Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

thenextweb.com

Post reply on HN
Print view View original

21–30 of 156 posts

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#21

Post by shubble »

Peroni wrote: post #9

If true, this will be a massive coup and regardless of how they obtained the records, LulzSec will get all of the significant negative attention they so badly crave. I submitted my census info via the online form and given the amount of detail I included I would be terrified if that info was leaked.

Imagining that the release is true, this will do strange things for pay bargaining. Imagine if you could look up your colleagues before asking for a rise? On the other hand, I don't recall anything really horrific on that form. Enough data to steal my identity and take out a mortgage in my name, yes. Enough to embarrass me? no...

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#22

Post by crocowhile »

mikle wrote: post #17
ElliotH wrote: post #2

Given LulzSec seems to post their hacks on twitter, that there's no way of validating who posted the PasteBin item and that the Office of National Statistics hasn't reported the loss, its probably best to wait and see something a little more convincing.

It also has the Bethesda and US senate links in the end, making this look more like copy-paste of an older release. This is inconclusive though since the real LulzSec might copy paste from an older release to get all the ascii art.

Yes, also the phone number is wrong. That number doesn't work anymore.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#23

Post by mike-cardwell »

wisty wrote: post #7
mike-cardwell wrote: post #6

Earlier quoted context omitted.

From what I understand, their main tool is simple SQL injection. Most websites seem to have at least one XSS or SQL injection hole. Nearly all have CSRF flaws.

Still, census data should not be accessible from a public facing web site. That's just amateur hour. You should really assume that anything with a POST form is vulnerable.

Agreed. Any submitted data should have been immediately encrypted with a public key who's companion private key was stored offline. It should have then been immediately transferred to a secondary box which was setup with a single function of accepting and storing the data. Ie a box which you can't query over the network for data.

As soon as the census closed, the relevant boxes should have been taken offline. The data moved to a "secure" location, and the original boxes wiped and destroyed.

Considering the data that was being collected, I don't think this is overkill.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#24

Post by estel »

pedrokost wrote: post #13

With the amount of hacking that is flooding the news recently, I would like to learn about database security. What are some good books/tutorials/videos on how to make databases more secure?

The Web Application Hacker's Handbook is most widely cited in a more general sense. I'm reading it myself at the moment - http://www.amazon.com/Web-Application-Hackers-Handbook-Disco...

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#25

Post by drtse4 »

"Biggest" only for the media coverage this could get, i would not be surprised if they had exploited a common vulnerability. At least when we are discussing about publicly accessible sites, "security-illiterate" is the perfect definition for these government agencies (and the external companies that realize the sites they need).

Will this kind of things make the general public at least a bit more security conscious?

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#26

Post by Joakal »

pedrokost wrote: post #13

With the amount of hacking that is flooding the news recently, I would like to learn about database security. What are some good books/tutorials/videos on how to make databases more secure?

SQL injections seem to be the prominent exploit by them.

Not in any order of popularity:

1. Brute-force (or not) cracking of weak or default usernames/passwords

2. Privilege escalation

3. Exploiting unused and unnecessary database services and functionality

4. Targeting unpatched database vulnerabilities

5. SQL injection

6. Stolen backup (unencrypted) tapes

http://mobile.darkreading.com/9289/show/8506121498da7d8ae483...

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#27

Post by crocowhile »

patrickod wrote: post #18

So what's the worst possible outcome here in terms of the UK government's reactions? Fast-tracked arcane legislation to make security tools illegal like they are in .de ? Broadening the terms of hacking and increasing the legal penalties? If LulzSec aren't trolling the world and they do indeed have these records I would imagine there is going to be one hell of a shitstorm in the coming weeks.

It would be just another excuse to get the Internet ID implemented. MAFIAA has been pushing for Internet ID since years now and a number of politicians are in favour. Must admit that every time I read about the latest Lulsec activity I cannot help but think that MAFIAA is behind all this.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#28

Post by drstrangevibes »

retube wrote: post #14

They're going to piss a lot of people off if they do this. Like every single UK citizen. Exposing security flaws and embarrassing govt is one thing, but to put un-redacted personal data online is quite another.

er... I dont think they care, its for the Lulz.... apparently :-\

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#29

Post by Peroni »

shubble wrote: post #21
Peroni wrote: post #9

If true, this will be a massive coup and regardless of how they obtained the records, LulzSec will get all of the significant negative attention they so badly crave. I submitted my census info via the online form and given the amount of detail I included I would be terrified if that info was leaked.

Imagining that the release is true, this will do strange things for pay bargaining. Imagine if you could look up your colleagues before asking for a rise? On the other hand, I don't recall anything really horrific on that form. Enough data to steal my identity and take out a mortgage in my name, yes. Enough to embarrass me? no...

There may not be anything in there to embarass me but there is unequivocally enough in there for someone to steal my identity and ruin a credit rating I've been working extremely hard to build over the last three years.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#30

Post by gaius »

beseku wrote: post #19
crocowhile wrote: post #12

I don't like where this is going.

Whats worrying about the apparent proliferation of security breaches like this is that as the attacks get more sophisticated, so do the prevention methods. This could get to the point whereby the skill level required to protect an application or server goes way higher than the skill level of many developers. The result being that independent development is impossible as you would need to hire ever more expensive secu…

In my experience the expense of a security consultant is rarely correlated with their skill level.
Post reply on HN