Aigarius Blog » blog

Hacker ‘Neo’ caught in Latvia

aigarius — Thu, 13 May 2010 19:59:19 +0000

A scandal has been brewing in Latvia over the last half year and yesterday the activity spiked shocking the media and some IT people in the country. I’ll go back and explain what happened first, what is happening now and why this could have a heavy impact on IT and journalists in Latvia.

At the end of last year, there were rumours that the IT system of Latvia’s Internal Revenue System was ‘hacked’ and millions of documents had been downloaded by multiple organizations. Shortly thereafter more details on the glaring security hole became public (after it was closed).

There is a full electronic interface to give all reports to the IRS electronically (at http://eds.vid.gov.lv) and as part of that system you could also view and export monthly report summaries about your organization into XML and PDF files. After the system checked that you are authorized to access the report, you were redirected to the URL to actually download the report by report ID (as a single param in a GET request). Unfortunately, report IDs were predicable and the script that gave the reports for download did not check if you were authorized to get that report. It did not even check if were logged into the system.

There were suspicions that the authorization was disabled on purpose to allow to leak data on purpose, but apparently it was an error of forgetting to disable debug code in production environment.

The error was discovered only because the firewall administrator noticed an unexplained stable increase of traffic, especially during night hours when typically the traffic fully stopped. Apparently a single hacker (who later identified himself as ‘Neo’ to the press) discovered the flaw and wrote a script to just try all possible report ids and get as much data out as possible. This had been going on for months, before someone noticed.

After the flaw was discovered and a bit of time passed, Neo made his first move – he published the list of top salaries in a governmental company, that clearly showed that the top leadership of this company failed to cut their salary by 40%, like everyone elses during harsh budget cuts of 2009. He stripped the names and ids of the specific employees, but named the company which made it pretty easy to figure out who was who.

The society was outraged that the top managers in a government owned company failed to comply with the strict pay cut that everyone else in government had to endure. But after a few weeks the outrage subsided and no action followed from the government or law enforcement.

Neo continued to release documents detailing salaries of top managers in different Latvian government companies. And each time after short outrage, nothing happened. Neo gave an interview where he said that he was disappointed in the passivity of the Latvian people in face of such blatant injustices.

After a few month Neo went silent, promising to return before parliamentary elections this fall.

However, this week a new development shocked everyone – in the middle of the night two police SWAT teams went into action: one detained Ilmārs Poikāns, a researcher in artificial intelligence at the University of Latvia’s Computer Science department and another raided the home of a Latvian TV journalist Ilze Nagle who interviewed Neo. Poikāns confessed of being Neo the next day and was released (with travel restrictions, pending trial) today.

Politicians reacted immediately – opposition demanded the resignation of the Interior Minister over ‘such blatant disregard of freedom of press’ and another politician (who is also a famous lawyer) Aleksejs Loskutovs volunteered to defend Neo pro-bono (on Twitter, no less). Almost all Latvian online media have the arrest of Neo and the raid on the home of a journalist as main stories of the day.

As a legal titbit, we also know that Neo is being charged with breaking statutes 145 and and 244p2 of the criminal law. Statute 145 is hard to find applicable in this situation as talks about actions done by ‘people authorized (..) to access [private] information’. Statute 244p2 will also be hard to pin down as it mentions ‘influencing system resources of (an IT system)’ and ‘if such action caused severe harm’. It looks like the first part talks about at least a DoS attack (which did not happen in this case) and also there was no measurable harm from these leaks.

Also Neo was careful to strip all personally identifying information (such as names, social security numbers and addresses of the employees in question), so it will be hard to pin him on that. Also no actual breaking or other modification of an IT system occurred. And no ‘specialized software’ was used beyond a trivial script such as :

for i in range(0,7000000):
    wget('https://eds.vid.gov.lv/getRep.aspx?id='+str(i))

A lot of commentators on the Internet likened the situation to walking trough an unlocked door and stealing something. I think that analogy is very incorrect – there was no door, and nothing went missing after the action.

I came up with a different analogy – there was this corridor with a lot of doors in IRS, locked steel doors. You were instructed to go to a room with a specified number and given a key to that room to unlock it and see your secret info. However, that corridor opened out to the street on one end, oh and also the walls of the rooms with all the secrets were transparent. So Neo walked into the corridor, looked at some of the secrets, wrote them down (to remember them better) and then went out and discussed the worst examples abuses of power he saw.

In the end IRS had to learn their lesson – if you have to put naked photos of yourself on the Internet (or something equally embarrassing), then make damn sure you password protect that, but if you don’t then don’t cry that someone ‘hacked’ you and ‘stole’ you pictures.

What other people think:
http://freespeechlatvia.blogspot.com/2010/05/neo-released-under-restrictions.html

We’ll see how the story develops soon.

Blog-split

aigarius — Fri, 21 Mar 2008 16:30:04 +0000

Occasionally I post (or could post) things that are not fit for Debian Planet (non-English) or Ubuntu.lv Planet (unrelated to Latvian or Debian/Ubuntu matters), so I finally budged and switch the planet feeds to their own categories so that such things can be managed on a per-post basis.

Anyone know a WordPress plugin that would allow to set multiple default categories?

Debconf7 photos

aigarius — Thu, 14 Jun 2007 15:25:20 +0000

My blog server has been down ever since I left off to Edinburgh for the 7th Debian conference. Since then I have been busy taking photos of everything and everyone here AND I am not alone in that. Enjoy!

A must

aigarius — Fri, 02 Feb 2007 15:03:01 +0000

It is really a must have – my blog gets mentioned on the DWN for the first time and at the same time (or even a bit earlier) the electricity cuts to the building where my server is co-located. And it takes a couple of days for the local administrator to get from all that chaos to turning my server back on. Perfect timing .

Spelling

aigarius — Tue, 25 Jul 2006 00:23:50 +0000

From the previous version of my last post, people with even moderate knowledge of English could have easily understood that I suck at spelling and that, consequently, I did not have a spelling checker installed at this blog. Both of those two conclusions would be true.
So I decided to break in and install something to help me and after some mishaps, I settled on Visual Spellcheck plug-in. I am editing my posts in HTML anyway, so lack of WYSIWYG editor support is not critical for me, more like the opposite. All I needed was to install the plug-in, activate it in wordpress, install php5-pspell package and restart Apache. I forgot to restart Apache at first and got a cryptic error from the included fake pspell wrapper. Also aspell and corresponding language libraries must be installed on server site.
Note: after you have corrected all spelling errors in your text you must also remember to press “Continue Editing” link or otherwise changes will not be saved. I think that is a bug.

Another blog move

aigarius — Tue, 20 Jun 2006 12:53:06 +0000

Got access to a new, more powerful server, moved my blog from Mnemosyne to WordPress, hopefully did not flood p.d.o, did not move the comments over yet.

And not to flood the planet.d.o with the move I did this little change to the WordPress feed – at the very end of the wp-atom.php file there is this line:

So I changed it to this:

post_date < 1150758000 ) && empty ...

Where 1150758000 is the UNIX time of some point between the last post from the old blog and the first post in the new blog.

And I also imported my old posts entries from an Atom feed using the rss feed import as a base. The diff is after the break

--- rss.php 2005-12-28 22:24:12.000000000 +0200 +++ atom.php 2006-06-18 18:26:03.000000000 +0300 @@ -1,13 +1,13 @@ < ?php


-class RSS_Import {

+class Atom_Import {
        var $posts = array ();

        var $file;
        function header() {

                echo '

';

-               echo ''.__('Import RSS').'
';

+               echo ''.__('Import Atom').'
';

        }
        function footer() {

@@ -21,8 +21,8 @@

        }
        function greet() {

-               echo '
'.__('Howdy! This importer allows you to extract posts from any RSS 2.0 file into your blog. This is useful if you want to import your posts from a system that is not handled by a custom import tool. Pick an RSS file to upload and click Import.').'
';

-               wp_import_upload_form("admin.php?import=rss&step=1");

+               echo ''.__('Howdy! This importer allows you to extract posts from any ATOM 1.0 file into your blog. This is useful if you want to import your posts from a system that is not handled by a custom import tool. Pick an Atom file to upload and click Import.').'
';

+               wp_import_upload_form("admin.php?import=atom&step=1");

        }
        function get_posts() {

@@ -33,14 +33,14 @@

                $importdata = implode('', $datalines); // squish it

                $importdata = str_replace(array ("\r\n", "\r"), "\n", $importdata);
-               preg_match_all('|(.*?)|is', $importdata, $this->posts);

+               preg_match_all('|(.*?)|is', $importdata, $this->posts);

                $this->posts = $this->posts[1];

                $index = 0;

                foreach ($this->posts as $post) {

-                       preg_match('|(.*?)|is', $post, $post_title);

+                       preg_match('|]*>(.*?)|is', $post, $post_title);

                        $post_title = $wpdb->escape(trim($post_title[1]));
-                       preg_match('|(.*?)|is', $post, $post_date);

+                       preg_match('|(.*?)|is', $post, $post_date);
                        if ($post_date) {

                                $post_date = strtotime($post_date[1]);

@@ -68,13 +68,13 @@

                                $cat_index++;

                        }
-                       preg_match('|(.*?)|is', $post, $guid);

+                       preg_match('|(.*?)|is', $post, $guid);

                        if ($guid)

                                $guid = $wpdb->escape(trim($guid[1]));

                        else

                                $guid = '';
-                       preg_match('|(.*?)|is', $post, $post_content);

+                       preg_match('|]*?>.*?
(.*?)
\s*?|is', $post, $post_content);

                        $post_content = str_replace(array ('< ![CDATA[', ']]>'), '', $wpdb->escape(trim($post_content[1])));
                        if (!$post_content) {

@@ -85,6 +85,7 @@
                        // Clean up content

                        $post_content = preg_replace('|< (/?[A-Z]+)|e', "'<' . strtolower('$1')", $post_content);

+                       $post_content = str_replace('\n', ' ', $post_content);

                        $post_content = str_replace('
', '
', $post_content);

                        $post_content = str_replace('
', '
', $post_content);
@@ -160,12 +161,12 @@

                $this->footer();

        }
-       function RSS_Import() {

+       function Atom_Import() {

                // Nothing.

        }

 }
-$rss_import = new RSS_Import();

+$atom_import = new Atom_Import();

-register_importer('rss', 'RSS', __('Import posts from an RSS feed'), array ($rss_import, 'dispatch')); +register_importer('atom', 'Atom', __('Import posts from an Atom feed'), array ($atom_import, 'dispatch')); ?>

Reiserfs glitch

aigarius — Thu, 09 Mar 2006 12:53:02 +0000

Yesterday my server went down again. This time it was a combination of hardware and software. On software side my Reizerfs filesystem got corrupted in a funny way – I could not delete some files under /var. Those were files modified after a specific time yesterday, but the effect was only local to /var directory and did not effect any files in any other directories on the same partition. No suspicios messages in logs for the whole day. It gives back EPERM = “Permission denied” errors even for root. I “fixed” the problem by “cp -r /var /var.new && mv /var /var.old && mv /var.new /var”. All files were fine in the new directory (no corruption) and I could delete the same files there. But /var.old is still not deletable even by “rm -rf” as root. Any ideas?

Of couse I just though that I would reboot now so that all services would use the new /var. And of course the system did not come up because USB chip died. I had to go to the server room and disable USB in BIOS to get it up again. I hate hardware.

Just when you think you’re done …

aigarius — Sat, 04 Mar 2006 16:10:39 +0000

Just a day after I announced my new blog, the server hosting it went off-line. The funny thing is – it was because of an upgrade. As it turns out after I updated Debian sid on the server, a new version of udev was installed. A version that did not work anymore with kernels << 2.6.12 and surely the kernel I had there was 2.6.11. I mean, what the hell is that? Why would you drop support for kernels that are only 4 version old???

Could you not just have a copy of the old code around and call that if the kernel is old?

Anyway it appears that it was the udev that was tasked with loading the drivers for my servers network card and as the server was rebooted (power problems) it would not bring its network back up. I only today managed to get to that server and find out what the problem was.

Oh and I also noticed that LVM packages are also just to be broken – apparently new packages will only work with kernel >> 2.6.14 . Just wonderful!

Migration finished

aigarius — Tue, 28 Feb 2006 16:12:25 +0000

Hello again dear Debian Planet! I have a surprise for you. While you were not watching I made myself a brand new shining blog using the fine Mnemosyne software. It is a blog written in Python that uses Kid templates and a lot of wonderful pythonic magic (for uninitiated) that generates a set of XML compliant static files.

I added support for comments, tag cloud and some other dynamic features using the magic of AJAX.

The feed for the planet is tweaked to only display things that have not been posted to the old blog, so this is no flood – it is only the new posts (and one old one for completeness). I especially hope the DPL platform comparison will get some feedback.

Testing blogging from GMail

aigarius — Thu, 23 Feb 2006 22:03:28 +0000

This particular post is being written from GMail, transfered to my blog server by email, processed by some massage scripts and then integrated into my blog without me doing much about it. Neat ne?

Pārbāūdīšu arī rāķštīšāņū Latviešu valodā.

Убедитесь в том, что вы готовы встретиться с любой проблемой, возможной в этой ситуации.

日本

This concludes language testing.