Business
ATO declines to fix code replay flaw within myGovID – ZDNet
Security researchers advise users to not use the system until it is patched, and given the taxation office’s response, that could be a long time coming.
The default login option for agents used by the Australian Taxation Office (ATO) is vulnerable to a code replay attack, security researchers Ben Frengley and Vanessa Teague said.
Writing in a blog post, the pair described that an attacker could use a malicious login form to capture user details, which the attacker could then use to login into other accounts held by the myGovID user.
The nub of the attack is that when a myGovID user attempts to login into a site, they are asked to input a fou…
-
General20 hours agoQueensland government expands youth justice laws, David Crisafulli tells UN critics ‘you don’t control me’
-
General23 hours agoRestaurants on the brink as business failures plateau
-
General20 hours agoCharlotte McConaghy calls for climate change action in new novel Wild Dark Shore
-
General12 hours agoThree maps that show the scale of the NSW flood disaster