Vehicle License Plate Number & Data breach - with lsmvaapvs.org


#1

Hi Guys.

I don’t know if anyone has seen this - www.lsmvaapvs.org. Powered by - Lagos State Ministry of Science & Technology.

ANYONE one can now query your plate number and retrieve your First name & Last Name.

I reached out to the ‘solutions architect’ (thanks to whois.com) who gave a flimsy excuse stating

“Your inquiry should be directed to the Lagos State MVAA office. Besides, the information listed there is public domain information. Also, it isn’t actually stored on the server. You can also access it via the askniid.org website. It is used by law enforcement to verify details about your vehicle.”

Really ? law enforcement ( with no controlled access ?)

FRSC - http://www.nvisng.org/NumberPlateVerification.aspx &

NIID - http://askniid.org/checkpolicy.aspx has such query system but were decent enough to withold personal details.

Why am i sharing this ? One of us may know someone in Lagos state government that can make sure the name aspect is removed OR better still reach out to lagos state government on all channels till some action is taken.

Hope to hear some effective proposals .

E


#2

I also believe that some personal details should be hidden when querying a licence number and the reason is this:

There’s this instagram account called gidicars. They specialise in showing the mad cars on lagos roads without blurring their license plates and i recalled i once reached out to them that they should blur license plates of the cars but apparently the message was not heeded too.

In a bid to make them see the folly of not blurring license plates, last week, i went on their page, copied some license plates, queried them on www.lsmvaapvs.org, got some matches, searched on facebook for the names that were displayed on the website and i got back results that matched the names on the www.lsmvaapvs.org website.

Morale of this bulletin is that someone needs to contact them as indicated by oga @Chukwuemeka_Mba and let them know that showing full information about the owner of a car to general public is not a very good idea or the full details should be made available to right people.

Anybody with the wrong motive could use the information against the owners of cars registered in lagos and since we all like to show stuffs on the internet, getting where we live, eat of have fun isn’t a stressful task at all

I think Prosper Otemuyiwa can help with this because i saw a github repo in the name of the website on his github profile.


#3

I concur, we don’t take security seriously in nigeria.


#4

That was just an unofficial API he built.


#6

Ok, my bad.


#7

Update: The Name Section has been removed. Goodie.


#8

NIID - http://askniid.org/checkpolicy.aspx was open to the public too with details of your insurance registration visible until after a while when it was disabled.

This too should be restricted to either a subscription based service or privilledged before boys starts using it to fish out fine babes driving expensive cars :joy:


#9

And so it happens…


#10

This is undoubtedly titillating, but, pray tell, what has it to do with this conversation?


#11

I suspect he (or she) is trying to get us to see this bit :slight_smile:

“The more inquisitive among them took advantage of a new website for vehicle registration in Lagos State which unveils the ownership of any vehicles by its number due to a bug on the webpage, and discovered that one of Ms. Okeke’s most prized possessions, the posh Mercedes-Benz car, is registered to “Apostle Suleman Johnson.””


#12

Ah! I see.


#13

Funny enough, it wasn’t a “bug in the code”. It was a lazy programmer who commented out PII instead of removing it.


#14

‘Lazy’ programmer indeed :smiley: more reason why one need to vet programmers closely before engaging or pushing their codes to production environment. Wonder what he was thinking by just commenting out the lines instead of removing it entirely. My thoughts are that it may not be the programmer him/herself who did this but rather an IT staff of the Lagos State department managing it.


#15

You might be right.


#16

Still don’t see any reason why this is a big deal.
If someone sees a fine car and captures the number plate, then follows the owner home. What difference would knowing the owner’s name have to do with the car?


#17

The difference is that, you know the person well before ‘following’ them home when you use the site unlike just following them blindly :slight_smile: