Сhecking for leaked data without storing any
medispank.com
Сhecking for leaked data without storing any
1–10 of 24 posts
Re: Сhecking for leaked data without storing any
#2Reversing the phone number hashes is trivial - there are maybe 8 to 10 digits in a phone number and something like hashcat will probably try them all in less than a second on a single current GPU. And it is probably not that much harder to reverse most of the email addresses - a suitable dictionary paired with some rules how people choose their email addresses and you are good to go.
Re: Сhecking for leaked data without storing any
#3Reversing the phone number hashes is trivial - there are maybe 8 to 10 digits in a phone number and something like hashcat will probably try them all in less than a second on a single current GPU. And it is probably not that much harder to reverse most of the email addresses - a suitable dictionary paired with some rules how people choose their email addresses and you are good to go.
While that's true, the phone numbers without the name and other information cannot be weaponized.
The phone numbers can be generated - there are only 8 changing digits in Australian mobile phone numbers (the first 2 digits are always 04).
Re: Сhecking for leaked data without storing any
#4Reversing the phone number hashes is trivial - there are maybe 8 to 10 digits in a phone number and something like hashcat will probably try them all in less than a second on a single current GPU. And it is probably not that much harder to reverse most of the email addresses - a suitable dictionary paired with some rules how people choose their email addresses and you are good to go.
Just checked: hashing all possible 100,000,000 mobile numbers on a single CPU takes 14 seconds. I am sure a rainbow table with such data already exists.
Re: Сhecking for leaked data without storing any
#5Reversing the phone number hashes is trivial - there are maybe 8 to 10 digits in a phone number and something like hashcat will probably try them all in less than a second on a single current GPU. And it is probably not that much harder to reverse most of the email addresses - a suitable dictionary paired with some rules how people choose their email addresses and you are good to go.
not sure if there is an effective solution to this. (phone number specific)
Re: Сhecking for leaked data without storing any
#6Reversing the phone number hashes is trivial - there are maybe 8 to 10 digits in a phone number and something like hashcat will probably try them all in less than a second on a single current GPU. And it is probably not that much harder to reverse most of the email addresses - a suitable dictionary paired with some rules how people choose their email addresses and you are good to go.
While that's true, the phone numbers without the name and other information cannot be weaponized. The phone numbers can be generated - there are only 8 changing digits in Australian mobile phone numbers (the first 2 digits are always 04).
> the phone numbers without the name and other information cannot be weaponized.
On the contrary - they can and routinely are.
Speculative case:
The space of valid phone numbers is small, the total number of subscribers is peanuts for automation, and bulk calling is cheap. As a result, it's affordable in some cases to just literally call every single number (prefiltered through one of the marketer databases of numbers belonging to real people) and try the scam - people who aren't in your target group will only get confused for a second, and write it off as usual robocall, while those in your target group will either fall for it, or otherwise identify themselves by recognizing the context.
Or at least that's what I believe is happening, based on calls I occasionally get, trying to "give" or sell me some crap from a product/service category I never cared about, available in a city on the other side of the country.
BTW. This is what's constantly happening in the e-mail space. I get tons of messages that attempt to phish people by hoping a percentage of recipients will happen to be customers of a specific company, or awaiting a package from a specific delivery company on a specific day. I personally had a close call with a phish about OneDrive data deletion that hit my company inbox on the very next day after the company migrated my data across corporate systems - by pure chance, the message looked almost perfectly legitimate, for me, on that day.
Common case:
The usual plausible deniability defense of legal scammers (telemarketers) is, "this number was randomly generated by our system", which is both technically plausible and obviously bullshit. However, being on a receiving end, I have neither time nor means to prove they got it from a database.
Re: Сhecking for leaked data without storing any
#7Reversing the phone number hashes is trivial - there are maybe 8 to 10 digits in a phone number and something like hashcat will probably try them all in less than a second on a single current GPU. And it is probably not that much harder to reverse most of the email addresses - a suitable dictionary paired with some rules how people choose their email addresses and you are good to go.
not sure if there is an effective solution to this. (phone number specific)
We had to meet a similar requirement and used hardware anchoring.
Instead of a hash, think of a keyed HMAC style operation where the HMAC secret is inside an HSM. HSM operations are handled by a separate team than webapp. Key is not extractable.
It is not vulnerable to brute-force in the same way as a hash because the function cannot be executed outside your computing environment. Of course an attacker can still try to brute-force, but only using the app or from inside your environment.
So you have to apply appropriate rate limiting controls and monitoring on your "boat anchor" HSM for it all to work out.
For this application I would probably look for "proof of ownership" of the number or email before allowing a query.
Re: Сhecking for leaked data without storing any
#8Reversing the phone number hashes is trivial - there are maybe 8 to 10 digits in a phone number and something like hashcat will probably try them all in less than a second on a single current GPU. And it is probably not that much harder to reverse most of the email addresses - a suitable dictionary paired with some rules how people choose their email addresses and you are good to go.
While that's true, the phone numbers without the name and other information cannot be weaponized. The phone numbers can be generated - there are only 8 changing digits in Australian mobile phone numbers (the first 2 digits are always 04).
Then why not publish all the phone numbers in clear.
Re: Сhecking for leaked data without storing any
#9No post body was provided.
Re: Сhecking for leaked data without storing any
#10The way Medibank has handled this breach has been atrocious. Drip feeding information, minimising, misleading etc.
My data is in this breach and all I've gotten thus far is the bullshit comms corporate speak emails from their CEO. No personalised notification that my details are out there on the internet, nothing. There ought to be personal criminal penalties placed on company leadership for this kind of ongoing and, and this point, wilful negligence. Otherwise they will never have sufficient incentive to guard against this kind of risk.