Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker wipes Romania's land registry database

news.risky.biz

Post reply on HN
Print view View original

351–360 of 440 posts

Re: Hacker wipes Romania's land registry database

#351

Post by ragall »

markdown wrote: post #301
skinfaxi wrote: post #5

> Since the hack, officials restored their website and posted a message announcing they are rebuilding the agency's entire network from scratch. Even if the hacker claims they deleted backups, the agency appears to have had an offline copy, otherwise things would have gotten really messy over the coming months in Romania. So it seems not all has been lost. I was worried about the societal implications of being unable…

A land title is written on paper or cardboard, with signatures and stamps on it. The digital copy is just that; a digital copy. The hacker would have to destroy the database and all backups, and also burn down the building holding the registry.

That's not how things work in most countries in Europe: the land registry is the authoritative source, and there are no bearer titles any more.

Re: Hacker wipes Romania's land registry database

#352

Post by ragall »

curiousObject wrote: post #143
cbg0 wrote: post #38

An update from the land registry (the truthfulness of this remains to be seen depending on how fast this comes back online): ANCPI announced that it had begun migrating its applications to Romania’s Government Cloud. The operation is being coordinated by the Special Telecommunications Service (STS) and is expected to be completed on Wednesday, July 22. After the migration, authorized institutions will inspect the app…

> it had begun migrating its applications to Romania’s Government Cloud This proclamation, coming from a governmental organization, makes me afraid they are doomed. Effectively they are saying they are fixing the mistake by repeating it. What they should do is admit fault. Freeze the system. Get independent expert help. Best wishes, recent Romanian land buyers and sellers Edit: thank you @cbg0 for giving us this upda…

Your prejudice knows no bounds.

Re: Hacker wipes Romania's land registry database

#353

Post by kijin »

halJordan wrote: post #269
SoftTalker wrote: post #259

Earlier quoted context omitted.

Yeah it's actually not that bad, because for example the BMV will likely upon request send you a duplicate driver's license to your address of record. Same for getting replacement credit cards. If you had utility services at that address in your name that's additional documentation. Also historical tax returns, bank accounts, etc.

"why's he asking for a new dl? " "Oh volcano exploded, his home is under 5 ft of ash." "Gotcha, mail him the copy"

Brb, gotta camp on top of the ash at the same lat/long coordinates to catch the mailman.

Re: Hacker wipes Romania's land registry database

#354

Post by kijin »

ponector wrote: post #275
brookst wrote: post #261

Earlier quoted context omitted.

Phone number and email access, if you can regain access to them. It is definitely a good idea to plan in advance and set up a recovery contact: https://support.apple.com/en-us/102641

But email access is protected by MFA based on your destroyed device. Recovery codes are also stored in the same destroyed building.

You can get back your phone number once you have a photo ID and buy a new phone. Then you should hope that your service providers aren't secure enough to have disabled SMS-based account recovery.

Re: Hacker wipes Romania's land registry database

#355

Post by kijin »

londons_explore wrote: post #286
franciscop wrote: post #139

Earlier quoted context omitted.

This happened in a 50k people town where my father is from in 1982 with a BIG flood that destroyed the town land registry documents (among a lot of the town). Since he's a lawyer, had first hand experience and I was always curious I asked many things about this a while back. Basically, what happened is that they rebuilt it from proof of ownership and testimonies of the people. You can never get to 100% recovery like…

Wouldn't work in a city like NYC where nobody knows their neighbours and a chunk of houses are empty and only owned by shady shell companies as investments...

Shady shell companies do an excellent job of proving ownership -- it's the only reason they exist! So if NYC is hit by an asteroid, you'll find backups of all the important papers neatly filed away in Delaware.

Re: Hacker wipes Romania's land registry database

#356

Post by markdown »

dghlsakjg wrote: post #317
markdown wrote: post #306

Earlier quoted context omitted.

wtf

That’s a simplified explanation. Title insurance covers a number of situations, fraudulent transfer of title is only one of them and is more likely to be something like “A wife sold her dead spouse’s house, but it turns out that there was a dispute about the will and now someone else is claiming that the house actually wasn’t hers to sell”

That wouldn't be possible in my country because she would not have any right to sell the house until it was transferred to her. This transfer would happen during the probate process. The probate process is where all issues regarding the will/estate and disputes are settled. Once probate is complete, ownership is set in stone and the widow would have every right to sell her house.

Re: Hacker wipes Romania's land registry database

#357

Post by pqdbr »

alok-g wrote: post #335
osinix wrote: post #208

The backups got wiped together with the systems, so they were reachable from same network. A backup the attacker can reach is not a backup. Good they had an offline copy, but a system this important should have that as regular schedule, not depend on luck.

Any guidelines on how to back up such that the attacker cannot reach (when the hacker otherwise had some valid credentials)?

This is how we implemented this at our company:

- We have 2 sources of data that we must backup to continue existing as a business; our postgres and binary files in S3. Everything else is derivable (elasticsearch, so on).

- For postgres, we use barman. With the help of opus/fable, you can get a streaming replication backup working in no time. We have one into another server in the same datacenter (we use baremetal) and another one in another server in a different datacenter.

- We then have a last resort barman backup with bi-weekly base backups + WAL streaming to S3 (both the base backup and WALs). It sends these backups + wal segments into an specific S3 bucket that has object lock in compliance mode. This is a feature from AWS S3 that even the most privileged account credentials (super admin) can't turn off nor delete the files before the object lock, which is 10 days in our case. Object lock compliance mode can only be extended, never shortened.

- For S3, we store them into another versioned bucket, with lifecycle rules to also expire non current versions (== deleted objects) after 10 days. No point in object lock compliance here because it would only protect objects for the most recent 10 days, and you gain nothing. What we do instead: the app servers only have access to these bucket tru an IAM credential that can't delete old versions (so deleted objects have to expire manually via the lifecycle rule) AND this IAM credentials also can't change the object policy.

IMHO, this protects us enough so that even in the worst case scenario (ransomware) we have 10 days to sort everything out and recover our AWS access.

And yes, we test the S3 barman restoration and it works fine. Data loss is at max 5 minutes due to the archive_timeout=300s on the primary.

For the streaming replications in the two servers I mentioned, it's less <1ms, but those wouldn't protect us much in the case of the ransomware - even tough we use tailscale and one compromised server can't ssh into the other.

Re: Hacker wipes Romania's land registry database

#358

Post by wahern »

lebuffon wrote: post #279
gchamonlive wrote: post #251

Earlier quoted context omitted.

The reason capitalism cannot work well is that it assumes endless resources and infinite growth, not because people don't like electronic transfers. Capitalism is failing in all countries and those that are not are already transitioning to some form or another or post consumerism.

Sure at the "end game" stage you are correct. But on the way to that stage it does what it does really well, meaning it makes lots more capital. De Soto is talking about why it "cannot" get started in a place without government controlled land registry.

> without government controlled land registry.

De Soto describes the exact opposite situation. Latin America inherited Napoleonic property law, which only recognized property ownership when formally registered, which required quite alot of red tape. It was impossible to transfer ownership without registration. Moreover, any defect in prior registration meant the lawful owner might be the heirs of someone generations ago. Most property "owned" by the peasantry usually had defective and incurable title, having changed hands in informal private agreements, which meant banks wouldn't accept it to secure a loan. This meant only the aristocracy could leverage the financial system, because they were accustomed to following all the formalities. What piece of real property someone thought they owned, even if occupied for generations, was often in the eyes of the law owned by some aristocratic family or the state.

He contrasted that system with the American common law system, where title could be legally transfered entirely privately. Disputes are handled by courts which look to the timing and substance of transfers. Moreover, adverse possession meant that after a number of years (well within one person's lifespan) nobody could come along and claim title because of a defective transfer (even if in principle they had a better claim originally), securing title in whomever held it, even if it had been transferred without even following the much looser requirements under the common law. A bank would issue a loan so long as you could prove you held an unchallenged title for a sufficient number of years. ("Title" was whatever piece of paper handed you by the previous possessors; no government stamp or recordation required.)

Registration systems in the US are a recent occurrence, and they overlay the traditional common law rules.

A gross generalization, but Napoleonic civil law systems emphasize formal transactions centrally administered by the state, while the common law emphasizes looking to the substance of private transactions, and usually only when a dispute arises (otherwise you just presume they're valid). Broadly speaking, De Soto argued the latter tended to favor the common man, because it was much less rigid.

De Soto also pointed out that US Federal Land Grants also did a decent job at distributing land among the people, unlike Latin America where mostly only the aristocracy held land under a good title.

Re: Hacker wipes Romania's land registry database

#359

Post by tracerbulletx »

reaperducer wrote: post #340
irjustin wrote: post #324

Earlier quoted context omitted.

> SSNs are not a "national ID" That's not what they are, but that's what they've defacto become. I hate it.

Is that still true? Except for certain industries where the government has a direct interest (banking, healthcare, real estate), I don't think anyone has asked for my SSN in at least a decade. It's not like the old days when you'd fork over your SSN to rent videos at Blockbuster.

oh ok so just for money body and property related issues. phew.

Re: Hacker wipes Romania's land registry database

#360

Post by amiheines »

dghlsakjg wrote: post #313
amiheines wrote: post #237

Earlier quoted context omitted.

If you're married and Jewish, the wife's mother keeps the marriage document, so even if there is a house fire and all documents are lost, your mother in law usually lives in another house, so you can pick it up from there.

I’m married and Jewish. It would be pretty surprising to me if my wife’s mother had even seen our marriage paperwork let alone possessed it. This also isn’t a tradition I’ve ever heard of in my family. Or did a joke about overbearing mother in laws just go right over my head.

Ask your mother in law. At least in Israel, during the ceremony, the Rabi gives the ktuba to the bride's mother for safe keeping.
Post reply on HN