LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census • Hacker News Board

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#151

Post by pbhjpbhj » Tue, Jun 21, 2011, 9:31 PM UTC

jules wrote: post #85

Peroni wrote: post #64

Earlier quoted context omitted.

Childrens names & DoB, previous addresses, employment status, national insurance number. That info alone is enough for someone experienced to do damage.

Isn't that info relatively easy to obtain from most people anyway? Not on such a large scale of course.

You can obtain that sort of info, by dumpster diving say, but not in anything like the scale.

Imagine that you can get this info and a pretty good idea of salary and lifestyle by running a db search in a few seconds. You can easily focus your attention on the most lucrative propositions and get info from even those that are careful to not put such info out there. Census completion is a legal requirement, everyone should be on one.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#152

Post by kl4m » Tue, Jun 21, 2011, 9:42 PM UTC

trotsky wrote: post #145

qF wrote: post #125

Earlier quoted context omitted.

During the 'hunt' for Wikileaks the U.S. has subpoenaed Twitter for info about supposed supporters.[1] In the case of Lulzsec this will have very little use though, as they use VPN's to hide their IP [2]. [1] http://www.wired.com/threatlevel/2011/01/twitter/ [2] http://lulzsecexposed.blogspot.com/2011/06/scared-puppies.ht...

they use VPN's to hide their IP The FBI routinely uses software exploits to install something called CIPAV on the remote client computer to retrieve forensics data and negate the effect of proxies, vpns, tor, etc. http://www.wired.com/threatlevel/2007/07/fbi-spyware-how/ Twitter almost assuredly has the ability to push a custom iframe or similar based on who is logged on to support these kinds of government payloads.…

It's pretty much useless if the tunnel is on another machine and/or it's firewalled properly.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#153

Post by nawa » Tue, Jun 21, 2011, 9:55 PM UTC

mef wrote: post #149

joejohnson wrote: post #122

Earlier quoted context omitted.

When you post a tweet, how much information does twitter have about you? An IP adress, what platform you use, etc. I'm just curious, because Lulzsec posts frequently and I wonder if law enforcement could subpoena twitter in attempts to catch these people.

It's no secret that the @lulzsec account is controlled by former Anonymous spokesperson Topiary ( http://twitter.com/atopiary ), whose identity is not publicly known, though it has been anonymously claimed that he or she is Daniel Ackerman Sandberg.

atopiary: "Dear press: I have Russian launch codes, motherfuckers. Come at me bro. I will blow your asses out of the sky you fuckers." lol

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#154

Post by wisty » Tue, Jun 21, 2011, 10:03 PM UTC

drstrangevibes wrote: post #16

wisty wrote: post #7

Earlier quoted context omitted.

Still, census data should not be accessible from a public facing web site. That's just amateur hour. You should really assume that anything with a POST form is vulnerable.

well its got to go in somehow, perhaps a facade that exposes only preparedstatements procs could have prevented this, but equally perhaps they exploited the facade, the transport mechanism to the facade, the db driver..... who knows, what is known is that theres a path, however narrow

No, they should have processed the data on a secure network, then burnt CDs with the final results.

That's how Australia treats important (Top Secret classified) data. I don't know how classified our census is, it should be treated with a bit of respect.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#155

Post by Feinux » Wed, Jun 22, 2011, 2:35 AM UTC

Peroni wrote: post #123

BasDirks wrote: post #116

LulzSec The Lulz Boat Oh well, just because we want to waste government and local authority investigation time: we hacked every website in the world. Enjoy! 11 minutes ago LulzSec The Lulz Boat I'm not seeing "we hacked the UK census" on our twitter feed or website... why does the media believe we hacked the UK census? #confusion 13 minutes ago LulzSec The Lulz Boat Not sure we claimed to hack the UK census or where…

LulzSec The Lulz Boat Just saw the pastebin of the UK census hack. That wasn't us - don't believe fake LulzSec releases unless we put out a tweet first.

hi Lulzer, nice to here your voices, :)

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#156

Post by StavrosK » Wed, Jun 22, 2011, 1:59 PM UTC

MiguelHudnandez wrote: post #137

StavrosK wrote: post #111

Earlier quoted context omitted.

Why can't anyone bother to sign their press releases, it's not like it's the 60s.

Plausible deniability? (assuming you meant to cryptographically sign the press releases.)

Hmm, good point.