HISA (Horseracing Integrity and Safety Authority) is making some extremely excessive claims regarding Marshall Gramm’s access to records maintained within the HISA Portal available to owners and trainers.
What follows is a look at how that access actually worked, why it does not constitute hacking, and why the HISA Portal is a poorly built system with multiple vulnerabilities. You don’t need a technical background to follow it, the failures here are basic ones.
How the HISA Portal works Link to heading
The HISA Portal is a web based software platform accessible in a browser, as well as through mobile applications for iPhone and Android. Users are given login credentials based on their status as an owner, trainer, or veterinary staff member.
This next part is worth calling out: in typical modern software platforms, once you are logged into a website your identity is tagged on every single action you take. Any time a request is made, the platform can see which account is making it. The website always knows who is asking.
The portal never checked whether you should see what you asked for Link to heading
The HISA Portal clearly did not scope user accounts to data associated with the individual owning the account. This allowed any individual with an account on the HISA Portal to see all the data contained within their database.
Another workflow that works in this scenario is Owner A opens the HISA portal to a URL for their horse and sends that URL to Owner B (who isn’t an owner of that horse), once logged in Owner B will have the ability to see this page. Technically this is the exact same usage pattern, but would we consider this hacking? Absolutely not, this is two users operating in a way that is fully allowed by the software platform.
This is a rather unusual decision for a software platform, as standard industry practice includes additional checks to ensure that account holders only access information associated with them as an individual. While you could argue that a small team on a tight timeline might start cutting some corners while building out a platform, that argument falls flat once you review the enormous yearly technology budget HISA has.
Using a testing tool is not hacking Link to heading
Playwright is an open source testing platform that allows for testing websites as a user would access them. It launches a Chrome window and scripts through button clicks and page loads to ensure that the right elements appear and respond as they should. Developers use it on their own sites every day.
Providing your valid login credentials to Playwright and having it pull down information from a website does not constitute hacking in any way, shape, or form. The entire intent of Playwright is to mimic what a user would do within the browser. Credentials are not stolen. Access is not reverse engineered. In fact, you don’t even need to know how to program in order to use something like this.
How could HISA have prevented this? Link to heading
The short answer is: build a software platform that conforms to modern best practices and standards. This is a total case of gross incompetence in building software. Three fixes, all of them standard, would have made this impossible.
Restrict which accounts can access which records. Having restrictions in place for which accounts can access which records makes this entire situation impossible. It is the fix that matters most, and it is not an optional one in modern software.
Rate limit requests. Modern software platforms can control how frequently their systems can be accessed. For example, a platform could have code built into every request to ensure that a given user can only make 10 requests per minute. They can even configure the system to lock a user account if the number of requests exceeds some unreasonable number. The definition of an unreasonable number is a case by case decision, and platforms can have very different definitions.
Stop using sequential numbers as identifiers. Using sequential numbers for identifiers (e.g. 1, 2, 3, 4, 5) allows anyone to just add one to a number in a URL like https://example.com/horse/1 and pull every single record in the database. This is considered the most basic form of a terrible software practice. Most modern software platforms use identifiers that look like this: f47ac10b-58cc-4372-a567-0e02b2c3d479. These identifiers are extremely difficult to figure out, as they do not follow any defined sequence and the possible combinations are so numerous that guessing them is a worthless endeavor. This is why they have become a standard practice in software to identify users and data.
The “sophisticated investigation” claim does not hold up Link to heading
These records were accessed with a valid login, and that login was associated, or should have been associated, with every single request that was made. This makes the claim of needing to launch a sophisticated investigation absolutely laughable. It should have taken the technology department all of about 30 seconds to figure out which account had accessed all their records.
They clearly were not alerted to the fact that these records were accessed at all, which is also something extremely trivial to do.
Others have very likely done this already Link to heading
These are such basic practices for any software platform to implement, especially one as well funded as HISA, that I cannot understand why they would be ignored. This almost feels like it was intentionally left wide open.
It also seems painfully obvious that these records have likely been accessed by others, who have all likely gone undetected due to the complete lack of logging and alerting within their systems.
The data itself is damning Link to heading
The entire point of this organization is to ensure the integrity and safety of the sport. They are sitting on vet records of horses currently racing that show a complete lack of integrity and safety.
If the claim is that this data was used as an advantage in either claiming or wagering, then the claim is also that horses are racing that shouldn’t be, and that there’s obvious data that proves it.
Summary Link to heading
This is such an aggressive response from an organization that has shown that, with a significantly large budget, it can’t even handle the basics of managing integrity or safety in this industry. Attempting to spin this as a sophisticated hack and aggressively punish someone because they clearly cannot do their jobs is the complete opposite of integrity. They are making a claim of a significantly complex investigation, but have not made public any details on what this entails. This is likely because there was nothing complex or significant about their investigation. They made mistake after mistake and are trying to save face and use Marshall Gramm as a scapegoat. If you are going to make serious claims, back them up with verified evidence. The fact they needed to be “tipped off” shows clearly they have no idea what they are doing. This has absolutely no bearing on the complexity of the system used to access data.
HISA and its leadership should be ashamed of themselves for how poorly they have operated and how poorly they have handled this situation. This is just the latest example of an industry that can’t seem to get out of their own way.