LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census
1–10 of 156 posts
Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census
#2Given LulzSec seems to post their hacks on twitter, that there's no way of validating who posted the PasteBin item and that the Office of National Statistics hasn't reported the loss, its probably best to wait and see something a little more convincing.
Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census
#3This was the first census where you could submit details online. I wonder if it was these records? Would be surprised if they had even finished scanning the paper ones yet, but the UK governments security record is not good. They contracted it to Lockheed Martin, who also do the US census, so presumably reused the software?
Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census
#4I wonder if they are using the same (undocumented) exploit for each of these attacks.
I am certainly no expert in this field, but I would have thought discovering new exploits and security holes would take time, yet these guys are hitting several major sites a week.
Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census
#5Given LulzSec seems to post their hacks on twitter, that there's no way of validating who posted the PasteBin item and that the Office of National Statistics hasn't reported the loss, its probably best to wait and see something a little more convincing.
I haven't seen "Census" mentioned in their twitter feed (yet), so as far as I know the only source is a bit of anonymous text on pastebin. Anyone could put that there.
Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census
#6I wonder if they are using the same (undocumented) exploit for each of these attacks. I am certainly no expert in this field, but I would have thought discovering new exploits and security holes would take time, yet these guys are hitting several major sites a week.
From what I understand, their main tool is simple SQL injection.
Most websites seem to have at least one XSS or SQL injection hole. Nearly all have CSRF flaws.
Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census
#7I wonder if they are using the same (undocumented) exploit for each of these attacks. I am certainly no expert in this field, but I would have thought discovering new exploits and security holes would take time, yet these guys are hitting several major sites a week.
From what I understand, their main tool is simple SQL injection. Most websites seem to have at least one XSS or SQL injection hole. Nearly all have CSRF flaws.
Still, census data should not be accessible from a public facing web site. That's just amateur hour. You should really assume that anything with a POST form is vulnerable.
Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census
#8If this is true then I am suing Lockheed Martin under the Data Protection Act.
Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census
#9If true, this will be a massive coup and regardless of how they obtained the records, LulzSec will get all of the significant negative attention they so badly crave.
I submitted my census info via the online form and given the amount of detail I included I would be terrified if that info was leaked.
Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census
#10Given LulzSec seems to post their hacks on twitter, that there's no way of validating who posted the PasteBin item and that the Office of National Statistics hasn't reported the loss, its probably best to wait and see something a little more convincing.
I wrote the article and have been trying to trace the authenticity of the release. I am still waiting to hear back from the Office of National Statistics, which at the time were unaware of who LulzSec even were.
I contacted them a little over two hours ago, I haven't received a response, yet.