Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

thenextweb.com

Post reply on HN
Print view View original

31–40 of 156 posts

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#31

Post by ErrantX »

m4tt wrote: post #10
ElliotH wrote: post #2

Given LulzSec seems to post their hacks on twitter, that there's no way of validating who posted the PasteBin item and that the Office of National Statistics hasn't reported the loss, its probably best to wait and see something a little more convincing.

I wrote the article and have been trying to trace the authenticity of the release. I am still waiting to hear back from the Office of National Statistics, which at the time were unaware of who LulzSec even were. I contacted them a little over two hours ago, I haven't received a response, yet.

Knowing a little of the internals of ONS...

It may take them a while to figure out what a "computer" is and how it might be "hacked". You could be waiting some time :)

ahem.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#32

Post by paradoja »

retube wrote: post #14

They're going to piss a lot of people off if they do this. Like every single UK citizen. Exposing security flaws and embarrassing govt is one thing, but to put un-redacted personal data online is quite another.

If you read the article or the pastebin:

We’re keeping them under lock and key though… so don’t worry about your privacy (…until we finish re-formatting them for release)

So, given they really arer LulzSec, they are hinting that they won't publish the data un-redacted.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#33

Post by Joakal »

beseku wrote: post #19
crocowhile wrote: post #12

I don't like where this is going.

Whats worrying about the apparent proliferation of security breaches like this is that as the attacks get more sophisticated, so do the prevention methods. This could get to the point whereby the skill level required to protect an application or server goes way higher than the skill level of many developers. The result being that independent development is impossible as you would need to hire ever more expensive secu…

But aren't they using pretty old exploits, SQL injections and DDoS?

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#34

Post by mike-cardwell »

retube wrote: post #14

They're going to piss a lot of people off if they do this. Like every single UK citizen. Exposing security flaws and embarrassing govt is one thing, but to put un-redacted personal data online is quite another.

I filled in the UK census online, but I can't actually remember what compulsory data was requested. Is there a copy of it somewhere?

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#35

Post by noobiscus »

beseku wrote: post #19
crocowhile wrote: post #12

I don't like where this is going.

Whats worrying about the apparent proliferation of security breaches like this is that as the attacks get more sophisticated, so do the prevention methods. This could get to the point whereby the skill level required to protect an application or server goes way higher than the skill level of many developers. The result being that independent development is impossible as you would need to hire ever more expensive secu…

"This could get to the point whereby the skill level required to protect an application or server goes way higher than the skill level of many developers."

We reached that point quite a while ago. What we are seeing now is the result of that point being reached, without anyone realising at the time.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#36

Post by crocowhile »

mike-cardwell wrote: post #23
wisty wrote: post #7

Earlier quoted context omitted.

Still, census data should not be accessible from a public facing web site. That's just amateur hour. You should really assume that anything with a POST form is vulnerable.

Agreed. Any submitted data should have been immediately encrypted with a public key who's companion private key was stored offline. It should have then been immediately transferred to a secondary box which was setup with a single function of accepting and storing the data. Ie a box which you can't query over the network for data. As soon as the census closed, the relevant boxes should have been taken offline. The dat…

For those who are interested, these are the questions: http://www.ons.gov.uk/census/2011-census/2011-census-questio...

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#37

Post by crocowhile »

beseku wrote: post #19
crocowhile wrote: post #12

I don't like where this is going.

Whats worrying about the apparent proliferation of security breaches like this is that as the attacks get more sophisticated, so do the prevention methods. This could get to the point whereby the skill level required to protect an application or server goes way higher than the skill level of many developers. The result being that independent development is impossible as you would need to hire ever more expensive secu…

I was thinking more in terms of reactions. Governments rarely admit their own faults and weaknesses. They will react claiming computer terrorists must be stopped now and that more control on the Internet is needed to protect everybody.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#38

Post by eftpotrm »

estel wrote: post #20
antihero wrote: post #8

If this is true then I am suing Lockheed Martin under the Data Protection Act.

There's jurisdiction for that?

If their servers have been compromised to leak the data, should be. They ran the survey and UK and European data protection law makes data leaks the responsibility of the data holder.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#39

Post by beck5 »

estel wrote: post #20
antihero wrote: post #8

If this is true then I am suing Lockheed Martin under the Data Protection Act.

There's jurisdiction for that?

Yes, they will probably be the information controller under the DPA and have to be extreamlly careful that our data is safe. Even keeping a copy in a non EU country is very hard.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#40

Post by redthrowaway »

paradoja wrote: post #32
retube wrote: post #14

They're going to piss a lot of people off if they do this. Like every single UK citizen. Exposing security flaws and embarrassing govt is one thing, but to put un-redacted personal data online is quite another.

If you read the article or the pastebin: We’re keeping them under lock and key though… so don’t worry about your privacy (…until we finish re-formatting them for release) So, given they really arer LulzSec, they are hinting that they won't publish the data un-redacted.

Or they're just literally formatting it for organization and readability. They've released damaging info before on innocent users.
Post reply on HN