention" - fairly vanilla and unremarkable.
That is until the government did a complete 180 and Missouri's governor "Mike Parson"
turned this story into an absolute clown show, when in a press conference he called the journalist
a "hacker".
Remember, all the journalist did was press F12, view the source code and responsibly
disclose the vulnerability - and now he's being threatened with a lawsuit.
So, I've edited down the video of the press conference, you're absolutely going to love
this, let's have
a watch.
[video]
Ok - erm, I honestly had trouble writing this next part of the video, because I wasn't sure
how to respond to this.
Just way he said HTML - it sounds like the first time he's ever heard of it is from the
script he's reading.
The weirdest part is, it sounds like he believes everything he's saying - that this was some
kind of a hack of epic proportions.
And I'm not sure how the figure of 50 million dollars to fix the bug was derived - either
the state is being milked by contractors or the governor gets his figures from playing
with a plate of number spaghetti.
And if you didn't think matters could get worse, then you're in for an absolute treat.
Because exploiting the opportunity for political grandstanding over defending teachers from
evil hackers was taken to a whole new level when this saga was used to promote the governor
in a political ad of theatrical proportions, which we shall now laugh at.
[video]
Y'know, seeing a political ad is always going to be strange for me, because they're illegal
on TV in the UK, but this was something else.
Accusing the newspaper of playing politics is ironic at best.
The dramatic music was a tad bit much.
And I don't understand the fascination over the fact that this "hack" - which it wasn't
a hack - but let's just play with the idea for a moment.
I don't understand why they obsess over referring to the "hack" as a multi-step process - I've
seen that phrase repeated over and over.
It's almost as if these people get their education from TV shows, where hacking can be as simple
as pressing a single button - and they therefore come to the conclusion that if there's multiple
buttons to press it must have been the work of only the most elite hackers, surely.
But then we get to the latest update which came out just a few days ago.
After months of drama, the journalist will not after all be prosecuted for the crime
of pressing F12.
After all it is the prosecutor who makes these decisions, rather than the governor - the
prosecutor published a press release, saying "There is an argument to be made that there
was a violation of the law" - the fact he even says this is a bit of a red flag to me,
but I suppose he needs to let down his boss "The governor" gently.
He announced the "investigation is now closed".
And the journalist responded with a press release of his own, essentially explaining
how his family and himself have been dragged through absolute hell the last few months,
not knowing if he was going to have to fight a frivolous lawsuit.
There is talk of him suing the state over the legal expenses he's incurred, and if he
can I'm sure you'll agree with me, that he definitely should.
On the bright side, we did get some memes from this drama, nothing to spicy, but solid
memes nonetheless.
Let me know in the comments, "stupid or malicious".
Is the governor just another technically illiterate boomer, convinced of his own bs.
Or do you think this was done intentionally to intimidate journalists.
Let me know down below.
This video is sponsored by Linode, who are giving you $100 worth of free cloud computing.
Linode is a totally customisable cloud hosting platform - whether you’re looking to quickly
spin up a VPN, website or host a kubernetes cluster - Linode has you covered.
If it runs on linux it’ll run on linode.
Linode just announced availability of their NVME block storage, the first alternative
cloud provider to officially support this state of the art hardware.
Linode’s philosophy is to focus on providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
Thanks for watching, you know the drill, make sure to mutilate the notification bell and
follow me on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.