Scottish National Party members found among list of names signed up to rival Alba Party after website whoopsie
- Reference: 1617021131
- News link: https://www.theregister.co.uk/2021/03/29/alba_party_website_error/
- Source link:
First reported by Scotland's [1]The Herald On Sunday , the names of more than 4,000 people who had signed up to attend events were inadvertently made public.
[2]
While the newspaper gleefully picked through the list to find high-profile members of the rival Scottish National Party (SNP), the nature of the error will cause disbelief in infosec circles.
According to the report, anyone who registerd with the site was given an ID, which could be used to share links to events with others. Those ID values were sequential, so simply changing the number on a link to an online event showed the person whose name corresponds with that ID as the referrer on the page.
[3]
The issue has apparently now been resolved.
It looks to us like a classic Insecure Direct Object Reference (IDOR) cock-up. Alba certainly wouldn't be the first and, we're sad to say, won't be the last victim of such iffy coding (the likes of [4]NurseyCam spring effortlessly to mind) although we imagine that the members of the SNP spotted on the list are in for a bit of a talking-to.
Security analyst Graham Cluley [5]posted : "Is it possible the website was created in something of a rush, without proper consideration for user security? You might think that, I couldn't possibly comment."
Neither could we, although judging by some of the homepage's sizing issues on show, the creators do seem to have been in a bit of a hurry.
And the site itself? "We will use your contact details to send you information on the topics you have requested," it proudly proclaims. Oddly, it doesn't say "and we'll send your name to anyone with a passing knowledge of how to change an ID in an address."
The Alba Party has yet to respond to The Register's request for comment.
A spokesperson for Information Commissioner's Office told us: "As a public body the ICO has to consider its responsibilities during the pre-election period. Our regulatory work continues as usual but we will not be commenting publicly on every issue raised during the Parliament Election.
[6]
"We will, however, be closely monitoring how personal data is being used during political campaigning and making sure that all parties and campaigns are aware of their responsibilities under data protection and direct marketing laws." ®
Get our [7]Tech Resources
[1] https://www.heraldscotland.com/news/19192899.alba-technical-fault-reveals-thousands-names-signed-party-events/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YGH5oVnSPQEuTbb@QUenhAAAANE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YGH5oVnSPQEuTbb@QUenhAAAANE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2021/02/22/nurserycam_breach/
[5] https://grahamcluley.com/alex-salmonds-alba-party-website-leaks-data-in-idor-foul-up/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YGH5oVnSPQEuTbb@QUenhAAAANE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://whitepapers.theregister.com/
I'm setting up a new party - The Scottish People's Front.
The Scottish People's Front.
I would definitely Back the Scottish People's Front... but I'm not sufficiently Scottish.
Re: The Scottish People's Front.
> I would definitely Back the Scottish People's Front... but I'm not sufficiently Scottish.
I think I would find it an affront to be asked to back the Scottish People's Front by the Front's backers, but not taken aback to be asked to front a Scottish People's Back party. Or have I got that back to front?
I'm setting up a new party - Campaign for a Free Scotland
Splitters...
I'm setting up a new party - the People's Front of Scotland!
Re: Splitters...
Splitter!
"Donald, where's your troosers?"
I presume Alba will fix this with a cutesy logo, a website redesign including happy smiling cartoon people of all colours and creeds and a meaningless statement along the lines of "hoots mon! will ye nae be worryin' about our security! Wee Hamish has it all in hoond!", just like Nurserycam ("your beautiful baby, on the internet forever!") are aiming to do.
Alba's first mistake was to name themselves after a purveyor of ratty old clock radios, and yes, Scottish people speak exactly like this. All of them.
Re: "Donald, where's your troosers?"
"Scottish people speak exactly like this" - no we don't. We usually swear a lot more than that...
Re: "Donald, where's your troosers?"
"In Glasgow, the word 'fucking' is just a general indication that a noun is on its way."
- Frankie Boyle
Re: "Donald, where's your troosers?"
Let's keep think properly Scottish here...
"Donald, whaur's yer troosers ?..."
Re: "Donald, where's your troosers?"
"Alba's first mistake was to name themselves after a purveyor of ratty old clock radios"
Along those lines, with Salmond's reputation, could have called themselves Bush.
Thank you Salmond days!
Immaculate Source for Coding to XSSXXXX ... A Heavenly BeDevilling Delight :-)
It is nice to know who you are getting into beds with. Anything less has one encountering an Almighty Invisible Resource ....a Superlative Sleeping Partner with Light Years of Quantum Communication Experience in Brokering Virtually Augmented Imagination ProgramMING.
To paraphrase Tom Hanks, and a legitimate question to ask for a sensible answer, given the implied subject matter ..... "Langley, is that there a problem?"
You appear to be holding four aces, El Reg, an exclusive hand dealt to you for you that you never before believed even remotely possible, but here we all are seeding future fare. :-) That puts y'all here on El Reg in a most enviable leading position whenever tuned in to Almighty Invisible Resources with Future Guaranteed Virtually Immaculate Source Supply to Muster and Deploy in the Foreign Fields of Alien Terrain.
Now that is One Almighty Core Ore Source Vein to Freely Tap into and partake of the Flow of Info and Intel enabling one to unlock all manner of Heavenly Padlocked Gates.. As may imagine, that very much opens up a whole host of Adam and Eve Gardens of Eden with Delights made IMPossible not to share in order to fully enjoy and luxuriate in the much appreciated reward of more rewards and awards to favour and savour and flavour and beta test sample live in the Palaces of Places Chosen.
And methinks for now, that be more than enough to enjoy . Too much of anything good or bad is never a great thing so just taking lots of great bits of everything leads one onto and into SMARTR SWIFT Courses. I Kid U Not.
If the Website was specifically hacked by the Newspaper for their story
Then isn't the Newspaper guilty under the GDPR for releasing the names?
I googled on Alba and found this [1]"ALBA Group - The recycling company" . Any connection ? ^^
And congrats to Scotland for their gallant victory on Friday evening - This 6 Nations championship was high on emotion this year
[1] https://www.alba.info/
Shocker
Some members of the only party for scottish independence interested in an alternative party for scottish independence shocker
Maybe not the way those members wanted to let the cat out of the bag, bur hardly surprising. Much as I find both sides merely popcorn fodder, this particular nugget is not where I'd anchor the story.
Re: Shocker
I agree that the news that some SNP members are moving to Alba isn't huge news. I assume that it's a condition of membership of the SNP that you aren't a member of another political party. If by some chance it isn't then the story is even smaller.
It's a bit embarrassing that the membership details have leaked though.
It gets worse
The new party's web site is a .org address but it's usual for there to be a .scot address too. As of the weekend, and right now as I type, trying to access albaparty.scot redirects to.... snp.org.
A quick whois and the entire issue goes deeper down a rabbit hole. The .scot domain is registered with Ionos, while the official .org domain is registered with Namecheap.
They'll have to get their act together by quite a lot more if there is any chance of my placing* them on the voting papers come May, as this does not inspire confidence.
* - The voting system allows this here rather than just an X.
Re: It gets worse
Curious. I had originally thought that Alba was being set up in direct competition with the SNP, but it seems that Alba is only aiming for regional seats, so won't affect the constituency vote. If I understand the system correctly, the SNP would not get many regional seats because the calculations reduce the impact of the regional vote for that party depending on how many constituency seats it wins.
If the SNP is for 'Independence' and Alba is explicitly set up for 'Independence', then the result is a significant increase in the 'Independence' vote with no (or little) impact on overall SNP seats.
I'm left feeling that Alba and the SNP are actually colluding, not conflicting, which might explain the issue with respect to "albaparty.scot". It seems like a con, to be honest.
Of course, I may be totally misunderstanding the voting method, so the above conclusions could be bollocks.
Yet again - Yaaaaawwwnn!
" Those ID values were sequential, so simply changing the number on a link to an online event showed the person whose name corresponds with that ID as the referrer on the page "
As in the movie - "You should get your head examined" "I did. They sent it back with with the note 'contents missing'"