Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Billion-record stolen Chinese database for sale on breach forum

theregister.com

Post reply on HN
Print view View original

101–110 of 258 posts

Re: Billion-record stolen Chinese database for sale on breach forum

#101

Post by nonethewiser »

keewee7 wrote: post #24

The Shanghai police has a unique role in China and abroad. For example the Shanghai police is tasked with spreading pro-CCP propaganda globally on platforms like twitter and Facebook. There was an HN post about this a few months ago: https://news.ycombinator.com/item?id=29654137 Someone posted a comment explaining a little more about Shanghai's special relationship with the CCP/PLA: >Shanghai is a city with a unique…

People didn't think Shanghai was open so that the world could come IN to China, did they? It's about the opposite direction.

Re: Billion-record stolen Chinese database for sale on breach forum

#103

Post by bilekas »

TecoAndJix wrote: post #96
bilekas wrote: post #34

Earlier quoted context omitted.

It's incredibly disappointing actually how often this happens. I can't count the amount of SO questions I've had to edit from others posting live API Keys for everything from custom services to AWS.

I wonder if you could make a luhn-like check that would require an additional approval step to post if it comes back positive. Something like "It looks like you may be posting a secret *****. Do you wish to continue?

I was thinking about that too, but it's actually tricky, even the example given, they use the var `accessId` but you could filter for all that, even the standard ones, but you couldn't have enough confidence in it so that if someone did post with a typo or even a random var name, they would think "Okay, no warning so must be okay".

Something like giving false confidence to the user. Not the best idea.

Re: Billion-record stolen Chinese database for sale on breach forum

#104

Post by teddyh »

capableweb wrote: post #71
swimfar wrote: post #51

Earlier quoted context omitted.

When you do this is there a way to completely get rid of the information? Usually you can go back an look at the edit history to see the original post.

Wouldn't matter. Tons of bots are scraping every inch of the internet all the time, and if something been online for five seconds, it has been cached/stored somewhere. Always assume that anything you've put up on the internet, can forever be accessed by someone . The only thing you can do is rotating the token/secret.

http://www.threepanelsoul.com/comic/on-that-guy

Re: Billion-record stolen Chinese database for sale on breach forum

#105

Post by dontbenebby »

WilTimSon wrote: post #33
keewee7 wrote: post #24

The Shanghai police has a unique role in China and abroad. For example the Shanghai police is tasked with spreading pro-CCP propaganda globally on platforms like twitter and Facebook. There was an HN post about this a few months ago: https://news.ycombinator.com/item?id=29654137 Someone posted a comment explaining a little more about Shanghai's special relationship with the CCP/PLA: >Shanghai is a city with a unique…

So I'm guessing that database would have quite a few activists listed in it and other anti-government people. Might even give someone a much-needed warning if they find themselves there.

No post body was provided.

Re: Billion-record stolen Chinese database for sale on breach forum

#106

Post by dontbenebby »

Haemm0r wrote: post #12
luke-stanley wrote: post #8

In 2018 I saw a local branch office were using Windows XP and an old Internet Explorer. You cannot expect that to be secure. This does not surprise me at all.

XP is very common on airports in China too.

it's in US ones too, it's an industry wide issue in the aviation sector, don't hack the airport, people will come for you and if you are lucky they will be carrying badges

Re: Billion-record stolen Chinese database for sale on breach forum

#107

Post by ge96 »

gfd wrote: post #17
mvdwoord wrote: post #3

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

The previous big case I remember was linkedin leak with 700M users: https://news.ycombinator.com/item?id=27674393 At this point I've basically accepted that all my info will be found on sites like fastpeoplesearch.com and that anything I tell any company (or I guess in this case, govt too) will eventually be leaked, correlated, and used against me.

Wow that's bigger than Equifax

Re: Billion-record stolen Chinese database for sale on breach forum

#108

Post by thrdbndndn »

tpaksoy wrote: post #16

Apparently there was a "blogpost" of a developer showing of their code, where they accidentally leaked access tokens in a piece of commented code: https://archive.ph/mP3bh This is completely unverified though, so take it with a grain of salt.

The consensus in Chinese community is while this is likely how the token got leaked, this alone isn't enough. To visit private Alibaba Cloud instance you can't just use some random IP. It's isolated from the Internet in certain way.

Re: Billion-record stolen Chinese database for sale on breach forum

#109

Post by black_puppydog »

twicetwice wrote: post #100
r721 wrote: post #55

Karen Hao (WSJ): "I downloaded the sample the hacker provided and called dozens of people listed. Nine picked up & confirmed exactly what the data said." https://twitter.com/_KarenHao/status/1543949945614393344 (thread)

nitter link, since Twitter put up what seems to be a timed login gate when I was halfway through reading the thread: https://nitter.net/_KarenHao/status/1543949945614393344

Nitter is the only sane way to read twitter nowadays. Even if I still had an account it would be better for reading.

Re: Billion-record stolen Chinese database for sale on breach forum

#110

Post by zricethezav »

tpaksoy wrote: post #16

Apparently there was a "blogpost" of a developer showing of their code, where they accidentally leaked access tokens in a piece of commented code: https://archive.ph/mP3bh This is completely unverified though, so take it with a grain of salt.

Assuming this unverified version of the story is true, the danger of accidentally leaking credentials in code is enormous and one of the reasons I continue to maintain and develop gitleaks. Those credentials[1] would have been caught by the gitleaks' generic rule [2]

[1] https://regex101.com/r/CLg9TK/1

[2] https://github.com/zricethezav/gitleaks/blob/master/config/g...

Post reply on HN