Posts Tagged ‘New Zealand’

NoCowboys security failure [updated x2] [fixed]

Friday, October 19th, 2012

  A few months ago while looking for an arborist my wife listed the job on NoCowboys.co.nz, a New Zealand website for finding and rating businesses. Because of the way jobs are manually checked before appearing on the site there is a delay after submitting before you can tell if it worked. While I was trying to work out why the job hadn’t appeared on the site yet I happened upon a gaping hole in their security which enabled me to edit any other job on the site as well as see all the correspondence between clients and businesses. Most of the correspondence is either the client giving their address or the businesses providing a quote. Obviously giving out an address is not great, but the quote can be harmful too. While I couldn’t change what the quotes were, I’m sure businesses would find it useful to know what the competing quotes were before providing their own one. It’s also possible to reply on behalf of the job-lister, and thus turn down quotes to ensure yours was the only one that got through. But this is only half of the site. The other half is being a business. If they have the same lack of security on that side then it will be trivial to edit the quotes from your competitors and destroy their reputation by adding a few swear words here and there. I haven’t been able to verify if such edits are possible because it costs $299NZD to register and I’m not paying for the privilege of checking their security any more than I already have. Still, I’m prepared to assume that if it is the same developer across the site they’ll have made the same basic mistake everywhere.
; ; ;Before I explain what this mistake is I should point out that I emailed NoCowboys about this in July, and again in October. I told them exactly how to perform the hack and suggested the cause and a fix. I have heard nothing from them and they haven’t fixed it. Hopefully by putting this in the public domain they’ll take more notice. Who knows, maybe we’ll see a listing under their Computer and IT Security section.
; ; ;So finally, what is this hole then? It’s simple, staggeringly simple. You need to register first and then login. If you had listed a job you could go to the edit page, or use this URL as an example: http://www.nocowboys.co.nz/jobs/myjobs/XXXX/overview-v2 except instead of XXXX you’d have a job number. All you need to do is change the job number to the one you want to spy on and you’ll have full write-access to that job. The only security check they do is that *someone* is logged in, they don’t check who is logged in. Authentication but not authorisation.

Update : Oct 20th
It gets worse. The whole point of NoCowboys is to see opinions and ratings from other customers of the business you’re looking at to decide if you want to use them. So it’s not good that businesses can edit any review on the site. All a business needs to do is use this URL as an example and fill in the review number they’d like to edit. http://www.nocowboys.co.nz/edit-my-rating/XXXX.

Update 2
NoCowboys have contacted me and are working on a fix. Apparently the contact email address wasn’t working so this was the first they heard of it :/

Update 3: Oct 21stNoCowboys have fixed the problems. That was pretty quick from when they first read my messages. If it hadn’t been for the faulty feedback form on their site they would have had enough time to fix it in private and the world would never have known.

Google Street View Trikes in NZ [updated]

Monday, April 19th, 2010

Back in January Google announced that the trikes, which shoot footage for Google Street View where the cars can’t go, were about to start roaming the outback in search of interesting off-road places. They started at Taronga Zoo and held a public vote to choose the rest. Well that’s all fantastic if you’re interested in seeing Australia. And thousands millions of people are. But I happen to think that New Zealand has some pretty awesome things to show off too so I’m starting a list of places that the trikes should visit when they come here.

1: Otago Rail Trail


The most obvious starting point. 150kms of trail graded gently enough for the trains of yesteryear. The trail might be a bit rutted and bumpy so I hope they’ve given those trikes some good suspension to protect the equipment as well as the rider.

2: Wai-o-tapu


It’s an amazing “thermal wonderland” not far south of Rotorua and though it looks really good from the sky you really need to get in amongst it to show off some of New Zealand’s famous geothermal features.

3: The Luge


Whilst they’re down in Rotorua they should definitely pay a visit to The Luge. It’s a set of paved downhill tracks each as wide as a single lane road over looking the city. But don’t spend anytime looking down there because you need to pay attention to the corners and other riders as you hurtle down the hill on your three wheeled carts. This is my favourite man-made tourist attraction in NZ by far, and features in any good road trip. There’s one in Auckland too but you can see most of it from the motorway and it doesn’t look half as exciting as the Rotorua one.

4: Rangitoto Island


The jewel of the Hauraki Gulf is a volcano with a few unsealed roads. Right now they are only used by the D.O.C. workers and the pull-along tourist tractor that takes those that can’t walk to the summit. The last 100m or so is on wooden steps that the trike couldn’t traverse so they’ll need to carry it. Which should get them in good practice for…

5: The Tongariro Crossing


One of the world’s best day hikes, and there in lies the problem. If Google can get the Street View equipment down to a size where two people can carry it I’d gladly be one of the sherpas.

6: Viaduct Harbour


Often touted as ‘party’ central for things like The America’s Cup, the Rugby World Cup and really any event that Auckland hosts. I made a Real Place for it a while ago but I think it could do with the Street View treatment, ideally on a day when some really interesting big yachts are in.

7: Rainbow’s End


New Zealand’s biggest theme park may not stack up against the some of the ones in the recent UK update but that doesn’t stop it being the best one we’ve got. As you can see on the map there’s enough space to be worth exploring and I reckon putting the trikes on the race track would be fun too. If only they could make a splash-proof version for the log flume :-) .

Any other suggestions?

Update
GEarthBlog.com has some speculation that StreetView might be heading indoors. If this is true then I’d add Te Papa, New Zealand’s national museum to the list of places to document. I think GEarthBlog’s idea is more of documenting the collections in proper posed photo shoots rather than riding a trike down the halls, but I like the idea of riding around the museum late at night when all the other visitors have gone home.