Weleakinfo.com Domain Name Seized: Site Had Sold Access to Hacked PII and Logins

#1

Post by djee » Fri, Jan 17, 2020, 3:30 PM UTC

Weleakinfo.com Domain Name Seized: Site Had Sold Access to Hacked PII and Logins
justice.gov

Re: Weleakinfo.com Domain Name Seized: Site Had Sold Access to Hacked PII and Logins

#2

Post by [deleted] » Fri, Jan 17, 2020, 5:39 PM UTC

[deleted]

Re: Weleakinfo.com Domain Name Seized: Site Had Sold Access to Hacked PII and Logins

#3

Post by SQueeeeeL » Fri, Jan 17, 2020, 5:55 PM UTC

I wonder if this is ever a positive thing. Like if a company sold 0.01% of the leaked credentials to prove the hack was real/scare the general public. And then shredded the other 99.99% of credentials.

I feel like the nuance would almost always be lost though

Re: Weleakinfo.com Domain Name Seized: Site Had Sold Access to Hacked PII and Logins

#4

Post by SketchySeaBeast » Fri, Jan 17, 2020, 6:21 PM UTC

SQueeeeeL wrote: post #3

I wonder if this is ever a positive thing. Like if a company sold 0.01% of the leaked credentials to prove the hack was real/scare the general public. And then shredded the other 99.99% of credentials. I feel like the nuance would almost always be lost though

Considering the Equifax breach, which consisted of leaking all the information on everyone, and didn't seem to phase the public hardly at all, I don't think that would be an effective tactic.

Re: Weleakinfo.com Domain Name Seized: Site Had Sold Access to Hacked PII and Logins

#5

Post by typescriptfan1 » Fri, Jan 17, 2020, 7:07 PM UTC

I love the cool images they seem to always put together when they do this.

Re: Weleakinfo.com Domain Name Seized: Site Had Sold Access to Hacked PII and Logins

#6

Post by rckoepke » Fri, Jan 17, 2020, 7:56 PM UTC

At what point do security dumps become 'public' and legal to disseminate?

Is there a framework for determining what is legal to provide to Brian Krebs or Haveibeenpwned.com?

Would it have been illegal of Brian Krebs to pay money to weleakinfo.com for a database that also existed elsewhere?

Basically is it illegal to buy, sell, give away for free to masses, give away for free to vetted individuals/researchers, or illegal to hold privately once you received it?

Would love if anyone could point me towards the path of enlightenment here. US/EU, and other laws all seem relevant.

Re: Weleakinfo.com Domain Name Seized: Site Had Sold Access to Hacked PII and Logins

#7

Post by juliend2 » Fri, Jan 17, 2020, 8:18 PM UTC

typescriptfan1 wrote: post #5

I love the cool images they seem to always put together when they do this.

You mean this? https://www.justice.gov/sites/default/files/styles/width_12/...

Yeah, that's pretty Matrix-like.

Re: Weleakinfo.com Domain Name Seized: Site Had Sold Access to Hacked PII and Logins

#8

Post by soulofmischief » Fri, Jan 17, 2020, 8:20 PM UTC

typescriptfan1 wrote: post #5

I love the cool images they seem to always put together when they do this.

yeah, whoever does those still has hacker aesthetics from the 90's.

Re: Weleakinfo.com Domain Name Seized: Site Had Sold Access to Hacked PII and Logins

#9

Post by dang » Fri, Jan 17, 2020, 8:35 PM UTC

Recent and related: https://news.ycombinator.com/item?id=22065780

Re: Weleakinfo.com Domain Name Seized: Site Had Sold Access to Hacked PII and Logins

#10

Post by vorpalhex » Fri, Jan 17, 2020, 8:42 PM UTC

rckoepke wrote: post #6

At what point do security dumps become 'public' and legal to disseminate? Is there a framework for determining what is legal to provide to Brian Krebs or Haveibeenpwned.com? Would it have been illegal of Brian Krebs to pay money to weleakinfo.com for a database that also existed elsewhere? Basically is it illegal to buy, sell, give away for free to masses, give away for free to vetted individuals/researchers, or ille…

I asked a lawyer friend this question once before starting on a personal project. The answer I got in return took about 30 minutes and was filled with a lot of "ifs" and "buts" and references to at-that-time undecided cases.