OpenSSH flaw on Alpine Linux and the 70 euro hospital ticket I paid 1 euro

Yesterday a flaw in OpenSSH on Alpine Linux came out. And it reminded me of a story from when I was just starting out.

What OpenSSH is, in simple terms

OpenSSH is the program you use to connect to a computer remotely, typically a server: you connect, you authenticate, and from there you control the machine as if you were sitting in front of it. It’s everywhere.

The flaw: if the machine has a user without a password, presenting any very long key is enough to get in. Not the right key, any key.

Why Alpine matters so much

Linux isn’t a single operating system, there are many distributions: different packages, different choices, same core. Alpine is one of the smallest and lightest, which is why it’s the base of a huge number of containers and servers.

The flaw has already been patched. But if you use Alpine as a base you need to update, otherwise it’s a real problem, both for the servers and for the users on them.

The 70 euro ticket paid 1 euro

I was at Careggi hospital in Florence for blood tests. Nurses on strike, lots of time to kill and my laptop with me. So I start paying the medical ticket online: 70 euros, field “not editable”.

Not editable for anyone who doesn’t open the page source. I opened it and typed 1. A 1 euro payment, a 70 euro receipt.

Reports that went nowhere

I reported it to everyone. I even reported myself, and in the end I paid the missing 69 euros out of my own pocket. Result of all the reports: nothing.

The best part is that some time later, at a job interview, I found myself sitting in front of the very developers of that application.

The flaw stayed there for years. Fixing it took more or less one line of code: checking on the server that the amount paid matched the amount due.

More security culture

The moral is always the same, like with the freezers thawed by hackers: we need more security culture for everyone, physical and digital. If people lack it, companies lack it too, because companies are made of people.

How long do you think a flaw like that stayed open? Tell me in the comments on the video (it’s in Italian).