Facts about the online system of the National Consultation
Seeing the success of the National Consultation, the index wrote an expiring article about the online system, again referring to "anonymous experts" (link at the end of the article). For a layman, a malicious sage can easily turn an flea into an elephant, as many people don’t understand what the image depicts what the article is about, all they see is that there is something wrong with it.
“The tempers of the child caught, although understandable, are unwise,” said Gyurcsány, the index’s favorite in 2007 (https://youtu.be/yAwgB_GcuB4)
This is the case with the left-liberals today, as they are the ones who steal the Consultation Envelopes and thus access, process and misuse personal data, but in the manner of good Bolsheviks, they accuse the Government of exactly what they do themselves.
We also have experts, let’s see the reality.
IT security is a diverse and exciting industry. A profession that everyone thinks first about knows everything. Yet his confident faith is merely a mud statue raised on the rock of his ignorance. This is what the Index journalist and its anonymous expert wrote with this in an article written in connection with the July 2020 national consultation website.
So let's learn from the case, we are uncertain, and turn to some professional materials! As an external observer, we analyze the technical side of the case!
Let's start at the beginning. What do we see and why do we see this?
This page is written in PHP using the Laravel (1) framework. In addition to being a turnkey guarantee that the programmer receives basic security features, the framework also supports developers with a debugging console. If the browser returns an error code instead of successfully loading the page, the web server will send very verbose datasheets similar to the one seen in the article with debug mode enabled (APP_DEBUG true). This site sometimes talks too much, but there are several good practices to overcome this. One of them is beautifully recognizable here. Already for the one who didn’t hang out on the Networks I. classes.
For several reasons, it is advisable to treat the web server and the database server as separate blocks and to manage their communication on a network. This is what happens here. The web server, the distributed cache (MEMCACHED_HOST) (2), and the database server (DB_HOST) (3) have separate Class C IP addresses (4), but presumably from a subnet. This ensures that endpoints can communicate with each other directly over a local area network. (192.168.x.y IP addresses refer to a local network only and cannot be accessed from the Internet.)
So we got to know a password and some of the technologies used, which is basically unfortunate, but we’re going to do virtually nothing with it because the location of the lock that belongs to it is unknown and not even publicly available. So we are not in trouble, the security of our data is guaranteed by the network environment itself.
On database servers, we can further restrict the IP address from which the connection of the technical user of the database is accepted (5). This ensures that with the DB_USERNAME value in this example, the server only accepts access from the preset address. This means that in order to use the username / password pair, we have to break e.g. the web server because we can only use it from here. Although the Laravel framework makes this difficult enough, let us be pessimistic, use additional security settings.
User and access rights. It is also a basic curriculum. If we add only INSERT rights to the given database or its table to the username, we guarantee that the server will only accept the INSERT command, ie we will only be able to upload new data. Neither SELECT, UPDATE, nor delete modes are executed due to lack of authority.
It is almost certain that in front of the examined website a complex firewall system (7) protects according to the network, as well as the so-called. WAF (Web Application Firewall) protects at the protocol level (8), so basic and most security flaws are prevented by the infrastructure.
The problem caused by the inattention of software developers can be perfectly protected even by the most basic administrator settings and the nature of the network, sinking the problem to an awkward but irrelevant level.
It will be inconvenient because for a layman, a malicious sage can easily make an elephant out of a flea.