Missouri gov. calls journalist who found security flaw a "hacker," threatens to sue
Missouri Gov. Mike Parson today threatened to prosecute and seek civil damages from a St. Louis Post-Dispatch journalist who identified a security flaw that exposed the Social Security numbers of teachers and other school employees, claiming that the journalist is a "hacker" and that the newspaper's reporting was nothing more than a "political vendetta" and "an attempt to embarrass the state and sell headlines for their news outlet." The Republican governor also vowed to hold the Post-Dispatch "accountable" for the supposed crime of helping the state find and fix a security vulnerability that could have harmed teachers.
Despite Parson's surprising description of a security report that normally wouldn't be particularly controversial, it appears that the Post-Dispatch handled the problem in a way that prevented harm to school employees while encouraging the state to close what one security professor called a "mind-boggling" vulnerability. Josh Renaud, a Post-Dispatch web developer who also writes articles, wrote in a report published yesterday that more than 100,000 Social Security numbers were vulnerable "in a web application that allowed the public to search teacher certifications and credentials." The Social Security numbers of school administrators and counselors were also vulnerable.
"Though no private information was clearly visible nor searchable on any of the web pages, the newspaper found that teachers' Social Security numbers were contained in the HTML source code of the pages involved," the report said.
The Post-Dispatch seems to have done exactly what ethical security researchers generally do in these situations: give the organization with the vulnerability time to close the hole before making it public.
Read more:https://arstechnica.com/tech-policy/2021/10/missouri-gov-calls-journalist-who-found-security-flaw-a-hacker-threatens-to-sue/
= new reply since forum marked as read
