Billion-record stolen Chinese database for sale on breach forum

Post by asdff » Tue, Jul 05, 2022, 11:06 PM UTC

nonrandomstring wrote: post #134

mvdwoord wrote: post #3

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

> What do we do now? I was thinking - if I had this, what could I do with the personal records of a billion Chinese people? And I must conclude - absolutely nothing. It's of no interest to me. Now, I probably lack sufficient criminal imagination, but the point is stuff like this is hard to fence because there's a very small market of buyers. In an article I wrote for Routledge about the markets for stolen digital dat…

Post by zricethezav » Tue, Jul 05, 2022, 11:21 PM UTC

alias_neo wrote: post #176

zricethezav wrote: post #110

Earlier quoted context omitted.

Assuming this unverified version of the story is true, the danger of accidentally leaking credentials in code is enormous and one of the reasons I continue to maintain and develop gitleaks. Those credentials[1] would have been caught by the gitleaks' generic rule [2] [1] https://regex101.com/r/CLg9TK/1 [2] https://github.com/zricethezav/gitleaks/blob/master/config/g...

How were the words selected for the regex? It's interesting that "pass" is not there and breaks detection in your first link, but I assume they were chosen based on the statistics? Is it covered by a different rule perhaps?

Post by arjvik » Tue, Jul 05, 2022, 11:25 PM UTC

rad_gruchalski wrote: post #173

jffry wrote: post #112

Earlier quoted context omitted.

For my dev machine's interactions with AWS, I use https://github.com/99designs/aws-vault You add the long lived IAM user API key/secret to it and it stores it in a password protected storage (MacOS keychain or similar). Then you invoke aws-vault with an IAM role and command, and it will handle obtaining short-lived credentials scoped to that role (including TOTP 2-factor code auth), and then run the command with thos…

I like your approach. So far I used profiles extensively. AWS_PROFILE is your friend. No idea why AWS doesn't heavily promote this everywhere they can.

Post by anitil » Tue, Jul 05, 2022, 11:46 PM UTC

zricethezav wrote: post #110

tpaksoy wrote: post #16

Apparently there was a "blogpost" of a developer showing of their code, where they accidentally leaked access tokens in a piece of commented code: https://archive.ph/mP3bh This is completely unverified though, so take it with a grain of salt.

Assuming this unverified version of the story is true, the danger of accidentally leaking credentials in code is enormous and one of the reasons I continue to maintain and develop gitleaks. Those credentials[1] would have been caught by the gitleaks' generic rule [2] [1] https://regex101.com/r/CLg9TK/1 [2] https://github.com/zricethezav/gitleaks/blob/master/config/g...

Post by tintor » Tue, Jul 05, 2022, 11:54 PM UTC

carapace wrote: post #67

mvdwoord wrote: post #3

What do we do now? It seems the majority of people on the planet now have had some of their data leaked. Or are becoming ever more entangled with government and corporate systems which control and peddle their information as they see fit. Is it ultimately a big nothing burger, or is this some singularity we are passing through?

> What do we do now? Well, if you look at (global) society as a dynamical system it seems to me that there are two stable basins or attractors, call them "Star Trek" and "North Korea". In the "Star Trek" future the people in charge are themselves also subject to the panopticon, and the world is ruled fairly and humanely. (The other name I use for this is the "Tyranny of Mrs. Grundy".) In the "North Korea" future ther…