Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Database containing personal info of 106M visitors to Thailand exposed online

comparitech.com

Post reply on HN
Print view View original

11–20 of 50 posts

Re: Database containing personal info of 106M visitors to Thailand exposed online

#11

Post by deanclatworthy »

weird-eye-issue wrote: post #10
TekMol wrote: post #8

What dangers are associated with this type of data becoming public? I can imagine burglars using this info to decide which houses and apartments to rob. Anything else that comes to mind? Any first / second hand experiences of what can happen if private data like this becomes public?

How is somebody going to get your address from this info? Did you actually look at what was leaked?

It's strange that it doesn't contain addresses. There's a bunch of other information you have to fill in including address on your arrival forms - so if it's the case that "this is it", we got off lightly. I have travelled there three times in the last ten years.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#13

Post by vmception »

cm2187 wrote: post #7
zachberger wrote: post #5

Earlier quoted context omitted.

Name -> passport # isn't concerning?

What can you do with a passport number?

Identity fraud

open bank accounts and launder money and lead a mile long paper trail to the wrong person

Re: Database containing personal info of 106M visitors to Thailand exposed online

#14

Post by tpmx »

deanclatworthy wrote: post #11
weird-eye-issue wrote: post #10

Earlier quoted context omitted.

How is somebody going to get your address from this info? Did you actually look at what was leaked?

It's strange that it doesn't contain addresses. There's a bunch of other information you have to fill in including address on your arrival forms - so if it's the case that "this is it", we got off lightly. I have travelled there three times in the last ten years.

Also lucky the biometric data from passports wasn't included - portrait photos and fingerprint data. (https://www.hindawi.com/journals/bmri/2012/490362/)

Re: Database containing personal info of 106M visitors to Thailand exposed online

#15

Post by deadalus »

cm2187 wrote: post #7
zachberger wrote: post #5

Earlier quoted context omitted.

Name -> passport # isn't concerning?

What can you do with a passport number?

Some crypto websites accept Passport as a means to verify you before you can withdraw funds.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#16

Post by diegoveralli »

TekMol wrote: post #8

What dangers are associated with this type of data becoming public? I can imagine burglars using this info to decide which houses and apartments to rob. Anything else that comes to mind? Any first / second hand experiences of what can happen if private data like this becomes public?

This is useful to attackers in social engineering scenarios for sure.

Additionally, some KBA authentication schemes might still be in place which make leaks like this one particularly problematic. Eg. one of my banks still asks relatively easy to answer questions to authenticate me when I call to unlock my card.

The most infamous KBA incident was the large scale IRS's tax returns fraud that occurred in 2014-2015:

- https://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-befor...

- https://krebsonsecurity.com/2015/08/irs-330k-taxpayers-hit-b...

- https://krebsonsecurity.com/2016/02/irs-390k-more-victims-of...

The type of data leaked by the Thai government doesn't look too bad, but one should not underestimate the creativity of attackers, especially when the amount of data is large (and might overlap with other, previous breaches that contain different attributes.)

Re: Database containing personal info of 106M visitors to Thailand exposed online

#17

Post by marcus_holmes »

vmception wrote: post #13
cm2187 wrote: post #7

Earlier quoted context omitted.

What can you do with a passport number?

Identity fraud open bank accounts and launder money and lead a mile long paper trail to the wrong person

Are you sure you just need the number for that and not a copy of the actual document?

Like gp says, I've handed my actual passport to every hotel I've stayed at, and they usually make a photocopy. If anyone is assuming that a photocopy of a passport is good evidence that someone is who they say they are, they're wrong. If someone is assuming that just the number proves anything, then they're more wrong.

The times I've needed my passport online to prove my identity, it was usually one of those ID processes where I need to be in front of a camera holding my actual passport.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#18

Post by vmception »

marcus_holmes wrote: post #17
vmception wrote: post #13

Earlier quoted context omitted.

Identity fraud open bank accounts and launder money and lead a mile long paper trail to the wrong person

Are you sure you just need the number for that and not a copy of the actual document? Like gp says, I've handed my actual passport to every hotel I've stayed at, and they usually make a photocopy. If anyone is assuming that a photocopy of a passport is good evidence that someone is who they say they are, they're wrong. If someone is assuming that just the number proves anything, then they're more wrong. The times I'v…

Forge the document with the correct number. Click upload.

You have way too much respect for the security and redundancies of the system.

Only need one account anywhere to be approved. Then you can just do a completely clearnet illicit source transfer to a crypto exchange and disappear the money into tornado.cash or Monero or whatever. The problem stays with the person whose name is on the account.

Alternatively, on Dread, people brag about maintaining funded brokerage accounts opened under other people’s names and accessed over compromised windows machines near where the physical person lives. They trading stocks and options with dollars, with the intent to deal with actual laundering later with a larger amount. There are market places for compromised windows machines by postal code and bandwidth.

Re: Database containing personal info of 106M visitors to Thailand exposed online

#19

Post by ourmandave »

marcus_holmes wrote: post #17
vmception wrote: post #13

Earlier quoted context omitted.

Identity fraud open bank accounts and launder money and lead a mile long paper trail to the wrong person

Are you sure you just need the number for that and not a copy of the actual document? Like gp says, I've handed my actual passport to every hotel I've stayed at, and they usually make a photocopy. If anyone is assuming that a photocopy of a passport is good evidence that someone is who they say they are, they're wrong. If someone is assuming that just the number proves anything, then they're more wrong. The times I'v…

In the Ocean's Fourteen script writer's room: "Wait, what?"
Post reply on HN