Halifax Water breach raises questions about ethical hacking

In February, Halifax Water received a tip from an unknown third party about a vulnerability in the utility’s Customer Connect portal. The email was dismissed as spam.

A month later, the third party followed up. This time, the issue was escalated all the way to the cybersecurity team. The portal was taken offline and, following an investigation, Halifax Water found that information from 16 customer accounts had been accessed.

In August, the utility said it was expanding its cybersecurity testing and strengthening escalation processes for security-related incidents.

The Halifax Water breach raises questions about well-intentioned but unauthorized hackers identifying vulnerabilities in an organization’s cybersecurity systems.

Chuks Awunor, the founder of cybersecurity company GuardsArm, says dismissing the initial tip shouldn’t have happened.

“Because it seems they don’t have a channel where tips like this could be reported and action taken,” Awunor says.

Halifax Water said in a statement to CBC News that it wouldn’t comment publicly on specific vulnerabilities, security testing activities or details of its cybersecurity controls.

“We can say, however, that Halifax Water takes cybersecurity seriously and has processes in place to review and respond to security issues through its established policies and reporting channels,” the statement reads.

Some companies use a practice known as ethical hacking to identify cybersecurity weak spots.

Ethical hacking involves authorizing cybersecurity firms to use hacking tools to test a company’s vulnerability to malicious actors. It’s considered an effective cybersecurity tool, giving companies a proactive method for improving their defence in a constantly changing field.

Ethical hacking takes all of the tools a hacker has and uses them to improve cybersecurity for companies and organizations. (Kacper Pempel/Reuters)

But that’s not the case in the Halifax Water breach, where the initial tip and subsequent followup came from an unknown third party.

Srini Sampalli is a professor at Dalhousie University who specializes in cybersecurity. He says good intentions alone do not make a hacker ethical.

“I would say the critical difference is authorization,” he says. “An ethical hacker normally has permission from the organization, a clearly defined scope and rules about what they can do and what they cannot do.”

Sampalli says the tip coming from an unauthorized third party makes the Halifax Water situation complicated.

Srini Sampalli says that the situation around Halifax Water is tricky due to an unauthorized third party providing the tip. (CBC)

“Did the person who disclosed [the vulnerability] have malicious intentions? Probably not. Did they do the right thing by reporting it? Yes. However, how did they discover the vulnerability? Did they go around poking the portal with hacker tools?

“That doesn’t fall under the principles of ethical hacking, so I would be cautious about calling this person an ethical hacker,” he says.

Permission is key when it comes to ethical hacking; when a cybersecurity company does a penetration test, or pen test, they could expose personal information, alter data or affect other users. If any of that information is compromised, it’s the owner of the system who bears responsibility.

Both Sampalli and Awunor say that proactive cybersecurity is not a one-time deal. It requires constant upkeep, and companies should avoid taking shortcuts.

“A lot of guys do automated pentesting, which is very wrong,” says Awunor. “Yeah, you can automate some [aspects], but there’s certain things you have to do manually to really find out the vulnerabilities.”

Despite the risks involved, Sampalli says the principles of ethical hacking are taught in all cybersecurity courses.

As technology continues to improve, it creates new attack surfaces for hackers to take advantage of. This is why being proactive is the only way to keep systems safe.

“Students should be taught how attackers think, but it must be integrated with ethics, law and responsibility,” he says. “Cybersecurity is a continuous problem and we need to address it on a day-to-day basis.”

MORE TOP STORIES