Live data from Hacker News

LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

thenextweb.com

101–110 of 156 posts

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#101
post #89

Earlier quoted context omitted.

I don't think so, this is the government that wants to pass the Freedom Bill: http://freedom.libdems.org.uk/

Hilariously, that url returns "403 forbidden." Google doesn't seem to return anything on that domain. Here's the text of the freedom bill: http://www.libdems.org.uk/siteFiles/resources/PDF/The_Freedo... Seems pretty nice. I dread to think what they'll have to trade the tories for it though.

Don't forget that Teresa May's first act when the Tories won the election was to scrap national ID cards and order the database destroyed.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#102

So what's the worst possible outcome here in terms of the UK government's reactions? Fast-tracked arcane legislation to make security tools illegal like they are in .de ? Broadening the terms of hacking and increasing the legal penalties? If LulzSec aren't trolling the world and they do indeed have these records I would imagine there is going to be one hell of a shitstorm in the coming weeks.

How about holding the companies who were supposed to secure the data fully accountable?

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#103
post #2

Given LulzSec seems to post their hacks on twitter, that there's no way of validating who posted the PasteBin item and that the Office of National Statistics hasn't reported the loss, its probably best to wait and see something a little more convincing.

I've wondered how many individuals and groups out there post things in the name of other security groups to distract attention from (or direct it toward) themselves. Maybe everyone should start signing their releases with a private key.

Goodbye plausible deniability...

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#104
Such a shame.

Anonymous had a lot of support for their attacks on Mastercard et. al. People, not just the programmers demographic, were seeing them as civil disobedience through the internet and hailing them for taking a right cause, namely against dirty, probably unconstitutional, certainly unethical attacks on wikileaks by numerous powerful groups.

What's more, anonymous was seen as more powerful than such groups on the internet arena. It was felt that such powerful groups would thus think twice and know that they are against probably smarter people, perhaps even their own employees. Alas, like actual physical protests, they did not manage to change much. Wikileaks has almost been forgotten now. Julian has gone quite. The organisation itself seems to have become divided and disorganised. They possibly are buying time. But the power that be has shown us that they have the resources, are willing to play, publicly, dirty tricks, and can even withstand a public opinion quite strongly against them.

Julian has been given some outstanding honour in journalism. He might even win the Peace prize for what some say was the effect of wikileaks on bringing about the Arab Spring. That may show that there are many powerful avenues to resist and/or push back the power that be.

All of that is being undermined for no apparent reason whatever. Although Lulzec might be trying to send a signal to the power that be. We are stronger. We are smarter. You need to know that before thinking again about doing dirty tricks. They don't seem to be able or willing to choose their targets well to send such a message. Showing that you can for example steal the census data in order to increase the security of organisations which deal with our data is like a man showing that he can steal a car by so breaking into the car and stealing it.

We can all commit crimes. We choose not to for very good reasons. Some things can not be fortified and turned into castles. And even castles can be brought down.

So the ultimate effect is that anonymous is painted with the same brush. As petty criminals bringing havoc into the streets of the neighbourhood by breaking car windows to show us that they can so break car windows.

For now, anonymous still has the upper moral ground. That is for now. By for now I mean for the next few days or weeks. The report for example that a member of lulzsec has been arrested who has connections with anonymous helps tremendously in blurring the lines between anonymous and lulsec.

The blurring means nothing more nor less than the excuse and the swaying of the public opinion that the power that be needs to go after anonymous and send a clear signal. You may be smarter but we have more resources and more avenues and the consequences you face are much greater.

The biggest signal that the power that be may send however is that they are able to control the public opinion by playing tricks. I think we all remember how last year we were talking about how the power that be is going to deal with wikileaks. The conversations that were had here on hackernews are probably still accessible through searching. Killing him seemed to be the most mentioned option, but quickly refuted by others. Now, it may be a strong statement to make seeing as I have no evidence whatever, but the information that did come out in regards to the two women, the fact that Assange is still here in Britain almost a year after, that he is actually free, suggests that tainting him with rape accusations was their choice. As we are seeing, it seems to have worked.

Equally, I do not know who lulzecs is. They have no motive, no reason, to do what they are doing. They are intelligent. Thus I doubt they would risk years in prison to just show that they can break a car. People do not tend to do things for no reason, especially if there are great consequences.

There is no laughter to be had of say having access to a lot of information of sonny users. Nor is there any lulz in having say the information of the census.

I therefore think that there is a probability that Matercard, Visa, Bank of America et al got quite pissed off from anonymous' attacks, but unable to do anything because of the strong public support that anonymous had, thought creatively and went for the blurring of the lines between common thief's and civil disobedience.

That is one possibility. Probably the more likely possibility. Sophos for example seems to be salivating every time lulzsecs does something.

The other option, that they are kids, being stupid, like most teenagers at time, confused, rebellious, is a possibility but unlikely. They probably know full well, that gaining such a high profile while not having any public support or even having the public against them means that they will crash down painfully to the bottom and remain there for years and years.

I'll finally finish this quite long comment by stating that if lulzsec is anything else than affiliated or corrupted, then they should know that they are tainting ideals with petty crimes.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#105

Such a shame. Anonymous had a lot of support for their attacks on Mastercard et. al. People, not just the programmers demographic, were seeing them as civil disobedience through the internet and hailing them for taking a right cause, namely against dirty, probably unconstitutional, certainly unethical attacks on wikileaks by numerous powerful groups. What's more, anonymous was seen as more powerful than such groups o…

Just so we're clear, you're suggesting that LulzSec is actually a front group for Sophos or maybe Mastercard?

That seems fantastically unlikely.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#106
post #63
post #57

Earlier quoted context omitted.

I believe that most databases are secure, especially the open source ones. What you should be careful about is the things surrounding the database: the .php files (or whatever) that read/write the database, and the system it is running on. Basic security practice for the web: NEVER trust user input: check and recheck all the GET/POST variables, check that numbers are numbers, that strings are correct strings (they ha…

Yes, let's secure our databases against O'Reillys and AT&Ts submitting their funny names! It's not characters that get you, it's lack of escaping or escaping for the wrong context (e.g. magic_quotes won't work for HTML) • For SQL use prepared statements exclusively (never let "oh, it's just a number so I don't need to" fool you) • Escaping doesn't differ between "trusted" and "untrusted" data (and these boundaries ar…

> For SQL use prepared statements exclusively (never let "oh, it's just a number so I don't need to" fool you)

I cannot vote this up enough. Also, depending on what database you are using (eg Oracle) if you don't use prepared statements (aka bind variables) you are guarantee killing your DB performance.

People have argued with me in the past that for things like sorting the data they cannot use bind variables. In that case, use the user input to select which safe string to use, eg:

    if user_select_sort == 'by_account_num'
      return 'order by account_num asc'
    elsif user_select_sort == 'by_transaction_date'
      return 'order by transaction_date'
    else 
      return ''
    end if
Then if someone sends in something tricky, it will just order wrong.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#108
post #94
post #52

Earlier quoted context omitted.

Supposedly, census data should be anonymous. This means the records should be anonymized as soon as possible and should not just be stored.

It can't be totally anonymous, otherwise there's no way of enforcing the legal requirement to complete it. Each census form had a unique ID, which is obviously linked to your address as it was sent to you through the post.

The answers can be hashed in many ways to ensure anonymity.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#109

Such a shame. Anonymous had a lot of support for their attacks on Mastercard et. al. People, not just the programmers demographic, were seeing them as civil disobedience through the internet and hailing them for taking a right cause, namely against dirty, probably unconstitutional, certainly unethical attacks on wikileaks by numerous powerful groups. What's more, anonymous was seen as more powerful than such groups o…

Give me a break. There are no ideals, and it's not a conspiracy. It's just a bunch of trolls on summer vacation. They are doing it because they don't really care to consider consequences when they choose to do something. Mystery solved by Occam's Razor.

If you didn't know that lots of people like to do mean, pointless things all day for no reason, then welcome to 4chan, you may or may not enjoy your stay.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#110

Earlier quoted context omitted.

I'm in the UK and for some crazy reason filled out my census correctly, so yeah, I think there's grounds for DPI lawsuit action.

Well, the crazy reason is the threatened fine of up to £1000.

I didn't fill mine in, whoops
Post reply on HN