Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

141–150 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#141

Post by roywiggins »

badrequest wrote: post #107
roywiggins wrote: post #53

Earlier quoted context omitted.

This data is accessible at small scales just by registering for a free api key at People Data Labs and making a GET request, and if you want more robust access you could just pay PDL for it.

Sorry, I should have been clearer, I'm talking about whoever is responsible for leaving it completely open to the public internet.

The only person harmed directly seems to be PDL since they may find it harder to charge subscriptions for bulk access to the data.

I am not sure why this stuff being online in bulk is so much worse than being online behind a paywall that someone should actually go to jail for it.

Re: Personal and social information of 1.2B people discovered in data leak

#142

Post by cortesoft »

troebr wrote: post #117
ThrustVectoring wrote: post #97

Earlier quoted context omitted.

It looks like it's a US-based company without enough of a European presence to fall under their jurisdiction.

https://gdpr.eu/companies-outside-of-europe/ it looks like it would? I'm no expert though.

Right, they can say it applies... but if a company does no business in Europe, how can a judgement be enforced?

Re: Personal and social information of 1.2B people discovered in data leak

#144

Post by cortesoft »

badrequest wrote: post #107
roywiggins wrote: post #53

Earlier quoted context omitted.

This data is accessible at small scales just by registering for a free api key at People Data Labs and making a GET request, and if you want more robust access you could just pay PDL for it.

Sorry, I should have been clearer, I'm talking about whoever is responsible for leaving it completely open to the public internet.

I mean it is INTENTIONALLY exposed to the public... the only mistake is they are giving it away instead of charging for it. If you don't like it when they give out all the information for free, it doesn't make it better if they charge money.

Re: Personal and social information of 1.2B people discovered in data leak

#145

Post by cortesoft »

greyfox wrote: post #10
manigandham wrote: post #3

This is all scrapped public social media data. No credentials or govt information. It's very easy to download or buy this data legally.

are you sure? how did you come to that conclusion. thanks for the info though, very glad to hear it.

I mean, this is literally just a leak of data that People Data Labs is selling to anyone who signs up to their service. The 'leak' is just bypassing their payment requirements, so by definition all the data leaked is available for purchase.

Re: Personal and social information of 1.2B people discovered in data leak

#146

Post by pc86 »

arbuge wrote: post #113

> 400 million+ phone numbers. 200 million+ US-based valid cell phone numbers. Sounds like a nightmare in the making for those cell phone users and their carriers when those begin to get SIM jacked.

Is that all you need to SIM jack a phone? The phone number?

Re: Personal and social information of 1.2B people discovered in data leak

#147

Post by gbear605 »

troebr wrote: post #117
ThrustVectoring wrote: post #97

Earlier quoted context omitted.

It looks like it's a US-based company without enough of a European presence to fall under their jurisdiction.

https://gdpr.eu/companies-outside-of-europe/ it looks like it would? I'm no expert though.

I’m also not an expert, but my understanding is that it applies but would be hard for the EU to take action against them

Re: Personal and social information of 1.2B people discovered in data leak

#149

Post by lioeters »

ethagnawl wrote: post #132
netsharc wrote: post #35

Earlier quoted context omitted.

Ah, looks like everyone's using that API key, I got 2 queries for my addresses and got a "rate limit exceeded" message. Strangely it only says I work in real estate (no I don't) when I looked up the email address I use for LinkedIn...

Try changing v4 to v3 in the URL.

Yup, that worked for me.

Indeed they do have a profile on me - a bare minimum, scaped from GitHub. That makes sense, since that's about the only social platform I use, aside from HN.

EDIT: My GMail address has the most amount of information gathered, which makes sense. It's gathered Facebook, LinkedIn, Pinterest, GitHub..

It lists my skills as: firefighting and emergency planning/management/services. I suppose, with a stretch of imagination..

Re: Personal and social information of 1.2B people discovered in data leak

#150

Post by atonse »

d33 wrote: post #62
kitotik wrote: post #4

Yet another Elasticsearch server wide open. This is going to make the flurry of open mongodb servers look trivial.

I wouldn't be surprised if the starting point for this vulnerability wasn't ES, but Docker. Docker by default modifies iptables and if you hack together a system that uses both software running directly on the host and in containers, it's going to expose the forwarded containers to the Internet - which you might not be expecting, since a bind to localhost would be enough to expose a service. It's always a good idea t…

I had this issue last week. I was pulling my hair out as to how my brand new Linode got hacked even though I had setup ufw within minutes.

It is downright ridiculous that this was ever approved as a default behavior.

Post reply on HN