Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers selling hacked police emails to request user data from TikTok, Facebook

404media.co

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#41

Post by dahdum »

omniglottal wrote: post #39
dahdum wrote: post #31

Earlier quoted context omitted.

Isn’t it though? You can attack email systems, network operators, and end users in a myriad of ways remotely from anywhere in the world. How can you compromise a traditional fax? Eavesdropping the PSTN itself? Physical access to one of the machines? Stealing the printed document? Network fax systems are more convenient to use than traditional, but still more secure than email because they’ve been designed to be so.

Analog. Unencrypted. Your intent to misinform appears evident.

Where’s the attack surface to exploit this analog and unencrypted data? A government can order their telecoms (and they do), but the same happens with emails providers. Neither is secure from government intrusion, but email is easier to compromise than traditional fax systems because their exposure is so limited.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#42

Post by vkou »

omniglottal wrote: post #38
MichaelZuo wrote: post #35

Earlier quoted context omitted.

How's that absurd? If you have 0 experienced security folks on staff/consulting, and no one willing to listen to them, then a fax is almost certainly more secure in practice.

One of those countries is the US. Fax is unencrypted analog. If practice, tgis is ver certainly not secure. It's only "more secure" in the sense that unauthorized access to it counts as wiretapping, whereas the feds carved a loophole allowing them to read private emails without going afoul our anti-wiretapping laws. That you don't see the absurdity means our educational system is also doing what feds built it to do.

> It's only "more secure" in the sense that unauthorized access to it counts as wiretapping, whereas the feds carved a loophole allowing them to read private emails without going afoul our anti-wiretapping laws.

How is that different from techbros trying to claim a loophole for their illegal business, because it's on the internet/through an app/'is a gig job'/on a blockchain?

When legislature hasn't kept up with technology, the only way to fight that behaviour is through lawsuits. Lawsuits have made some headway in dealing with both private, and government malfeasance, here.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#44

Post by nitwit005 »

NoZebra120vClip wrote: post #4

Ok if these social media giants are authenticating LEOs by origin email only, without benefit of GPG, or secure token, or whatever, then they are stuck on stupid, and deserve any hacking they get. Ouch.

They respond to written letters too (and they have a legal obligation to do so).

There is, unfortunately, no way to get every police force on the globe to agree to some authentication scheme.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#45

Post by hedora »

extraduder_ire wrote: post #7
NoZebra120vClip wrote: post #4

Ok if these social media giants are authenticating LEOs by origin email only, without benefit of GPG, or secure token, or whatever, then they are stuck on stupid, and deserve any hacking they get. Ouch.

To many normal people the "from" field in an email means that it came from there. I am wondering how they get the data back though, unless they demand it is faxed, or sent to another email address. (Or the person replying doesn't notice the different reply-to address.)

Interestingly, gmail trusts the from field, so if I send a message “from” you to your account, it will put it in your sent folder.

Urban legend says people have been fired after forged harassment emails were delivered this way.

Google claims this is a feature, and the sent “label” isn’t meant to mean that it came from your gmail account.

For instance, there could be a corporate service firehosing spam at coworkers on your behalf, and obviously you don’t want to notice that, so it puts it in the sent box.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#46

Post by randysalami »

jacquesm wrote: post #17
TZubiri wrote: post #3

Earlier quoted context omitted.

According to Meta Whatsapp is E2EE and Data requests by government agencies can only reveal metadata like recipients, durations of calls, frequency of messages, but not content of messages.

Meta data is often as valuable or even more valuable than the data itself. Because you might be talking to the mob boss about the weather. But the fact that you are talking to the mob boss is an extremely interesting data point. It pins you to the map in a way that you are immediately a POI and causes a file to be opened on you and your other contacts to further map your place in the network. Who talks to who is very…

See The Wire.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#47

Post by happytiger »

lisbon44 wrote: post #43

Whatever happened to the concept of receiving a legal-order, having your lawyers scrutinize it and complying afterwards? None of these high-stakes data handoffs coordinated over insecure email.

You want private courts? You destroy due process? You want pay-to-play legal systems?

You pay the price. This is the price. And you better not complain.

You can either have one, or the other. But you can’t compromise one and keep the the other.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#48

Post by coldtea »

happytiger wrote: post #47
lisbon44 wrote: post #43

Whatever happened to the concept of receiving a legal-order, having your lawyers scrutinize it and complying afterwards? None of these high-stakes data handoffs coordinated over insecure email.

You want private courts? You destroy due process? You want pay-to-play legal systems? You pay the price. This is the price. And you better not complain. You can either have one, or the other. But you can’t compromise one and keep the the other.

I want public no pay-to-play legal systems.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#49

Post by singleshot_ »

what-no-tests wrote: post #28
singleshot_ wrote: post #26

Earlier quoted context omitted.

Castle Rock v. Gonzales, 545 U.S. 748 (2005) (Police not required to serve or to protect).

False advertising.

Lack of a sale or advertisement of any merchandise would be fatal to such a claim, at least in this jurisdiction.

Re: Hackers selling hacked police emails to request user data from TikTok, Facebook

#50

Post by extraduder_ire »

hedora wrote: post #45
extraduder_ire wrote: post #7

Earlier quoted context omitted.

To many normal people the "from" field in an email means that it came from there. I am wondering how they get the data back though, unless they demand it is faxed, or sent to another email address. (Or the person replying doesn't notice the different reply-to address.)

Interestingly, gmail trusts the from field, so if I send a message “from” you to your account, it will put it in your sent folder. Urban legend says people have been fired after forged harassment emails were delivered this way. Google claims this is a feature, and the sent “label” isn’t meant to mean that it came from your gmail account. For instance, there could be a corporate service firehosing spam at coworkers on…

I thought gmail enforces SPF for gmail emails. I'd try it myself, but I don't want the few machines I have with port 25 unblocked to get a worse spam rating.

Is this documented anywhere?

Post reply on HN