Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker wipes Romania's land registry database

news.risky.biz

Post reply on HN
Print view View original

231–240 of 440 posts

Re: Hacker wipes Romania's land registry database

#231

Post by RandomLensman »

AndroTux wrote: post #209
RandomLensman wrote: post #49

Earlier quoted context omitted.

You need a machine (hardware and software) to read digital copies, not just the digital copies.

And you need to know how to read to read paper copies. Same thing, essentially. Anyone speaking hieroglyphics fluently? Point is, if you take care of your archive and make sure it remains accessible, it doesn't really matter whether it's digital or analog.

Not at all the same thing - what equipment do you need to read hieroglyphs on top of understanding the language (which goes for digital, too)? If you have the paper and understand the language, that's it. We already can see that accessing old digital data isn't necessarily easy if it wasn't always kept on/converted to current media and formats (will we keep that up for millenia)?

And both storage can be broken, needing reconstruction.

If I were to give you a 70y old book in English vs some 70y tape with data on - which one is easier to read?

Re: Hacker wipes Romania's land registry database

#232

Post by tredre3 »

RandomLensman wrote: post #56
wongarsu wrote: post #52

Earlier quoted context omitted.

There have been plenty of instances of paper-based land registries being wiped out. It's just usually a very local problem because paper lends itself more to decentralized storage

Yes, so quite limited in scope. We have no experience with storing and keeping accessible electronic records for hundreds of years, though, but we know already that accessing old storage media and formats isn't necessarily easy.

So far accessing old storage media from 50+ years ago hasn't really been a problem. Reading old tapes and punch cards/tapes or even early hard drives is something that a single motivated hobbyist can achieve in a few weeks or months with a microcontroller and patience.

But it's more difficult to imagine that 1000 years from now someone will be able to read from a PCI-E NVME drive if the specs get lost along the way (ignoring for a moment that flash storage most likely won't retain data that long).

Re: Hacker wipes Romania's land registry database

#233

Post by kazinator »

skinfaxi wrote: post #5

> Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania. So it seems not all has been lost. I was worried about the societal implications of being unable…

I'm skeptical that they not missing at least a week's or so worth of land title registry transactions, if the only thing they have left is offline, because offline backups are not made after every single transaction.

If the hacker was targeting the erasure of a particular recent transaction, they may well have succeeded. And by deleting numerous others, they have plausible deniability in the subsequent dispute over the property. If you just wipe a record that is related to you, and the manipulation is discovered (which it will be, one way or another), you are part of a narrow circle of suspects.

Re: Hacker wipes Romania's land registry database

#234

Post by giancarlostoro »

alexpotato wrote: post #230
franciscop wrote: post #139

Earlier quoted context omitted.

This happened in a 50k people town where my father is from in 1982 with a BIG flood that destroyed the town land registry documents (among a lot of the town). Since he's a lawyer, had first hand experience and I was always curious I asked many things about this a while back. Basically, what happened is that they rebuilt it from proof of ownership and testimonies of the people. You can never get to 100% recovery like…

> Basically, what happened is that they rebuilt it from proof of ownership and testimonies of the people In a similar vein, I was once curious how you would prove your identity if ALL of your relevant documents (passport, driver's license, birth certificate etc) were lost in some kind of cataclysm e.g. a house fire pre-digital etc Turns out there is actually a mechanism for this: - get multiple people to sign sworn a…

Fun fact, if you're unlucky enough to replace your Social Security card 10 times, they will no longer issue them to you anymore. It is a lifetime limit, and they fan it out to 3 per year.

Oddly enough, if you legally change your name, they will send you a new one regardless of the limit.

Re: Hacker wipes Romania's land registry database

#235

Post by red-iron-pine »

alt227 wrote: post #80
b3lvedere wrote: post #67

Earlier quoted context omitted.

Rotting, sweaty human hands and fire to name a few.

Pretty sure fire is a risk to servers as well.

only in that location.

mirror that DB onto a server on the other side of the country, or continent, etc.

Re: Hacker wipes Romania's land registry database

#236

Post by RandomLensman »

tredre3 wrote: post #232
RandomLensman wrote: post #56

Earlier quoted context omitted.

Yes, so quite limited in scope. We have no experience with storing and keeping accessible electronic records for hundreds of years, though, but we know already that accessing old storage media and formats isn't necessarily easy.

So far accessing old storage media from 50+ years ago hasn't really been a problem. Reading old tapes and punch cards/tapes or even early hard drives is something that a single motivated hobbyist can achieve in a few weeks or months with a microcontroller and patience. But it's more difficult to imagine that 1000 years from now someone will be able to read from a PCI-E NVME drive if the specs get lost along the way (…

I would not call needing weeks or months not a problem (assuming you also get the potentially proprietary software to understand the data recovered). Also, early hard drives weigh 100s of kilograms, so just physically handling them is difficult.

Totally agree on accessing NVME example.

Re: Hacker wipes Romania's land registry database

#237

Post by amiheines »

alexpotato wrote: post #230
franciscop wrote: post #139

Earlier quoted context omitted.

This happened in a 50k people town where my father is from in 1982 with a BIG flood that destroyed the town land registry documents (among a lot of the town). Since he's a lawyer, had first hand experience and I was always curious I asked many things about this a while back. Basically, what happened is that they rebuilt it from proof of ownership and testimonies of the people. You can never get to 100% recovery like…

> Basically, what happened is that they rebuilt it from proof of ownership and testimonies of the people In a similar vein, I was once curious how you would prove your identity if ALL of your relevant documents (passport, driver's license, birth certificate etc) were lost in some kind of cataclysm e.g. a house fire pre-digital etc Turns out there is actually a mechanism for this: - get multiple people to sign sworn a…

If you're married and Jewish, the wife's mother keeps the marriage document, so even if there is a house fire and all documents are lost, your mother in law usually lives in another house, so you can pick it up from there.

Re: Hacker wipes Romania's land registry database

#238

Post by petre »

dmos62 wrote: post #65
alexpotato wrote: post #37

Romanian friends have told me that this is really due to corruption. Specifically: - government gives IT/data contracts to cronies - cronies don't actually do any real security work to protect the data - things like this happen

Same thing is rampant in other Eastern European countries as well. Tips on how to address this for those of us that are publicly minded?

Use EU funds to build it then tip the EPPO when they defraud the funds?

Re: Hacker wipes Romania's land registry database

#239

Post by charcircuit »

daneel_w wrote: post #199
charcircuit wrote: post #197

Why is deleting the whole database a valid operation? The system should make that impossible.

Why is deleting a row in a table a valid operation? Why is deleting a table in a schema a valid operation? Most likely they had full privileged access to the database.

>had full privileged access to the database

Why does full access include the ability to delete read only data that should never ever be deleted for the rest of time?

It's like building a self destruct button that ignites the physical records. It's an unnecessary risk to make such a dangerous thing.

Re: Hacker wipes Romania's land registry database

#240

Post by rcostin2k2 »

LelouBil wrote: post #79
arisAlexis wrote: post #21

We will see a lot of those with open source Mythos equivalent models.

I mean: > Sources told Risky Business that the hacker entered using valid credentials This is social engineering or corruption.

... and an incorrect password policy and poor access control. Usually, in these institutions, if STS is not responsible, there are third-party companies, usually proxies, that are responsible for managing the firewall and accessing the data. The lack of procedures and lack of supervision from the authority, combined with the delay from the service providers, leads to a situation where everyone does backups as they think is best. That's why it takes so long now, because STS restores data from different formats, from different places, made at different times
Post reply on HN