<div dir="ltr"><div>Hi Andrew,</div><div><br></div><div> Based on the public information available there was no direct access to the database involved in the breach, the attacker found an unsecured public API endpoint (essentially your "broker") which they then proceeded to query for every customer record iterating the contact id each time, i.e. wget <a href="http://somedomain.com/some/api/contactid=1">http://somedomain.com/some/api/contactid=1</a>,
wget <a href="http://somedomain.com/some/api/contactid=2">http://somedomain.com/some/api/contactid=2</a>, etc..</div><div><br></div><div>Whether or not the database is in a private network is irrelevant, if there's a conduit to it and if that doesn't have proper access controls implemented you end up with this situation.</div><div><br></div><div>Best Regards,</div><div><br></div><div>Morgan<br>
</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 27, 2022 at 1:00 PM Andrew M. Mathieson-Blakely <<a href="mailto:andrew.mathieson-blakely@bmcg.net.au">andrew.mathieson-blakely@bmcg.net.au</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-2971243562084312328">
<div style="overflow-wrap: break-word;" lang="EN-AU">
<div class="m_-2971243562084312328WordSection1">
<p class="MsoNormal"><span>What I don’t understand (and I am not a programmer) is why there isn’t a broker setup. In the Mainframe world normally, you would have your database on a private network that will only server a
request server and serve the data that it requests to see. I really get nervous these days when databases are not behind private networks with no public access to whatsoever.<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>That’s my food for thought be interested to see what goes on in the real world today but I just see this as not the most secure way to be handling any information that is stored in a database.<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>Regards<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>Andrew<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<div style="border-color:rgb(181,196,223) currentcolor currentcolor;border-style:solid none none;border-width:1pt medium medium;padding:3pt 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">AusNOG <<a href="mailto:ausnog-bounces@ausnog.net" target="_blank">ausnog-bounces@ausnog.net</a>> on behalf of Michael Kahl <<a href="mailto:michael@kahl.id.au" target="_blank">michael@kahl.id.au</a>><br>
<b>Date: </b>Tuesday, 27 September 2022 at 12:40 pm<br>
<b>To: </b>Nathan Brookfield <<a href="mailto:Nathan.Brookfield@iperium.com.au" target="_blank">Nathan.Brookfield@iperium.com.au</a>><br>
<b>Cc: </b>"<a href="mailto:ausnog@ausnog.net" target="_blank">ausnog@ausnog.net</a>" <<a href="mailto:ausnog@ausnog.net" target="_blank">ausnog@ausnog.net</a>><br>
<b>Subject: </b>Re: [AusNOG] Optus Hack<br>
<b>Resent from: </b><<a href="mailto:andrew.mathieson-blakely@bmcg.com.au" target="_blank">andrew.mathieson-blakely@bmcg.com.au</a>><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Is there any legal obligation to store sensitive ID information in its original form? Storing a hashed version only would be sufficient to prove the details had been collected and verify any future ID verification requirements without actually
retaining the sensitive data. <u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Separately, should the government provide an opt in two factor ID verification service for critical services such as telco, utilities, banking, etc? There are privacy concerns, however if implemented correctly they wouldn't be collecting
any further information than what they legally have access to now.<u></u><u></u></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Tue, Sep 27, 2022 at 11:12 AM Nathan Brookfield <<a href="mailto:Nathan.Brookfield@iperium.com.au" target="_blank">Nathan.Brookfield@iperium.com.au</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-color:currentcolor currentcolor currentcolor rgb(204,204,204);border-style:none none none solid;border-width:medium medium medium 1pt;padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal">They’re legally obligated to retain it but why it’s on the API and why it’s not encrypted.<br>
<br>
Looking at the data some fields are hashed and then repeated in the bloody clear :(<br>
<br>
On 27 Sep 2022, at 11:02, <a href="mailto:glenn.satchell@uniq.com.au" target="_blank">
glenn.satchell@uniq.com.au</a> wrote:<br>
<br>
My understanding was that the data included the 100 points of ID info. Why are they retaining this? Surely after confirming the 100 points there only needs to be a record "100 points provided"=true and not retain the actual details. This goes back to only keeping
the private data you need.<br>
<br>
regards,<br>
Glenn<br>
<br>
On 2022-09-27 10:49, Damien Gardner Jnr wrote:<br>
> Personally, I find putting Authentication on my API endpoints to be a<br>
> FANTASTIC first step towards API security. And then not even using<br>
> public IP addresses in test environments is a pretty good second<br>
> step.. </onlyhalfsarcasticherewhydoesthiskeephappening><br>
> On Tue, 27 Sept 2022 at 10:46, Bevan Slattery <<a href="mailto:bevan@slattery.net.au" target="_blank">bevan@slattery.net.au</a>><br>
> wrote:<br>
>> Hi everyone,<br>
>> Obviously a big week in telco and cybersecurity. As part of my work<br>
>> I am on the Australian Cyber Security Industry Advisory Committee as<br>
>> an industry representative.<br>
>> I am keen to look at opening up a dialogue with more and more telco,<br>
>> DC and Cloud CISO’s on what they are doing around this issue and<br>
>> looking to take a proactive step towards best practice on customer<br>
>> data and system security.<br>
>> There will be some pretty serious consequences of this hack on the<br>
>> industry and importantly we need to make sure we are as best placed<br>
>> to help each other continually increase in security posture through<br>
>> best practice, but also working with each other as an industry.<br>
>> Are people keen on having a online/VC session sometime in the next<br>
>> few weeks where like-minded industry participants get together and<br>
>> discuss security, retention, encryption, threat detection etc.? If<br>
>> so, just ping me directly and if there is enough interest I will<br>
>> send out an invitation to the list for a call.<br>
>> Cheers<br>
>> [b]<br>
>> _______________________________________________<br>
>> AusNOG mailing list<br>
>> <a href="mailto:AusNOG@ausnog.net" target="_blank">AusNOG@ausnog.net</a><br>
>> <a href="https://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
> --<br>
> Damien Gardner Jnr<br>
> VK2TDG. Dip EE. GradIEAust<br>
> <a href="mailto:rendrag@rendrag.net" target="_blank">rendrag@rendrag.net</a> -
<a href="http://www.rendrag.net/" target="_blank">http://www.rendrag.net/</a><br>
> --<br>
> We rode on the winds of the rising storm,<br>
> We ran to the sounds of thunder.<br>
> We danced among the lightning bolts,<br>
> and tore the world asunder<br>
> _______________________________________________<br>
> AusNOG mailing list<br>
> <a href="mailto:AusNOG@ausnog.net" target="_blank">AusNOG@ausnog.net</a><br>
> <a href="https://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@ausnog.net" target="_blank">AusNOG@ausnog.net</a><br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@ausnog.net" target="_blank">AusNOG@ausnog.net</a><br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@ausnog.net" target="_blank">AusNOG@ausnog.net</a><br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</div></blockquote></div>