Job board website vulnerable to hacking, data interception

A popular Yukon job board website is vulnerable to hacking because its managers have not put common security measures in place.

A popular Yukon job board website is vulnerable to hacking because its managers have not put common security measures in place.

YuWin.ca doesn’t use Secure Sockets Layer (SSL) that allows encryption of all the data exchanged between a client computer and the internet server hosting the website yuwin.ca

“It’s rare to see (no SSL) these days,” said Martin Lehner, an IT specialist and co-owner of Tangerine Technology in Whitehorse.

“It’s quite surprising they wouldn’t encrypt,” Lehner said. “They’ve had executive directors who have been from the IT industry.”

SSL is becoming ubiquitous as even Google now encrypts all searches by default.

“At some point the entire internet will be SSL (encrypted) anyways,” Lehner said.

Because the data exchanged is not encrypted, an attacker could intercept a user’s login information.

While YuWin doesn’t hold information, such as social insurance numbers, that could be used for fraud or identity theft, hackers could still make use of the passwords used for YuWin accounts.

That’s because people often reuse the same password for different services, Lehner said.

“I would say anybody who has an account on the job board … should know their internet password is viewable at a minimum by the YuWin staff or anybody who has access to the backend,” he said.

And an attacker wouldn’t even need to be on the same internet network to intercept passwords, Lehner said.

All he or she would need to do is capture data flowing between the Yuwin.ca’s server and other internet routers.

“Eventually if you wait long enough, you can pull traffic out,” Lehner said.

The lack of SSL also means an attacker could impersonate the website, and trick people into entering their login information.

It doesn’t matter that YuWin is a Yukon-based website, Lehner said, because hackers will scan the entire internet looking for vulnerable services.

Implementing SSL is neither expensive nor difficult, Lehner said.

“I would suspect that with the government who funds them, they probably expect the data is kept reasonably secure.”

YuWin chair Debbie Parent told the News the board was aware of the situation and working on it.

Parent asked the News to withhold publication of this story in exchange for first crack at a news release to be issued Tuesday. The News declined.

Contact Pierre Chauvin at pierre.chauvin@yukon-news.com

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

U Kon Echelon hosts Tour de Haines Junction

U Kon Echelon continued its busy schedule with the Tour de Haines… Continue reading

Melted beeswax, community pottery take centre stage at Arts Underground’s August shows

Two new, and very different, shows will be opening at Whitehorse’s Arts… Continue reading

Northern First Nations call for a major overhaul of mining legislation

The Na-Cho Nyäk Dun, Tr’ondëk Hwëch’in and Vuntut Gwitchin Governments say change is long overdue

Yukon Salmon Sub-Committee recommends First Nations take ‘additional measures’ to conserve Chinook

Recommendation comes as Chinook run on the Yukon River appears unlikely to meet spawning goals

Students prepare for online learning as Yukon University announces fall semester

The school plans to support students who may struggle with remote learning

Changes to federal infrastructure funds allow for COVID-19 flexibility

Announcement allows for rapid COVID-19 projects and expands energy programs to Whitehorse

City hall, briefly

A look at decisions made by Whitehorse city council this week

C/TFN announces Montana Mountain reopening plan

Carcross/Tagish First Nation and the Carcross/Tagish Management Corporation announced the partial reopening… Continue reading

Roberta Joseph reelected as Tr’ondëk Hwëch’in chief

Unofficial results show Joseph with more than double the votes of runner-up

Development incentives considered for three projects

Projects will add 24 rental units to the market

Delegate calls for crosswalk changes to show support for people of colour

Mayor states support for idea, but cautions it could take some time

Whitehorse advises of water system maintenance

Residents on the city’s water system are being advised they may notice… Continue reading

Walkway, signs planned for West Dawson paddlewheel graveyard

Unofficial attraction may get 135-m walkway and interpretive signs, if YESAB application approved

Most Read