Forum

 
  Back to OzPolitic.com   Welcome, Guest. Please Login or Register
  Forum Home Album HelpSearch Recent Rules LoginRegister  
 

Page Index Toggle Pages: 1
Send Topic Print
SA Govt allows massive data breach (Read 673 times)
Bam
Gold Member
*****
Offline


Australian Politics

Posts: 21905
Gender: male
SA Govt allows massive data breach
Sep 25th, 2018 at 11:46am
 
Millions of SA property records downloaded en masse, government forced to limit access

Quote:
Key points:
* SA Government shut down guest access to the land titles registry after the discovery
* Guests could access a property's value and owner, its mortgage status and historical ownership
* Expert says the data scraping wouldn't have been terribly difficult to carry out

Sophisticated data matching tools, nefarious social engineering, ethically dubious sales tactics, and plain curiosity — they could all be among the motivations behind a suspected overseas agent who downloaded more than a million South Australian property records.

The South Australian Government has shut down guest access to the land titles registry website after it discovered a single IP address had harvested the information en masse.

Guests were able to access information including a property's value and owner, its mortgage status and historical ownership.

While there is no suggestion it was a data breach — the website was working exactly as designed — it was not the Government's intention to make the information so easily available.

SA Planning Minister Stephan Knoll called it a "curious" case and said he could not understand the purpose of the attack.

Dr Ralph Holz from the University of Sydney — who is an expert in networks and security — said it did not look like it would have been terribly difficult to pull off.

"It would've been very simple [for the agency] to limit the number of accesses to some small number per minute … which would've slowed down the attack considerably," he said.

"Maybe they were just curious … [but] maybe they were after data that would help them in terms of social engineering, making cold calls to people."

"For example, if you were cold-calling people to sell them mortgages or other financial products, the data could be of great help to you.

"On the more nefarious end of the spectrum you could possibly argue that this data could be linkable to other data that is acquired somewhere else, like health data or some financial data.

"Data by itself is not particularly useful, but suddenly may become useful when it is linked to another dataset."

Centrelink and the Australian Tax Office use data matching, a process of taking information from various sources to try to track down citizens who owe the Commonwealth money.

And the more data you have access to, the more you can learn.

"For example if you're able to combine it with census data … then you might be able to learn a whole lot more," Dr Holz said.

Land registries a hot commodity

While unknown actors are fishing for the data, there is no doubt to its value in aggregate, with major financial firms paying top dollar for access.

The South Australian Government outsourced operation of the Land Titles Office last year, bringing $1.6 billion, plus regular royalties, into state coffers — four times more than it expected.

It is now run by a conglomeration including Macquarie Bank and a Canadian super fund.

The New South Wales Government has done the same, and a few weeks ago First State Super paid almost $3 billion for the right to operate Victoria's land titles registry.

Real Estate Institute of SA chief executive Greg Troughton has welcomed the protections being put in place to stop data abuse.

"I guess there's a conflict between the Torrens titling system, which is open and transparent, and making that information available," he said.

"Clearly somebody has set up a robot of sorts … that is clearly not what we're after.

"The horse may well have bolted but it depends on how quickly the barn door was closed."

Land Services SA said in a statement to customers that it was working on a long-term solution that will allow "appropriate" access.

Back to top
 

You are not entitled to your opinion. You are only entitled to hold opinions that you can defend through sound, reasoned argument.
 
IP Logged
 
Page Index Toggle Pages: 1
Send Topic Print