Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An Electronic Voting Firm Exposes 1.8M Chicagoans

upguard.com

Post reply on HN
Print view View original

41–50 of 76 posts

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#41

Post by dark_shadow »

jsjohnst wrote: post #33
SamuelAdams wrote: post #6

Isn't this considered public data anyways? Illinois (and I believe every other US state) requires that certain voter data be publicly accessible. To access it in bulk, you'll have to pay a small fee, but anyone can get this. A misconfigured AWS instance is always an issue. I'm not trying to downplay that. Only that this data being released to the public isn't anything new - the public already had access to it. https:…

Considering this was Chris Vickery, my money is on it being an unsecured Mongo instance on AWS. He's spent the last 2+ years consistently probing for Mongo instances (mostly via Shodan) and then ransoming the owners if he can find them.

Ransoms the owners? That's a big claim. What proof do you have or are you just trolling him?

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#42

Post by pavel_lishin »

GauntletWizard wrote: post #31
vkou wrote: post #29

Earlier quoted context omitted.

> Last four of social is so abused it shouldn't count Yet it does. Almost every single business/government service in America uses DoB + last 4 SSN to identify you. The two together make fraud trivial.

Exactly. Every leak already has it. Every company already has it. The fact that fraud is trivial is already true, and this leak really adds little to it.

Can I have the last four numbers of your social security number?

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#43

Post by GauntletWizard »

pavel_lishin wrote: post #42
GauntletWizard wrote: post #31

Earlier quoted context omitted.

Exactly. Every leak already has it. Every company already has it. The fact that fraud is trivial is already true, and this leak really adds little to it.

Can I have the last four numbers of your social security number?

-

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#44

Post by Chris_Vickery »

jsjohnst wrote: post #33
SamuelAdams wrote: post #6

Isn't this considered public data anyways? Illinois (and I believe every other US state) requires that certain voter data be publicly accessible. To access it in bulk, you'll have to pay a small fee, but anyone can get this. A misconfigured AWS instance is always an issue. I'm not trying to downplay that. Only that this data being released to the public isn't anything new - the public already had access to it. https:…

Considering this was Chris Vickery, my money is on it being an unsecured Mongo instance on AWS. He's spent the last 2+ years consistently probing for Mongo instances (mostly via Shodan) and then ransoming the owners if he can find them.

This is a false and defamatory. I (Chris Vickery) have never ransomed any data. I have protected the private data of hundreds of millions. Post some evidence or retract your comment.

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#46

Post by mattnewton »

monksy wrote: post #15
colinyoung wrote: post #14

As both a Chicagoan and (obviously) an Illinois resident, this means my voter info has been exposed twice this year alone. Amazon sent out warning emails for owners of misconfigured boxes about 60 days ago. Why didn't the firm in question take action? I am an engineer and literally had to do that same task at work at that time. Easy as 2 clicks.

The ticket wasn't a high enough priority. Or the PO didn't want to prioritize it in the sprint.

My guess is they were staffed with contractors to build it out and it was no ones responsibility to maintain after they left. I've seen that happen more than once..

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#47

Post by komali2 »

monksy wrote: post #15
colinyoung wrote: post #14

As both a Chicagoan and (obviously) an Illinois resident, this means my voter info has been exposed twice this year alone. Amazon sent out warning emails for owners of misconfigured boxes about 60 days ago. Why didn't the firm in question take action? I am an engineer and literally had to do that same task at work at that time. Easy as 2 clicks.

The ticket wasn't a high enough priority. Or the PO didn't want to prioritize it in the sprint.

"It was in the backlog!"

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#48

Post by tomsthumb »

bpicolo wrote: post #38
nrb wrote: post #27

Earlier quoted context omitted.

They are a requirement if you were wanting to fraudulently open a bank account in someone else's name.

Need a whole SSN for that no?

Both the first three and the middle two have a pretty clear rhyme and reason to them which would likely make getting them right a not-so-difficult task after a bit of homework.

https://www.ssa.gov/history/ssn/geocard.html

Anecdotally, while bored in math class we figured out that 10 or so of the guys in the class had one of two numbers for their first three.

Re: An Electronic Voting Firm Exposes 1.8M Chicagoans

#49

Post by jerf »

GauntletWizard wrote: post #43
pavel_lishin wrote: post #42

Earlier quoted context omitted.

Can I have the last four numbers of your social security number?

-

OK, now would be so kind as to pretend that we've been leaked your birth year and state of birth?

Before you answer, you may want to poke your answers into this site and have a look at the outcome: https://www.ssn-check.org/lookup/

Caveat: This tracks your issue date, not truly your birthdate. In the past couple of decades many/most babies get registered at birth, but if I stick my own (birth) data in there I actually get the wrong answer, because when I was born issuance wasn't automatic yet. But that will work for a lot of people.

Post reply on HN