Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

thenextweb.com

Post reply on HN
Print view View original

11–20 of 156 posts

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#11

Post by 46Bit »

ZeroMinx wrote: post #5
ElliotH wrote: post #2

Given LulzSec seems to post their hacks on twitter, that there's no way of validating who posted the PasteBin item and that the Office of National Statistics hasn't reported the loss, its probably best to wait and see something a little more convincing.

I haven't seen "Census" mentioned in their twitter feed (yet), so as far as I know the only source is a bit of anonymous text on pastebin. Anyone could put that there.

They are mentioning something they've got though, in similar language to the pastebin. I think it unlikely they'd have managed to acquire the full census, but I think it's probably quite possible they've got ones submitted online.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#15

Post by crocowhile »

justincormack wrote: post #3

This was the first census where you could submit details online. I wonder if it was these records? Would be surprised if they had even finished scanning the paper ones yet, but the UK governments security record is not good. They contracted it to Lockheed Martin, who also do the US census, so presumably reused the software?

LM was penetrated few days before census day. Maybe the left some back doors? http://www.ibtimes.com/articles/154078/20110529/lockheed-mar...

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#16

Post by drstrangevibes »

wisty wrote: post #7
mike-cardwell wrote: post #6

Earlier quoted context omitted.

From what I understand, their main tool is simple SQL injection. Most websites seem to have at least one XSS or SQL injection hole. Nearly all have CSRF flaws.

Still, census data should not be accessible from a public facing web site. That's just amateur hour. You should really assume that anything with a POST form is vulnerable.

well its got to go in somehow, perhaps a facade that exposes only preparedstatements procs could have prevented this, but equally perhaps they exploited the facade, the transport mechanism to the facade, the db driver..... who knows, what is known is that theres a path, however narrow

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#17

Post by mikle »

ElliotH wrote: post #2

Given LulzSec seems to post their hacks on twitter, that there's no way of validating who posted the PasteBin item and that the Office of National Statistics hasn't reported the loss, its probably best to wait and see something a little more convincing.

It also has the Bethesda and US senate links in the end, making this look more like copy-paste of an older release. This is inconclusive though since the real LulzSec might copy paste from an older release to get all the ascii art.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#18

Post by patrickod »

So what's the worst possible outcome here in terms of the UK government's reactions? Fast-tracked arcane legislation to make security tools illegal like they are in .de ? Broadening the terms of hacking and increasing the legal penalties? If LulzSec aren't trolling the world and they do indeed have these records I would imagine there is going to be one hell of a shitstorm in the coming weeks.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#19

Post by beseku »

crocowhile wrote: post #12

I don't like where this is going.

Whats worrying about the apparent proliferation of security breaches like this is that as the attacks get more sophisticated, so do the prevention methods. This could get to the point whereby the skill level required to protect an application or server goes way higher than the skill level of many developers.

The result being that independent development is impossible as you would need to hire ever more expensive security consultants for anything that stores data.

Post reply on HN