Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Billion-record stolen Chinese database for sale on breach forum

theregister.com

Post reply on HN
Print view View original

171–180 of 258 posts

Re: Billion-record stolen Chinese database for sale on breach forum

#171

Post by vbezhenar »

nonrandomstring wrote: post #134
mvdwoord wrote: post #3

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

> What do we do now? I was thinking - if I had this, what could I do with the personal records of a billion Chinese people? And I must conclude - absolutely nothing. It's of no interest to me. Now, I probably lack sufficient criminal imagination, but the point is stuff like this is hard to fence because there's a very small market of buyers. In an article I wrote for Routledge about the markets for stolen digital dat…

After my data was leaked, now scammers periodically call my phone to let me know that "I'm from bank security and someone's recently tried to change phone number for your bank account" or "I'm from police and we're opening a criminal case against you". It was fun first few times, but now I'm considering changing my phone number because I could miss an actual bank security call.

And I'm sure that plenty of gullible people were scammed and lost their money because of those leaks. When someone calls you, knows your full name and talks with enough confidence, it causes some trust.

Re: Billion-record stolen Chinese database for sale on breach forum

#172

Post by CoffeeOnWrite »

pitched wrote: post #132
jewel wrote: post #115

Earlier quoted context omitted.

If vendors agreed to a common prefix on all secret key values then it'd be easy for everyone to add checks, to everything. Something like "_SECRET88_". Of course, then your secret key checker would need to build that string by concatenating so that it wouldn't set off itself.

How about scanning for any string with high entropy? Might be easier to get buy-in if we don’t all have to bike-shed over what the prefix is.

That’s helpful but the token prefixes are also helpful. You might be interested in GitHub’s reasoning at https://github.blog/2021-04-05-behind-githubs-new-authentica...

Re: Billion-record stolen Chinese database for sale on breach forum

#173

Post by rad_gruchalski »

jffry wrote: post #112
compumike wrote: post #40

Earlier quoted context omitted.

Doesn't the client still need to know a long-lived secret (or a long-lived refresh token) in order to generate the ephemeral credentials?

For my dev machine's interactions with AWS, I use https://github.com/99designs/aws-vault You add the long lived IAM user API key/secret to it and it stores it in a password protected storage (MacOS keychain or similar). Then you invoke aws-vault with an IAM role and command, and it will handle obtaining short-lived credentials scoped to that role (including TOTP 2-factor code auth), and then run the command with thos…

I like your approach. So far I used profiles extensively. AWS_PROFILE is your friend. No idea why AWS doesn't heavily promote this everywhere they can.

Re: Billion-record stolen Chinese database for sale on breach forum

#174

Post by nikcub »

moneywoes wrote: post #131
scandinavian wrote: post #126

Earlier quoted context omitted.

The linkedin "leak" was just a scrape of public data.

Is there any word out how they managed to avoid linkedins relentless rate limiting? For example my account gets rate limited for normal browsing

Likely hacked/purchased browser extensions

Re: Billion-record stolen Chinese database for sale on breach forum

#175

Post by imron »

guywithahat wrote: post #135
r721 wrote: post #55

Karen Hao (WSJ): "I downloaded the sample the hacker provided and called dozens of people listed. Nine picked up & confirmed exactly what the data said." https://twitter.com/_KarenHao/status/1543949945614393344 (thread)

That WSJ article is so much better than the posted one, I mean what even is "the register"

The home of snarky IT journalism since the first dotcom boom.

Re: Billion-record stolen Chinese database for sale on breach forum

#176

Post by alias_neo »

zricethezav wrote: post #110
tpaksoy wrote: post #16

Apparently there was a "blogpost" of a developer showing of their code, where they accidentally leaked access tokens in a piece of commented code: https://archive.ph/mP3bh This is completely unverified though, so take it with a grain of salt.

Assuming this unverified version of the story is true, the danger of accidentally leaking credentials in code is enormous and one of the reasons I continue to maintain and develop gitleaks. Those credentials[1] would have been caught by the gitleaks' generic rule [2] [1] https://regex101.com/r/CLg9TK/1 [2] https://github.com/zricethezav/gitleaks/blob/master/config/g...

How were the words selected for the regex? It's interesting that "pass" is not there and breaks detection in your first link, but I assume they were chosen based on the statistics?

Is it covered by a different rule perhaps?

Re: Billion-record stolen Chinese database for sale on breach forum

#177

Post by rejectfinite »

t_mann wrote: post #36
MadsRC wrote: post #18

Earlier quoted context omitted.

IIRC when Nazi Germany invaded Denmark in 1940, one of the first things the SS did was to send representatives to the local churches. In Denmark, every child was (I’m not sure if they still are actually?) registered at birth by the local parish in so called “church books”. With these “databases” in hand, the SS had a neat list of all names, and the approximate location of peoples homes. Those lists were used to ident…

Church books were used to find Jews? Do you have a source for that?

They where like the tax office before the tax office.

Same in Sweden.

Re: Billion-record stolen Chinese database for sale on breach forum

#178

Post by rejectfinite »

freewizard wrote: post #156

- 10 BTC sounds a lot but it's peanuts for such large data sets. - 750k row of sample data is large enough for a leak by itself, many on reddit/twitter/fediverse have already started to explore the data set for gender ratio, age composition and frequency of raping cases, etc.

>many on reddit/twitter/fediverse have already started to explore the data set for gender ratio, age composition and frequency of raping cases, etc.

Any links?

Re: Billion-record stolen Chinese database for sale on breach forum

#179

Post by silentsea90 »

dang wrote: post #167
freewizard wrote: post #147

Earlier quoted context omitted.

Thanks for reposting this. The last link submitted by me only got 3 upvotes. Guess it sounded just too crazy to be true 2 days ago!

There's just a lot of randomness in what gets attention/traction off /newest. That's why HN doesn't try to prevent reposts of stories that haven't had significant attention yet. It sucks when you're earlier and don't 'win', but it evens out in the long run if you post lots of good stories, since sometimes the lottery works in your favor. One of these years we'll get around to implementing karma-sharing to spread cred…

What's the point of "winning" if everything is made up and the points don't matter? I get there's satisfaction in posting content that was useful, and HN isn't Fb/Twitter/Reddit and awash in ad $, but I feel fake internet points kinda manipulative since there's $ for the platform in your work.

Re: Billion-record stolen Chinese database for sale on breach forum

#180

Post by dredmorbius »

bell-cot wrote: post #144

Kinda interesting that The Register does not even speculate about steps which China's higher-level security services might take in response, to "memorably demonstrate their displeasure" at the theft. (A certain cynical attitude is usually part of The Register 's stock-in-trade.)

Perhaps The Register is aware that it cannot out-cynic the Chinese.
Post reply on HN