Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

131–140 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#131

Post by paulgb »

sparkywolf wrote: post #48

I found a vulnerability in linkedIn a few years back that allowed anyone to access a private profile (because client side validation was enough for them I guess..?) They didn't take my report seriously (still not completely patched) and I feel like that told me all I needed to know about their security practices.

I had a similar experience. In 2014 I reported an issue where you could take over someone's account by adding an email you control to it and having them complete the flow by sending them a link (which, unless they looked very carefully, looked exactly like the regular log-in flow at the time - especially if they used a public email service and you registered a similar-looking account).

I tried it on a friend and it worked, but LinkedIn's response was basically "meh".

My life has only gotten better since I deleted LinkedIn a few years ago. I know I'm in a privileged position to be able to do that, but I strongly recommend everyone here consider whether what they gain from their account is worth the crap and spam they have to put up with.

Re: Personal and social information of 1.2B people discovered in data leak

#132

Post by ethagnawl »

netsharc wrote: post #35
anilshanbhag wrote: post #31

People data labs's data is pretty accurate. Here is mine: https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204... You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.

Ah, looks like everyone's using that API key, I got 2 queries for my addresses and got a "rate limit exceeded" message. Strangely it only says I work in real estate (no I don't) when I looked up the email address I use for LinkedIn...

Try changing v4 to v3 in the URL.

Re: Personal and social information of 1.2B people discovered in data leak

#133

Post by MrOxiMoron »

Havoc wrote: post #17

Out of curiosity how do you guys think they managed to scrape LinkedIn on such a large scale? I've been wanting to do some social graph experimentation on it (small scale - say 1000 people near me) but concluded I probably couldn't scrape enough via raw scraping without freaking out their anti-scraping. (And API is a non-starter since that basically says everything is verboten).

once worked on a project that tried to do just that, but at the time the LinkedIn api was already limited to seeing the authenticated users connections connections, which was too limited for what we wanted to do, can only imagine it got worse. It's also the reason recruiters really want to connect to you on LinkedIn because even if you are not interested, your connections might be.

Re: Personal and social information of 1.2B people discovered in data leak

#134

Post by davidhyde »

kaivi wrote: post #85
Havoc wrote: post #17

Out of curiosity how do you guys think they managed to scrape LinkedIn on such a large scale? I've been wanting to do some social graph experimentation on it (small scale - say 1000 people near me) but concluded I probably couldn't scrape enough via raw scraping without freaking out their anti-scraping. (And API is a non-starter since that basically says everything is verboten).

I've crawled a popular social network on a large scale, currently doing the same for dating services as a hobby. God, wish I'd still got paid for webscraping. Here are some tricks which may or may not work today: - Have an app where user logs in through said website, then scrape their friends using this user's token. That way you get exponential leverage on the number of API calls you can make, with just a handful of…

You forgot the part about exposing your finished database to unprotected elasticsearch http endpoint ;)

In all seriousness does anyone know why you can even host an elasticsearch database as http and without credentials? Seems to be the default. What is the use case for this?

Re: Personal and social information of 1.2B people discovered in data leak

#135

Post by cmdshiftf4 »

anilshanbhag wrote: post #31

People data labs's data is pretty accurate. Here is mine: https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204... You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.

It returned a 404 for my personal email account, so that appears to be sufficiently protected.

More surprisingly it had data such as my name, title and work email address which was connected to old work email account (Okta managed - GSuite) that I never associated with external services, and absolutely never used on a social networking site like LinkedIn.

Re: Personal and social information of 1.2B people discovered in data leak

#136

Post by gdulli »

tyri_kai_psomi wrote: post #26
Havoc wrote: post #17

Out of curiosity how do you guys think they managed to scrape LinkedIn on such a large scale? I've been wanting to do some social graph experimentation on it (small scale - say 1000 people near me) but concluded I probably couldn't scrape enough via raw scraping without freaking out their anti-scraping. (And API is a non-starter since that basically says everything is verboten).

Distributed bot and scraper networks. Thousands of IPs geographically dispersed throughout the world. There is only so much you can do with rate limiting.

They asked about LinkedIn, where the content is gated behind a login. If it was a rate limiting problem, that would be trivial.

Needing to be logged in as the same user defeats the purpose of proxying to hide your physical origin.

Registering thousands of different users to use in a distributed way is hard now that they require a text message verification for new accounts.

Re: Personal and social information of 1.2B people discovered in data leak

#137

Post by tomc1985 »

davidhyde wrote: post #134
kaivi wrote: post #85

Earlier quoted context omitted.

I've crawled a popular social network on a large scale, currently doing the same for dating services as a hobby. God, wish I'd still got paid for webscraping. Here are some tricks which may or may not work today: - Have an app where user logs in through said website, then scrape their friends using this user's token. That way you get exponential leverage on the number of API calls you can make, with just a handful of…

You forgot the part about exposing your finished database to unprotected elasticsearch http endpoint ;) In all seriousness does anyone know why you can even host an elasticsearch database as http and without credentials? Seems to be the default. What is the use case for this?

The use case is in a local datacenter, with a NAT-ed IP not exposed to the main web

Re: Personal and social information of 1.2B people discovered in data leak

#138

Post by shadowgovt »

It's a tragedy that all of this data was available to anyone in a public database instead of.... checks notes... available to anyone who was willing to sign up for a free account that allowed them 1,000 queries.

It seems like PDL's core business model is irresponsible regarding their stewardship of the data they've harvested.

Re: Personal and social information of 1.2B people discovered in data leak

#139

Post by cm2187 »

arbuge wrote: post #113

> 400 million+ phone numbers. 200 million+ US-based valid cell phone numbers. Sounds like a nightmare in the making for those cell phone users and their carriers when those begin to get SIM jacked.

I think cold calling could be an even bigger nuisance. My DNS provider published my phone number by mistake on a whois when I registered a domain, I spotted it immediately and it was corrected within hours. Over a year later I still receive cold calls from India to sell me web services at least once or twice a week.

Imagine if you can match everyone’s position with a mobile phone, a dream for tele marketers, tailors, scammers, etc...

Re: Personal and social information of 1.2B people discovered in data leak

#140

Post by adjkant »

mythrowaway1124 wrote: post #125
jonathankoren wrote: post #115

Earlier quoted context omitted.

For a while, our Comcast billing account accessed some other person’s account. Comcast didn’t take it seriously, and just told us to create a new account and not use the old one. (!!!) We had full access. I could have signed this person up for the most expensive package, or even canceled their service.

Let's be realistic here. Everyone knows it's not possible to cancel Comcast service.

"Ah yes, cancelling requires a call because of security. A feature for the user!"
Post reply on HN