Security – Creative Administration

Neon CRM Vulnerability Allows Modification of Member Numbers

TL;DR: Earlier this summer the SCA configured their Neon CRM membership portal to show registered users their member number. I discovered a vulnerability in Neon One’s software that allowed technically-savvy users to use that capability to change their member number to any value they desired.

After this was reported, the link to the vulnerable screen was removed, but the screen still exists and the vulnerability in the underlying Neon CRM software appears to remain unpatched.

In February the SCA completed the migration of its membership data from an aging legacy system (“Members Only”) to a new platform hosted by Neon One. Their Neon CRM service now appears to function as the system of record for the Society’s member records, including modern names, addresses, and payment information, as well as SCA-specific data such as Society name, kingdom, and member number.

SCA To End Emailing of Credit Card Numbers

The SCA will soon stop asking local event organizers to pay for venue insurance certificates by sending their personal credit card number to the corporate office via email, as it had been doing for the last two decades.

Instead, event organizers will be asked to process those credit card payments on the new membership portal operated by NeonOne, as hinted when the new higher costs for certificates were announced in April.

This change will be well received by Internet security enthusiasts among the membership, who have complained for many years about the practice of sending credit card numbers by email.

Procedures for Reporting IT Vulnerabilities

The SCA does not have an established procedure for reporting or addressing technology security vulnerabilities.

In correspondence with the Society IT Manager, they suggested sending vulnerability notifications by email, either to them, or to the relevant kingdom officers, or both.

Accessing SCA Member Information

For reasons discussed here previously, I was curious as to how complex it might be to programmatically access member data from the SCA’s new member portal.

It turns out the switch from MembersOnly to NeonOne has made this dramatically easier, and we can access member data in just a few lines of Python without scripting Chrome or hand-crafting any RPC calls.

Letter: Reconsideration of Sanction of Brian De Moray

I have sent the following letter regarding the sanction of Brian De Moray to the Society Seneschal, the Board Comments address, and the Ombudsman for IT, with copies to the Society IT Manager, Society Webminister, East Kingdom Webminister, and Brian De Moray himself. As always, I included my modern name and member number. Receipt was acknowledged less than two minutes later; I suspect they’re having a busy weekend over there. I will update if further action is taken.

To the Society’s Seneschal and Board of Directors, greetings from the East.

I write to you today to ask you to reconsider the January 2020 sanction of Brian De Moray, as the information available in the public record suggests that this decision may have been made in error.

The Sanction of Brian De Moray

TL;DR: Brian De Moray is a Master of Defense and of the Pelican in Atlantia, who was sanctioned by the Society in January 2020 for an innocuous 113-word Facebook post commenting on software development work he was doing as a volunteer for the kingdom.

As far as I can tell from the information available to me, this sanction appears to have been an error, made in haste by a Board that misinterpreted some technical jargon they didn’t understand, and should be reversed.

I first became aware of this case when it was mentioned in the context of the Wistric Saga, being discussed by Aeron Harper in the second part of his “Tale of Six Sanctions” essay. Aeron’s article was focused on the procedures and policies of the sanctions process, and understandably glossed over some of the technical details, but as a software developer, my curiosity was piqued.

At the time, I was disappointed to learn that Brian was reluctant to discuss the details for fear of additional sanction, but ten days later he published additional information, including technical details of his work, after the Chairman of the Board of Directors assured him that he would not be sanctioned a second time for the same offense.

The SCA Lists Archive Breach

TL/DR: An SCA IT web configuration error exposed confidential email messages.

For three years, the SCA mistakenly published all email sent to Board of Directors’ feedback address, allowing anyone on the Internet to read messages that had been sent in confidence, including reports of harassment and sexual assault.
If you emailed sca-comments@sca.org between March 6, 2020 and February 2, 2023, you should be aware that the message you sent is no longer secret and has likely been read by other people outside of the organization’s leadership.
Six mailing lists used by committees for internal communication were also affected.