You dopes! US state's pot dealer database pwned after security goes up in smoke

Don't mean to harsh your buzz: Hackers weed out access hole

33 Reg comments Got Tips?

The US state of Washington says a miscreant was able to access the system it uses to track the manufacturing and sale of marijuana.

The Evergreen State's Liquor and Cannabis Board – a job that sounds way cooler than it actually is – yesterday admitted that last weekend someone was able to exploit a vulnerability in one of its machines to access Leaf Data Systems, which Washington uses to keep records on the movement of Mary Jane.

Described as a "seed to sale" tracing process, the Leaf system is intended as a way for the board to keep track on the movement of marijuana from growers and suppliers. Growers and merchants upload information including planned shipments and movements of crops between various points in the "chain of custody" as the pot moves from farms to wholesalers and eventually shops.

Earlier this week, Washington was hit with a pot shortage after the Leaf Data System went down with what was at the time thought to be a "glitch" that had left shops unable to take in new shipments.

On Thursday, the board revealed that the "glitch" was in fact the aftermath of a hacker intrusion, and that someone had been able to obtain a copy of the database that tracked shipments.

"There are indications an intruder downloaded a copy of the traceability database and took action that caused issues with inventory transfers for some users," the board said.

"We believe this was the root cause of the transfer/manifest issue experienced between Saturday and Monday."

The stolen database contained information on shipments set to take place between February 1 and 4 of 2018, including route manifest information, vehicle identification and, license plate number. Only the manifest data is considered sensitive, as the other records are public information.

The board said that individual driver information, such as name and driver's license number, was not stored in the compromised database.

"Because there is no personally identifiable information, there is nothing that licensees need to do at this time," the board noted.

"As a precaution, with the above in mind, please review your transport plans and take any appropriate steps you feel necessary for your business."

The board did not say who might be behind the cyberattacks or what their aims for breaching the site may have been. ®


Biting the hand that feeds IT © 1998–2020