The unattributable “db8151dd” data breach • Hacker News Board

Re: The unattributable “db8151dd” data breach

#141

Post by tialaramex » Sat, May 16, 2020, 4:03 AM UTC

heavenlyblue wrote: post #136

tialaramex wrote: post #118

Earlier quoted context omitted.

Millions per day. This used to be part of one of my old jobs. A feed of stolen PII would drop into our SFTP server every morning and we'd process it. There's no honour among thieves so there were a bunch of duplicates pretending to be "new" data, but yes there is a cottage industry of stealing smaller quantities of PII, focused particularly on email addresses and passwords (because those get re-used elsewhere) and cr…

One of the cool things of having a password manager is that a password manager can’t auto-complete the form for websites not sharing the domain with the old one. If you don’t know the password yourself, then phishing is less effective as it’s quite rare that your password manager forgets that it needs to fill out the form for you.

> ... then phishing is less effective as it’s quite rare

In practice users who're successfully being phished curse the password manager and override it. Not always but often enough.

WebAuthn bakes the site-specificity into the protocol thus preventing you from shooting yourself in the foot, even if you're convinced that's what you need to do.

Re: The unattributable “db8151dd” data breach

#142

Post by amatecha » Sat, May 16, 2020, 5:49 AM UTC

throwaway9993 wrote: post #50

Dataset for sale: [redacted] Similar data structure: https://stackblitz.com/edit/angular-soswe4?file=src%2Fapp%2F... Owner works for: https://covve.com Covve: This simple yet state-of-the-art app will revolutionise your business relations like you've never seen. Edit: Response: https://twitter.com/covve/status/1261287954967941120

haha, I found exactly the same! https://twitter.com/amatecha/status/1261231178423517184

A user who replied to me also shared some anecdotes that indicate further evidence towards that being the source (a private email address only used for GSuite admin purposes, on her iOS device, upon which she had Covve installed) -- thread here https://twitter.com/angelalgibson/status/1261314415829237761

Re: The unattributable “db8151dd” data breach

#143

Post by amatecha » Sat, May 16, 2020, 6:06 AM UTC

tru3_power wrote: post #115

I did some quick searching for the dataformat included in the snippets from the article. Lots of repos with stored secrets that match: https://github.com/acalvoa/SRID_CHANGER/blob/da367e68433b3fd... Stored secret: https://github.com/acalvoa/SRID_CHANGER/blob/master/config.p... Will look more into this later

Ehhh, to me those seem like pretty common fields for any kind of contact data. It doesn't have some of the more unusual or IMO implementation-specific fields like "ShowableNonVisibleToOthers" or "PopulatedCleanNumber", for example.

Re: The unattributable “db8151dd” data breach

#144

Post by stedaniels » Sat, May 16, 2020, 6:23 AM UTC

dmix wrote: post #112

Nextgrid wrote: post #79

Earlier quoted context omitted.

The metadata in the breached records like "Imported from EverContacts" or similar supports the theory that it comes from a contacts app.

Curious why it has people's Github and Pintrest accounts when it's contact data. Looks like it was mined from somewhere and combined with other data... Unless people are putting their github urls in the contact apps?

A lot of CRMs are enriched with social media accounts and their web of connections.

Re: The unattributable “db8151dd” data breach

#145

Post by ta17711771 » Sat, May 16, 2020, 7:28 AM UTC

tialaramex wrote: post #116

blaser-waffle wrote: post #97

Earlier quoted context omitted.

Noobs and relatively skill makes me think H O N E Y P O T

No, more likely it's like street corner drug dealing, or say, the industrial area near me that has street walkers (well I presume it doesn't now because neither street walkers nor their johns want to die of COVID-19) This stuff happens, at a low level, and prosecuting it is expensive and makes little real difference so why bother? It's not even like busting shop lifters and petty burglars where at least you make the…

People are still going to Starbucks, mate, you think quite high of intelligence of those picking up streetwalkers.

Re: The unattributable “db8151dd” data breach

#146

Post by ta17711771 » Sat, May 16, 2020, 7:37 AM UTC

noxford1 wrote: post #48

smichel17 wrote: post #41

Earlier quoted context omitted.

Thanks for saving me a click. No desire to play "guess how many minutes I'll have to spend clicking sidewalks" today.

If it takes you minutes to solve a recaptcha your problem might not be the recaptcha...

No, the problem is Google trying to outsource creating their Waymo test data onto us.

Re: The unattributable “db8151dd” data breach

#147

Post by iamacyborg » Sat, May 16, 2020, 9:56 AM UTC

stedaniels wrote: post #144

dmix wrote: post #112

Earlier quoted context omitted.

Curious why it has people's Github and Pintrest accounts when it's contact data. Looks like it was mined from somewhere and combined with other data... Unless people are putting their github urls in the contact apps?

A lot of CRMs are enriched with social media accounts and their web of connections.

Stuff like Clearbit can "enrich" a profile with social accounts like Facebook, Twitter, LinkedIn and Github.

https://clearbit.com/attributes

That entire market needs to be killed off with hefty fines.

Re: The unattributable “db8151dd” data breach

#148

Post by multidim » Sat, May 16, 2020, 2:57 PM UTC

VectorLock wrote: post #122

Nextgrid wrote: post #2

For the people that use unique per-merchant e-mail addresses (like someone+amazon@...), could you try some of those aliases on HaveIBeenPwned and see which ones come up in this breach? That might shed some light onto its origin.

So many things disallow + in email addresses I don't even bother any more.

All services so far seem to accept dots, but the number of possible dot arrangements can be quite limited, and it is a pain to actually use (figure out next one to use, figure out associated service from dot arrangement, etc).

Re: The unattributable “db8151dd” data breach

#149

Post by multidim » Sat, May 16, 2020, 3:07 PM UTC

wincent wrote: post #38

I don't really get the utility of HIBP. The answer to the "have I been pawned?" question is, of course, yes, multiple times. I think about the only way to keep your email out of the hands of the bad guys is to not use it or give it to anyone ever, at which point you don't need an email address. What am I supposed to do whenever I'm involved in a new breach? Burn all my accounts and start again?

>What am I supposed to do whenever I'm involved in a new breach? Burn all my accounts and start again?

If you reuse passwords, then change your passwords for all the accounts that use the breached password. Hopefully, it'll spur you to start using a password manager so you can easily have strong, unique passwords.

If you don't reuse passwords, then change your password for the breached account. Sometimes services don't tell you about breaches and it is HIBP that first informs you about the breach.

If there is some email address that you really, really don't want bad guys to know about (perhaps a dedicated email address for your important financial accounts), then it helps you know when to switch to another email address.

HIBP helps you know how often a service has been breached in the past, and that might help guide what services you want to use/not-use in the future.

Re: The unattributable “db8151dd” data breach

#150

Post by killswitched » Sat, May 16, 2020, 3:22 PM UTC

Some emails that turned up on my end: Dr. Dobbs and New Relic, although the leaks occurred from parties to whom these sites had provided my data, including at least unique email addresses.