Folks, please remember to PURGE GIT COMMIT HISTORY of the file. It does no good to simply remove a password if it's there in plain (historical) sight.
https://help.github.com/articles/removing-sensitive-data-fro...
Hackers sell data of 130M Chinese hotel guests on dark web for 8 Bitcoin
21–30 of 33 posts
Re: Hackers sell data of 130M Chinese hotel guests on dark web for 8 Bitcoin
#22wondering if there is a service to be built selling data through cryptocurrencies...
Re: Hackers sell data of 130M Chinese hotel guests on dark web for 8 Bitcoin
#23so something that happens everyday is news worthy why? because he undersold? or is this type of data so common that it was only worth 50k USD?
[deleted]
Re: Hackers sell data of 130M Chinese hotel guests on dark web for 8 Bitcoin
#24Earlier quoted context omitted.
please don't over estimate their skills and qualification. the leaked database username is root and the password is 123456. the screenshot of the github file can be access here: https://www.secrss.com/articles/4851 and yes, that "programmer" pushed such highly sensitive company information to his personal github repo.
This happens so frequently, and is easy to scan for, sadly. What is missing is a way to programmatically, and secretly, inform people of their mistakes. I've personally found literally hundreds of examples of this and lack the manpower to file that many tickets....
What is missing is a default or recommended git hook to reject pushes that contain passwords for the patterns that are obvious.
Re: Hackers sell data of 130M Chinese hotel guests on dark web for 8 Bitcoin
#25Earlier quoted context omitted.
please don't over estimate their skills and qualification. the leaked database username is root and the password is 123456. the screenshot of the github file can be access here: https://www.secrss.com/articles/4851 and yes, that "programmer" pushed such highly sensitive company information to his personal github repo.
This happens so frequently, and is easy to scan for, sadly. What is missing is a way to programmatically, and secretly, inform people of their mistakes. I've personally found literally hundreds of examples of this and lack the manpower to file that many tickets....
[deleted]
Re: Hackers sell data of 130M Chinese hotel guests on dark web for 8 Bitcoin
#26> The company's developers accidentally uploaded the entire database to Github Wait, from what I've heard, the programmer just uploaded a configuration file that contains the password of the database? And oh boy, he's not the only one, Maybe GitHub can do something about it. To the topic: This is the exact reason why I don't support any sort of system that log users personal information without user's control. Becaus…
please don't over estimate their skills and qualification. the leaked database username is root and the password is 123456. the screenshot of the github file can be access here: https://www.secrss.com/articles/4851 and yes, that "programmer" pushed such highly sensitive company information to his personal github repo.
Why do people store secrets directly in their codebase? It makes me physically ill seeing this. Environment variables exist for a reason.
Re: Hackers sell data of 130M Chinese hotel guests on dark web for 8 Bitcoin
#27> The company's developers accidentally uploaded the entire database to Github Wait, from what I've heard, the programmer just uploaded a configuration file that contains the password of the database? And oh boy, he's not the only one, Maybe GitHub can do something about it. To the topic: This is the exact reason why I don't support any sort of system that log users personal information without user's control. Becaus…
please don't over estimate their skills and qualification. the leaked database username is root and the password is 123456. the screenshot of the github file can be access here: https://www.secrss.com/articles/4851 and yes, that "programmer" pushed such highly sensitive company information to his personal github repo.
123456
That's the kind of combination an idiot would have on his luggage!
Re: Hackers sell data of 130M Chinese hotel guests on dark web for 8 Bitcoin
#28Folks, please remember to PURGE GIT COMMIT HISTORY of the file. It does no good to simply remove a password if it's there in plain (historical) sight. https://help.github.com/articles/removing-sensitive-data-fro...
And obviously rotate the exposed credentials - because even if it was only public for "a while" it could have been viewed by many users.
Re: Hackers sell data of 130M Chinese hotel guests on dark web for 8 Bitcoin
#29Ignoring the moral/ethics concerns, how would a potential buyer know that the data is legit (if it even exists at all?). Give me a couple of days and I'll create a fake -but real looking- set of records with millions of false customers (it would be made real enough by using public information)... If you tell me that they'll provide an extract as "proof", I'll answer: it's easy to cook-up a realistic small sample, jus…
Perhaps if you are a buyer of this data you have similar, if smaller, databases. You could then say, here's ten thousand hashed credit card numbers from my collection. Give me the full data for ~1,000 of them. If their data lines up with yours that's a good sign.
This wouldn't be a perfect method, but if the seller could do it then it would increase my confidence a lot.
Re: Hackers sell data of 130M Chinese hotel guests on dark web for 8 Bitcoin
#30Points lost for claiming VPNs are a way to access the dark web. Points gained for referring to Tor as a privacy oriented tool.
They got that it's a privacy-related thing, but they still called it a browser...
I'm always conflicted on how "correct" articles like this should be. I would prefer that they were more accurate when it comes to technology, but for the average reader (who might leave a password in git) it might be better to over simplify