Medgadget's Guide to Hacking into Social Networks for Doctors

So other than being professional A--holes,Whats the point in publishing this?

If someone gains entry into a site such as Sermo using this technique, I look forward to investigating whether they can be prosecuted for identity theft.

To demonstrate security issues; that 'restricted access' is easy to work around.

Sermo actually requires a physician's date of birth and not, as you incorrectly suggest a year of graduation. it is much more secure than this article suggests.

grisdoc (sermo user)

grisdoc :

Date of birth is not a security feature in Sermo. And they do check the graduation date.

Obviously the ethics held by doctors are not also held by medgadget. "Educational purposes only" does not justify this post.

The authors of MedGadget have more exemplary ethics than NoLongerAReader, they're uncovering the very dangers of poor authentication of existing sites. I join them (and reminesce from my days as a MedGadget editor) and blogged about it at Doctor Geek, M.D.

As a physician, I have nothing but contempt for fellow physicians who place their own egos above with welfare of their physician colleagues. At least 2 of the 3 editors of medgadget are members of Sermo. Yet, their solution to perceived holes in Sermo security was not to contact Sermo or start a post to Sermo members, but instead to post instructions about how to break the law in order to gain access to Sermo. This illustrates to me that their primary purpose isn't Sermo, but the furtherment of their own blog. Now I am not so naive as to think that they revealed any great secrets, but I have no doubts that the would have it they could have.

I know that there are many physicians who read this blog. My question for you is whether you are willing to support a site (medgadget) which gives detailed instructions how to access the DEA and license numbers of fellow physicians, when the only way that people can use this information is by breaking the law through identity theft? Personally, I am not willing to support any such endeavor, nor any company that advertises on their site.

UnbrknCh8n:

As a physician, I have nothing but contempt for fellow physicians who believe that... public does not have the right to know how to use public databases...

As a physician, I have nothing but contempt for fellow physicians who believe that... fellow physicians cannot do investigative reporting...

As a physician, I have nothing but contempt for fellow physicians who believe that... Sermo.com did nothing wrong, while Sermo perfectly knew about the gaping hole in their security...

As I've told you in Sermo, please direct your anger elsewhere.

DrO:

You state "As I've told you in Sermo, please direct your anger elsewhere."

The way I see the situation is that you write and post an article titled, "Medgadget's Guide to Hacking into Social Networks for Doctors."

In this article, you state:
"So, if you don't care what identity you assume, write down one of the DEA numbers there, last and first name, and then head on to the medical board site for that physician's state. Find his/hers medical school and graduation date, and you are all set. That was easy."

It is obvious that instead of trying to trying to bring attention to security issues in Sermo, you are instead encouraging people to assume the identity of physicians.

This does make me angry. And it is with you that I am angry. So what better place is there to bring this discussion than to the comments section of this article?

It always amazes me when people going around with a haughty, superior and 'holier than thou' attitude while doing unethical, immoral and illegal things. Congratulations writers of medgadget, you really take the cake in the area of hypocritical behavior. No matter how you state your disclaimer "Here's how to do something illegal, now please don't actually do it" you are really just helping people gain private information about others. Why not call the blog what it really is? AmateurHackersWithoutEthics has a nice ring to it. The reason the internet needs better security measures is because of people exactly like you.

dcted:

Before accusing anyone about unethical, immoral things, ask yourself about Sermo. Who developed flawed system, advertised it as super secure, and fooled thousands of physicians?

In terms of us, public has the right to know how to use public databases.

This entire discussion is really quite old: apparently people are fighting over this topic since the 19th century. The question of full disclosure is very controversial. More on the topic can be found here: http://en.wikipedia.org/wiki/Full_disclosure

However in my opinion, publishing this literally step by step guide to exploit the system wasn't a very smart thing to do.

Good discussion on http://www.xconomy.com/2007/09/26/sermo-strikes-back-a-physicians-online-community-lashes-out-against-bloggers-who-publicize-security-gap/#comment-1618

about this topic

When can we start acting like professionals again?

yours hopefully

gd

Quoting from the xconomy site what Bruder, whose name links to this site:

Bruder -

I cannot think of a better statement about the journalism of medgadget.com than to quote your very words as you have said i best:

"As for you claiming that this has something to do with credibility of Medgadget reporting on this, then you're just being silly because in the long run, there is no need for credibility here. The issue is very clear that Sermo is compromised. As I said before, you don't need an expert to see that the door is open. If a ten year old would have noticed this, it would have been just as true."

Being sarcastic, "there is no need for credibility here" might just make a good masthead saying for medgadget.com

Journalism is all about credibility
]

For the record Bruder of medgadget added to what I said above without any editorial notation [nothing was added to Michael's writing. The quote he attributed to Bruder was inserted how it appeared originally. This was an action to prevent Michael from censoring Bruder] of doing that so the reader should realize that medgadget has edited my comments.

Is there a place on this site where it is stated that medgadget can edit comments - many of the newspapers do state that letters to the editor can be edited so does that apply in these discussion groups. It does say above "Open comments are not moderated, although abusive and vulgar remarks may be deleted. Opinions expressed do not necessarily reflect the views of Medgadget.com. Please consult our disclaimer." and I do not think I have been abusive or vulgar, but obviously there seems to be moderation

On xconomy.com this is what Bruder posted in regards to my above comment. Should have posted it with the above:

Michael,

I updated your comment on Medgadget to include my whole quote, not out of context like you decided to do. I hope that helps with the credibility and understanding. You can take a look here: http://www.medgadget.com/archives/2007/09/medgadget_guide_to_hacking_into_social_networks_for_doctors.html

Hmmm .... changing what someone writes in a web page where comments are welcomed and not letting other readers know what has been changed and why, raises the question of how does anyone know what is said in the other comments is what was said by the responder and not people at medgadget to make medgadget look better - isn't that an issue of credibility? If stories on web pages are changed, is there a notation or an addendum like would be done in the print media or does the late reader not know it has been changed.

One last quick question Bruder and then I think it is time to quit this.

Did you mean to say misrepresent what you said rather than censor what you said because I, unlike you, cannot moderate, edit or delete what others say and cannot even do that to my own posts after sent in.