Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Billion-record stolen Chinese database for sale on breach forum

theregister.com

Post reply on HN
Print view View original

221–230 of 258 posts

Re: Billion-record stolen Chinese database for sale on breach forum

#221

Post by nirui »

duxup wrote: post #218
nirui wrote: post #216

> While the Shanghai government and police department have largely been silent over the leak, Someone/some team in the police department is probably in serious panic right now. Not only because the data is leaked, but also because the leak has displayed an example of what they are actually recording. For example, according to the posts that other people has posted online (probably rumor and speculations), the `addres…

> That's a lot of data that are not directly related to census, social safety, or law enforcement. Is that a … concept in China? That the police should only have data “ directly related to census, social safety, or law enforcement”? I wonder how strange or surprising to locals this might be or maybe not be?

I don't think Chinese people actually cares, most people don't even know what "Data" actually is, let alone how "Data" effects them.

The altitude of most people here (I'm a Chinese BTW) is "I did nothing wrong, so why should I care?".

But, it's one thing to hear the humor, it's another thing when you can actually see it. People will have different opinions about privacy when their wives asks them why their business trip to another city showed up as a hotel night 500 meters away from home on the government database.

Re: Billion-record stolen Chinese database for sale on breach forum

#222

Post by snovv_crash »

brianpan wrote: post #211
throwaway787544 wrote: post #21

Earlier quoted context omitted.

Starting today, this will be known as "Shanghai'd credentials" and be reason #1 why we use ephemeral credentials (e.g. AWS STS/SSO) rather than static credentials (e.g. IAM Users)

Speaking as an Asian American, no, let's not do that.

Shanghai'd is already a phrase that means something else, anyways.

Re: Billion-record stolen Chinese database for sale on breach forum

#223

Post by dx034 »

flatiron wrote: post #122
hintymad wrote: post #70

The leaked screenshot of the data's metadata looks like the output of Elasticsearch's /_cat command. Someone probably left the port 9200 open to the public, or stored the index on a public cloud but somehow leaked its keys either on github-like service or in some discussion forum -- a typical mistake that engineers make.

https://www.alibabacloud.com/product/datahub is what they were using, and yeah their keys were in a commented out psvm tester method. pretty awful

Another reason why not everyone should use the cloud. Sure, the cloud can be as secure as on-prem or even safer in many cases. But it's just so easy to keep on-prem data safe by just not connecting it to the outside world. If no server can be accessed from anywhere but the premise, leaks like these just can't happen. A key won't help you unless you can break into the police building.

Access just based on credentials seems so wrong anyway. There should always be whitelisted IPs for sensitive stuff like that.

Re: Billion-record stolen Chinese database for sale on breach forum

#224

Post by challenger-derp »

nirui wrote: post #221
duxup wrote: post #218

Earlier quoted context omitted.

> That's a lot of data that are not directly related to census, social safety, or law enforcement. Is that a … concept in China? That the police should only have data “ directly related to census, social safety, or law enforcement”? I wonder how strange or surprising to locals this might be or maybe not be?

I don't think Chinese people actually cares, most people don't even know what "Data" actually is, let alone how "Data" effects them. The altitude of most people here (I'm a Chinese BTW) is "I did nothing wrong, so why should I care?". But, it's one thing to hear the humor, it's another thing when you can actually see it. People will have different opinions about privacy when their wives asks them why their business t…

>People will have different opinions about privacy when their wives asks them why their business trip to another city showed up as a hotel night 500 meters away from home on the government database.

Had a good chuckle. But then it got me thinking about other situations in which government-leak-induced friction that might lead to cause for legal action. The government demands and collates data presumably supported by legal under-pinnings that citizens must comply with. When these are leaked, shouldn't the government bear legal, fiduciary, etc. responsibility?

With great data, comes great responsibility, no?

Re: Billion-record stolen Chinese database for sale on breach forum

#225

Post by dx034 »

pessimizer wrote: post #77
throwaway4good wrote: post #44

Who would buy this? How could anyone possibly make money off this data set? I could understand if the Chinese government would pay for it to avoid embarrassment but making the sale public kinda voids that.

The US government might buy it to help them find good candidates to recruit as spies and saboteurs, or to note if current spies and saboteurs are under suspicion or have been discovered.

They'd probably just buy it to have it. That much data about foreign citizens can be valuable in many ways, from immigration to foreign intelligence.

Re: Billion-record stolen Chinese database for sale on breach forum

#227

Post by challenger-derp »

freewizard wrote: post #156

- 10 BTC sounds a lot but it's peanuts for such large data sets. - 750k row of sample data is large enough for a leak by itself, many on reddit/twitter/fediverse have already started to explore the data set for gender ratio, age composition and frequency of raping cases, etc.

>10 BTC

>many on reddit/twitter/fediverse have already started to explore the data set for gender ratio, age composition and frequency of raping cases, etc.

Is a portion of it public?

Isn't BTC more traceable than Privacy coins like monero?

Re: Billion-record stolen Chinese database for sale on breach forum

#228

Post by bobthepanda »

throw8383833jj wrote: post #183
vbezhenar wrote: post #171

Earlier quoted context omitted.

After my data was leaked, now scammers periodically call my phone to let me know that "I'm from bank security and someone's recently tried to change phone number for your bank account" or "I'm from police and we're opening a criminal case against you". It was fun first few times, but now I'm considering changing my phone number because I could miss an actual bank security call. And I'm sure that plenty of gullible pe…

Don't verify anything. Just call the bank back using a phone number you can verify with 100% certainty.

Banks themselves go out of their way to say that they will never, ever proactively call you for something like that. At least in the US.

Re: Billion-record stolen Chinese database for sale on breach forum

#229

Post by Akronymus »

thedailymail wrote: post #196
silentsea90 wrote: post #179

Earlier quoted context omitted.

What's the point of "winning" if everything is made up and the points don't matter? I get there's satisfaction in posting content that was useful, and HN isn't Fb/Twitter/Reddit and awash in ad $, but I feel fake internet points kinda manipulative since there's $ for the platform in your work.

One benefit of "winning" is that HN gives more agency (i.e., the ability to downvote) to accounts that have over a certain karmic threshold.

I "won" with a post. Don't think ive ever really exercised many of the features.

Re: Billion-record stolen Chinese database for sale on breach forum

#230

Post by maccard »

zricethezav wrote: post #185
asdff wrote: post #181

Earlier quoted context omitted.

It doesn't help that so many tools are like "give me your secret key in plain text in the config file" without at least offering a link to a webpage on the github of how you could secure your keys and use this software

hardcoded creds in example documentation... T_T Use vault, env vars, GitHub/GitLab secrets, anything but string literals!!!

Vault is not just a drop in and go system - setting up a vault instance is an ordeal in and of itself, and the pricing for vault on hashicorp cloud is incredibly expensive. The problem with the other options is that you have to get the secrets into environment variables, or out of github/lab secrets and into your application. To use most of the services like AWS secrets manager, vault, etc, it will cost you more to manage secrets than it will to host the app on a small DO droplet for example.
Post reply on HN