Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Personal and social information of 1.2B people discovered in data leak

dataviper.io

Post reply on HN
Print view View original

211–220 of 440 posts

Re: Personal and social information of 1.2B people discovered in data leak

#211

Post by lmilcin »

Xylakant wrote: post #170
jillesvangurp wrote: post #155

I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad... , in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to…

> Out of the box it does not even bind to a public internet address. Bind to all interfaces used to be the default in 1.x - it changed pretty much because people were footgunning themselves. Coupled with lack of security in the base/free distribution, that made for a dangerous pitfall. At least now security is finally part of the free offering, but the OSS version still comes with no access control at all.

You typically use these in pods which share networking but are not available from outside.

It doesn't matter then if you bind it to 0.0.0.0.

Re: Personal and social information of 1.2B people discovered in data leak

#213

Post by CrazyStat »

olivierduval wrote: post #98
troebr wrote: post #90

Earlier quoted context omitted.

It would be really surprised if this were compliant with the GDPR. I live in the US but I tried email accounts of relatives in Europe and they had data in there.

So... if the owner is known, it will be quite costly ;-)

It's no secret who is behind that website [1].

Good luck to the EU on enforcing their law against an American company, though.

[1] https://angel.co/company/peopledatalabs/people

Re: Personal and social information of 1.2B people discovered in data leak

#214

Post by dmw_ng »

simonlc wrote: post #96
john-radio wrote: post #64

Earlier quoted context omitted.

I reported an issue to the LinkedIn competitor https://about.me two years ago where signing in with my Google credentials gives me access to some the account of some random other person with a similar name to me. I think that during registration, I attempted to register about.me/johnradio (except it's not "johnradio"), but he was already using it, and then the bug occurred that gave me this access. I randomly check e…

I actually had a similar thing happen with facebook, though we didnt share names.

I signed up for a disposable Gmail account using my real name at one point, and accepted the randomly suggested address it offered. Gmail loaded with someone else's obviously in use mailbox

IIRC I logged out again and back in, same thing, my credentials worked. Went back to it a few days later and the password no longer worked

Re: Personal and social information of 1.2B people discovered in data leak

#216

Post by lacker »

jerrac wrote: post #165
jillesvangurp wrote: post #155

I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad... , in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to…

I've been using ES off and on since before 1.0 came out. It has always baffled me that ES doesn't require a username and password by default. ES is a database that has to exist on a network to be usable. Heck, it expects that you have multiple nodes, and will complain if you don't. So one of the first things you do is expose it to the network so you can use it. Yes, it takes some serious incompetence to not realize y…

If you set up elasticsearch on a cloud service like AWS, by default your firewall will prevent the outside world from interacting with it, and no authentication is really necessary. If you do use authentication, you probably wouldn't want username+password, you would probably want it to hook into your AWS role manager thing. So to me, username+password seems useful, but it isn't going to be one of the top two most common authentication schemes, so it seems reasonable that it should not be the default.

MongoDB also by default does not have username+password authentication turned on.

I think defaulting to username+password is a relic of the pre-cloud era, and nowadays is not optimal.

Re: Personal and social information of 1.2B people discovered in data leak

#217

Post by amerine »

godelski wrote: post #203
shadowgovt wrote: post #138

It's a tragedy that all of this data was available to anyone in a public database instead of.... checks notes... available to anyone who was willing to sign up for a free account that allowed them 1,000 queries. It seems like PDL's core business model is irresponsible regarding their stewardship of the data they've harvested.

Would it be better if this was a paid service? If the issue access to the data, then maybe we should ask if this data should be collected in the first place.

That is OPs point.

Re: Personal and social information of 1.2B people discovered in data leak

#218

Post by dharmab »

lmilcin wrote: post #211
Xylakant wrote: post #170

Earlier quoted context omitted.

> Out of the box it does not even bind to a public internet address. Bind to all interfaces used to be the default in 1.x - it changed pretty much because people were footgunning themselves. Coupled with lack of security in the base/free distribution, that made for a dangerous pitfall. At least now security is finally part of the free offering, but the OSS version still comes with no access control at all.

You typically use these in pods which share networking but are not available from outside. It doesn't matter then if you bind it to 0.0.0.0.

At the time it was common to deploy on bare hosts. Deploying ES into a network namespace isn't even the most common use case today.

Re: Personal and social information of 1.2B people discovered in data leak

#219

Post by dmos62 »

jerrac wrote: post #165
jillesvangurp wrote: post #155

I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. https://www.golem.de/news/elasticsearch-datenleak-bei-conrad... , in German). This beats any of that. Out of the box it does not even bind to a public internet address. Somebody configured this to…

I've been using ES off and on since before 1.0 came out. It has always baffled me that ES doesn't require a username and password by default. ES is a database that has to exist on a network to be usable. Heck, it expects that you have multiple nodes, and will complain if you don't. So one of the first things you do is expose it to the network so you can use it. Yes, it takes some serious incompetence to not realize y…

Password auth over HTTP is horrible. Short of binding a public IP address to your instance, basic auth without HTTPS setup is probably the worst thing you can do.

Re: Personal and social information of 1.2B people discovered in data leak

#220

Post by StillBored »

I think the solution here is laws which require anonymity, and that includes in banking (where it will never happen).

That is because a couple days ago, I got a text message from tmobile (which seemed genuine) basically saying that my account was one of a larger subset of prepaid phone accounts which had been compromised and that my personal information had been potentially taken by "hackers".

To which I got a good chuckle, because tmobile is one of the few phone companies that will let you create completely anonymous prepaid accounts using cash and without filling out any information. AKA you buy a sim card for $$$ and that is it. So, basically the only information they lost of mine as far as I can tell, is the phone number and type of phone I'm using (which they gather from their network). If they got the "meta" data about usage/location/etc that would have been different but it didn't sound like the hacker got that far.

Had this been a post-paid account they would have my name/address/SSN/etc.

Post reply on HN