I wonder whether FB/Linkedin can manipulate the timing of negative news like this, for strategic reasons...
Personal and social information of 1.2B people discovered in data leak
61–70 of 440 posts
Re: Personal and social information of 1.2B people discovered in data leak
#62Yet another Elasticsearch server wide open. This is going to make the flurry of open mongodb servers look trivial.
I wouldn't be surprised if the starting point for this vulnerability wasn't ES, but Docker. Docker by default modifies iptables and if you hack together a system that uses both software running directly on the host and in containers, it's going to expose the forwarded containers to the Internet - which you might not be expecting, since a bind to localhost would be enough to expose a service. It's always a good idea to have a separate firewall running outside of the your system - this is the one Docker can't fool.
Re: Personal and social information of 1.2B people discovered in data leak
#63I wonder whether FB/Linkedin can manipulate the timing of negative news like this, for strategic reasons...
Facebook/LinkedIn are not implicated in the breach at all; it was some random third-party data enrichment service. The Facebook/LinkedIn in the title refers to the fact that people's FB/LI accounts were one of the fields in the database. So were their Github, and basically any other public-facing account that these scrapers can gather.
Re: Personal and social information of 1.2B people discovered in data leak
#64I found a vulnerability in linkedIn a few years back that allowed anyone to access a private profile (because client side validation was enough for them I guess..?) They didn't take my report seriously (still not completely patched) and I feel like that told me all I needed to know about their security practices.
I reported an issue to the LinkedIn competitor https://about.me two years ago where signing in with my Google credentials gives me access to some the account of some random other person with a similar name to me. I think that during registration, I attempted to register about.me/johnradio (except it's not "johnradio"), but he was already using it, and then the bug occurred that gave me this access.
I randomly check every 6 months or so and yep, still not fixed.
Re: Personal and social information of 1.2B people discovered in data leak
#65Out of curiosity how do you guys think they managed to scrape LinkedIn on such a large scale? I've been wanting to do some social graph experimentation on it (small scale - say 1000 people near me) but concluded I probably couldn't scrape enough via raw scraping without freaking out their anti-scraping. (And API is a non-starter since that basically says everything is verboten).
LinkedIn Sales Navigator is a paid tool which allows you to search their whole database. Then depending on how much you pay you can get all their personal details (Email address, phone number, even their address sometimes.) https://business.linkedin.com/sales-solutions/sales-navigato...
Re: Personal and social information of 1.2B people discovered in data leak
#66Earlier quoted context omitted.
I want someone to start an opt-out service, where I send them $20, and they send a book of names by registered mail for opt-outs every month. An online opt-out system is too easy for them. I want each one to get a phone-book sized list of opt-outs every month. And the same for data requests. Someone that curates the data collectors, and sends them requests every month. Do you know which country’s “do not call” list I…
Would be a great idea and I bet it could be successful, but maybe at a lower price point and using lots of automation of opt-out forms. As far as opting out of many credit reporting agencies, check out https://www.consumer.ftc.gov/articles/0262-stopping-unsolici... https://www.optoutprescreen.com/?rf=t Also it seems like theres a service like this called Delete Me, but it also seems like theyre a manual opt-out shop.…
Easier to just send them your own template on paper instead of using theirs.
It should be like a doctor’s prescription in a lot of places: as long as it’s on paper and has the right elements, it’s valid.
Re: Personal and social information of 1.2B people discovered in data leak
#67Out of curiosity how do you guys think they managed to scrape LinkedIn on such a large scale? I've been wanting to do some social graph experimentation on it (small scale - say 1000 people near me) but concluded I probably couldn't scrape enough via raw scraping without freaking out their anti-scraping. (And API is a non-starter since that basically says everything is verboten).
So far, the answers have contained non-technical answers like "Distributed Scraping." Well, yes, obviously. A more useful answer is: I did this once, many years ago. Back then it was a matter of hooking up PhantomJS and making sure your user string was set correctly. Since PhantomJS was – I think – essentially the same as what headless chrome is today, the server can't determine that you're running a headless browser…
I wrote a chrome headless framework that types using semi-realistic key presses (timing, mistakes, corrections) and does semi-realistic scrolling / swiping and clicking / tapping.
It's not very hard to get something that would be too hard for almost every website beside Google and Facebook to bother with. If it's a 1 on a 0-9 scale in difficulty, most websites just don't have the resources to detect it
It took me like ~3 hours to write it, but I guarantee it would take months for someone to detect it, and even then, they'd have a lot of false positives and negatives.
Re: Personal and social information of 1.2B people discovered in data leak
#68Earlier quoted context omitted.
I want someone to start an opt-out service, where I send them $20, and they send a book of names by registered mail for opt-outs every month. An online opt-out system is too easy for them. I want each one to get a phone-book sized list of opt-outs every month. And the same for data requests. Someone that curates the data collectors, and sends them requests every month. Do you know which country’s “do not call” list I…
> I want someone to start an opt-out service, where I send them $20, and they send a book of names by registered mail for opt-outs every month This exists but it's not cheap: https://www.abine.com/deleteme/
“DeleteMe experts find and remove your personal information.”
Blargh, let the data broker figure out if I’m in their DB or not.
Trying to determine that myself seems risky. Better to send the request to every broker in existence.
Re: Personal and social information of 1.2B people discovered in data leak
#69Can I do a GDPR request for the data about myself? How?
It's weird because for oxydata you have to contact their sales team... but peopledatalabs has an opt out form. https://www.peopledatalabs.com/opt-out-form People Data Labs privacy policy: 3. ACCESS TO AND CONTROL OVER INFORMATION A person may do any of the following at any time by contacting People Data Labs at support@peopledatalabs.com. People Data Labs will reply to a person’s request within five business days. A.…
Thanks a bunch for compiling those links/emails. I've unsubscribed myself and alerted my family.
Re: Personal and social information of 1.2B people discovered in data leak
#70This is all scrapped public social media data. No credentials or govt information. It's very easy to download or buy this data legally.
are you sure? how did you come to that conclusion. thanks for the info though, very glad to hear it.
Look at the personal record that was in the article. It looks like aggregated public information. And look at what the companies referenced in the DB do.
It's possible there's someone selling them so not-quite-public info, too, but it's probably more like phone numbers and less like private messaged on Facebook or Linkedin.
The title reads like data from 1.2B profiles was leaked by Facebook and Linkedin, but this looks like scraping public profiles from them.