US Customs Database Of Traveler Photos Was Hacked And Stolen • Hacker News Board

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#41

Post by txcwpalpha » Mon, Jun 10, 2019, 9:36 PM UTC

izzydata wrote: post #22

lsllc wrote: post #17

Rule #1 about databases: It will be hacked. Rule #2: see rule #1

That would imply that security is irrelevant. Maybe you should re-work your rule the say that it will attempt to be hacked. Therefore you should always worry about security.

Security is not irrelevant, but that doesn't mean that everyone won't be hacked. There is a saying in the security world: "there are two types of companies: those that have been hacked, and those that just don't realize yet that they've been hacked".

Of course we shouldn't just 'give up' and stop trying to improve our security, but the unfortunate truth is that breaches are practically inevitable. In addition to constantly striving to improve our security, our society also needs to start investigating ways to make it so that breaches are less impactful (for example, stop using SSNs as any type of secret identifier, so that if an SSN database is breached, it doesn't matter).

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#42

Post by pseudolus » Mon, Jun 10, 2019, 9:36 PM UTC

Fair compensation to those whose biometric information has been compromised should, at the very minimum, include free plastic surgery - in similar situations where social security numbers have been offered the government has provided new replacement social security numbers, so there is precedent. Seriously though, this highlights the danger of databases of biometric information, there's no way of remedying the damage because there's no credible way of altering one's personal biometric markers.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#43

Post by idlewords » Mon, Jun 10, 2019, 9:36 PM UTC

fuzz4lyfe wrote: post #33

idlewords wrote: post #29

Earlier quoted context omitted.

Remember the time Experian got hacked and the CEO subsequently retired with a $90M payday? The private sector is just as consequence-free.

Only politically connected companies, if you and I ran a business like that the outcome would have been different. The state has no problem going after small businesses.

This is kind of tautological, because if you're keeping databases of this size you are necessarily not a small business

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#44

Post by sehugg » Mon, Jun 10, 2019, 9:37 PM UTC

mzs wrote: post #20

netsec_burn wrote: post #18

Sounds like Perceptics.

seems very likely, wapo journo broke this and it's alluded to: https://wapo.st/2ItjHfW

The Register reported the Perceptics breach on May 23: https://www.theregister.co.uk/2019/05/23/perceptics_hacked_l...

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#45

Post by dflock » Mon, Jun 10, 2019, 9:40 PM UTC

dannykwells wrote: post #28

We are living in a boring, yet somehow equally terrifying, dystopia.

https://www.reddit.com/r/aboringdystopia

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#46

Post by idlewords » Mon, Jun 10, 2019, 9:42 PM UTC

netsec_burn wrote: post #18

Sounds like Perceptics.

Yes, one of the bright lights at CBP left the name in the title of an otherwise redacted Microsoft Word document, confirming that it's them.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#47

Post by souterrain » Mon, Jun 10, 2019, 9:44 PM UTC

If CBP is not directly forthcoming with facts relating to the breach (specifically, whose information was unlawfully taken from the CBP production network) how does one seek redress for the harms created by the actions of the contractor?

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#48

Post by dawnerd » Mon, Jun 10, 2019, 9:44 PM UTC

pseudolus wrote: post #42

Fair compensation to those whose biometric information has been compromised should, at the very minimum, include free plastic surgery - in similar situations where social security numbers have been offered the government has provided new replacement social security numbers, so there is precedent. Seriously though, this highlights the danger of databases of biometric information, there's no way of remedying the damage…

Or let this be proof that biometrics are a terrible way to verify someone's identity.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#49

Post by txcwpalpha » Mon, Jun 10, 2019, 9:45 PM UTC

This is yet another reminder that managing the security of your company's third party contractors is just as important as managing your own company's security. Security is a game of weakest links, and it wouldn't have mattered if CBP's internal security was the best in the world if they were allowing access to a third party that doesn't have good security.

It is naturally very difficult to enforce security mandates on a company that isn't your own, but I feel that this is one of the best ways we can improve security overall in our society: companies need to start requiring that everyone they do business with have a strong, independently certified security program, or else no contract will be signed. This is already done for things like data center contracting, but it should be much more widespread and encompass every type of b2b deal.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#50

Post by [deleted] » Mon, Jun 10, 2019, 9:50 PM UTC

axaxs wrote: post #9

> On May 31, 2019, CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor’s company network > CBP ... is closely monitoring all CBP work by the subcontractor What. In the private sector, they'd have been fired and probably legal action levelled against them. Th…

[deleted]