Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker wipes Romania's land registry database

news.risky.biz

Post reply on HN
Print view View original

161–170 of 440 posts

Re: Hacker wipes Romania's land registry database

#161

Post by c7b »

FeepingCreature wrote: post #102
codedokode wrote: post #81

Earlier quoted context omitted.

So that 50% attack results in someone taking all the land? No thanks. It is a poor idea to use blockchain for government registries. If you want transparency, simply publish signed daily updates and that's enough. Just use simple DB with backups, and optionally, a printer printing changes on a paper.

Yeah, the overwhelming majority of the benefit of blockchain here is just gotten by making the data public and signed. Now you may argue "that is a blockchain, not every blockchain is associated with a shitcoin" but to be frank that ship has sailed, if you wanted to defend that you'd have had to do a lot more work over the past decade.

That is what I'm saying. And you may be right, but the security guarantees are math and math is patient. If people decide to ignore it today, it'll still be true any time they decide to take another look.

Re: Hacker wipes Romania's land registry database

#162

Post by ghaff »

gchamonlive wrote: post #133
cataphract wrote: post #127

Earlier quoted context omitted.

Don't know exactly on it works in Romania, but proving you purchased a patch of land is a different question -- for that you have the deed. You then submit the deed to the land registry. So this situation could at most result in the seller being able to sell the land more than once or disputes over the priority of sales over liens and other competing acts subject to registration.

Here in Brazil lots of people deal land by word of mouth. The country is just too big and there isn't enough state present to make every transaction official, so people shake on it, draft an unofficial document and actually living and developing the land over a long period of time is what consistitutes ownership.

It doesn't take much. A neighbor and I just had to deal with a bunch of property line confusions in the US where a property subdivision 25 years ago wasn't handled correctly. None of us really cared but it would matter in the event of an eventual sale and it cost thousands of dollars in surveyor and legal fees.

ADDED: We also had a bunch of easements and cooperative maintenance agreements that were only partially documented in the deed and mostly done via a handshake. So we got that all squared away in the expensive binder from the lawyer.

Re: Hacker wipes Romania's land registry database

#163

Post by ExoticPearTree »

otabdeveloper4 wrote: post #111
alexpotato wrote: post #37

Romanian friends have told me that this is really due to corruption. Specifically: - government gives IT/data contracts to cronies - cronies don't actually do any real security work to protect the data - things like this happen

"It's corruption and cronies" is a generic cop-out answer that doesn't explain anything. Like whenever someone gets caught in a compromising situation they say they "were hacked", as if saying that means anything.

Its a bit more nuanced than that. The company responsible for ensuring the cybersecurity of the system told the press that "they secured what the client told them to secure and it was not their job to tell the client what needs to be secured".

Re: Hacker wipes Romania's land registry database

#164

Post by anvuong »

gchamonlive wrote: post #36
skinfaxi wrote: post #5

> Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania. So it seems not all has been lost. I was worried about the societal implications of being unable…

I'd bet money the offline copy is far from up-to-date, given the state of the network. It still has potential to be mayhem

It depends. In my country the online land register data is just a copy of the physical land owning certificate. The physical certificates (1 for the owner, 1 for the local government, and at least 1 more for some document keeping agency) are the source of truth.

Re: Hacker wipes Romania's land registry database

#165

Post by ExoticPearTree »

iAMkenough wrote: post #132
UltraSane wrote: post #98

Enterprise storage arrays have immutable snapshot functionality that makes ransomware easy to recover from.

What does it take to delete a snapshot?

Depends on the vendor. Some just admin access to the array, other require a two person authorization to delete it.

Re: Hacker wipes Romania's land registry database

#166

Post by notahacker »

ExoticPearTree wrote: post #150
skinfaxi wrote: post #5

> Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania. So it seems not all has been lost. I was worried about the societal implications of being unable…

> I was worried about the societal implications of being unable to prove land ownership but it seems that may be avoided. You know, it's not like people would come and steal your land overnight because you can't provide proof of ownership.

Squatters, boundary disputes and rent defaults happen all the time.

Plus having most of your net worth locked up in something no sane person would consider buying off you because you can't prove you own it is ... suboptimal

Re: Hacker wipes Romania's land registry database

#167

Post by krisoft »

nicce wrote: post #26
skinfaxi wrote: post #5

> Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania. So it seems not all has been lost. I was worried about the societal implications of being unable…

One more reason to to define the whole infrastructure in code and have offline backups. Recovering could be measured in hours.

That sounds good, but wouldn’t you worry that the same hackers will let themselves in via the same route again?

You would need to understand first how they gained access and verify that they can’t do the same again. That in itself could take days if not weeks. Then of course they might have found new vulnerabilities while they were in, so you would need to worry about that too.

Re: Hacker wipes Romania's land registry database

#168

Post by PunchTornado »

jopsen wrote: post #117
21asdffdsa12 wrote: post #50

Imagine if the hacker was more clever and started writing plausible nonsense into the database, corrupting the backups.

Selling properties you don't own, ideally land owned by government..

ideally properties of corrupt politicians

Re: Hacker wipes Romania's land registry database

#169

Post by MichaelZuo »

Ekaros wrote: post #147
drunner wrote: post #105

Earlier quoted context omitted.

It's no different anywhere. Security isn't valued since it's just an email and a .01% or less income fine. The amount of times my SSN and correlated info has been leaked and I've been offered a free year or credit monitoring is depressing.

Problem really is that things like SSN or ID numbers should have never been treated as more as just one possible semi-public unique identifier. Never anything to be used in identifying a person for a contract.

This would implicate close to 100% of American firms and most of the adult population?

If they are clearly misusing a system (SSN) never designed nor intended that way. And continue to do so even after being shown the facts.

Post reply on HN