Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

thenextweb.com

Post reply on HN
Print view View original

61–70 of 156 posts

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#61

Post by antihero »

Peroni wrote: post #29
shubble wrote: post #21

Earlier quoted context omitted.

Imagining that the release is true, this will do strange things for pay bargaining. Imagine if you could look up your colleagues before asking for a rise? On the other hand, I don't recall anything really horrific on that form. Enough data to steal my identity and take out a mortgage in my name, yes. Enough to embarrass me? no...

There may not be anything in there to embarass me but there is unequivocally enough in there for someone to steal my identity and ruin a credit rating I've been working extremely hard to build over the last three years.

Essentially if every person in the UK was open to identity theft then this would be an extremely serious issue. Which it could be.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#63

Post by pornel »

tomp wrote: post #57
pedrokost wrote: post #13

With the amount of hacking that is flooding the news recently, I would like to learn about database security. What are some good books/tutorials/videos on how to make databases more secure?

I believe that most databases are secure, especially the open source ones. What you should be careful about is the things surrounding the database: the .php files (or whatever) that read/write the database, and the system it is running on. Basic security practice for the web: NEVER trust user input: check and recheck all the GET/POST variables, check that numbers are numbers, that strings are correct strings (they ha…

Yes, let's secure our databases against O'Reillys and AT&Ts submitting their funny names!

It's not characters that get you, it's lack of escaping or escaping for the wrong context (e.g. magic_quotes won't work for HTML)

• For SQL use prepared statements exclusively (never let "oh, it's just a number so I don't need to" fool you)

• Escaping doesn't differ between "trusted" and "untrusted" data (and these boundaries are too easy to break eventually).

Just escape everything, always. In PHP it means every `echo $var` is a likely vulnerability and `echo htmlspecialchars($var, ENT_QUOTES)` (in HTML except script) or `json_encode($var)` (in script) is a must.

Obviously, you should do defense in depth, so input validation is great and some filtering just-in-case may be warranted, but escaping alone (assuming done well) is sufficient for security, while filtering alone is not.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#64

Post by Peroni »

mariuskempe wrote: post #59
Peroni wrote: post #29

Earlier quoted context omitted.

There may not be anything in there to embarass me but there is unequivocally enough in there for someone to steal my identity and ruin a credit rating I've been working extremely hard to build over the last three years.

What info from the census would enable someone to steal an identity? From the looks of it there's only DoB and address in terms of personal info...

Childrens names & DoB, previous addresses, employment status, national insurance number. That info alone is enough for someone experienced to do damage.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#65

Post by robin_reala »

antihero wrote: post #60
StrawberryFrog wrote: post #42

Earlier quoted context omitted.

Why would jurisdiction enter into someone in the UK suing the company that processed the UK census data? Thier data. I don't know if antihero is in the UK, but if they aren't, people in the UK should do it instead. I am disturbed that my data could leak like this.

I'm in the UK and for some crazy reason filled out my census correctly, so yeah, I think there's grounds for DPI lawsuit action.

Well, the crazy reason is the threatened fine of up to £1000.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#66

Post by Peroni »

m4tt wrote: post #10
ElliotH wrote: post #2

Given LulzSec seems to post their hacks on twitter, that there's no way of validating who posted the PasteBin item and that the Office of National Statistics hasn't reported the loss, its probably best to wait and see something a little more convincing.

I wrote the article and have been trying to trace the authenticity of the release. I am still waiting to hear back from the Office of National Statistics, which at the time were unaware of who LulzSec even were. I contacted them a little over two hours ago, I haven't received a response, yet.

Looks like Sophos are instigating PR damage control already: https://twitter.com/#!/gcluley/status/83121318723194880

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#67

Post by jodrellblank »

Peroni wrote: post #9

If true, this will be a massive coup and regardless of how they obtained the records, LulzSec will get all of the significant negative attention they so badly crave. I submitted my census info via the online form and given the amount of detail I included I would be terrified if that info was leaked.

Why would you be terrified? There isn't that much information on the census form - name, age, address, nationality and employer, roughly.

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#69

Post by davweb »

beck5 wrote: post #39
estel wrote: post #20

Earlier quoted context omitted.

There's jurisdiction for that?

Yes, they will probably be the information controller under the DPA and have to be extreamlly careful that our data is safe. Even keeping a copy in a non EU country is very hard.

US companies can store data from EU countries if they comply with the "Safe Harbour" principles. Organisations can self-certify and as yet no company has been challenged as failing to meet the guidelines.

http://en.wikipedia.org/wiki/Safe_Harbor_Principles

Re: LulzSec supposedly claims its biggest coup yet: The entire UK 2011 Census

#70

Post by m4tt »

m4tt wrote: post #56
ErrantX wrote: post #31

Earlier quoted context omitted.

Knowing a little of the internals of ONS... It may take them a while to figure out what a "computer" is and how it might be "hacked". You could be waiting some time :) ahem.

Just got off the phone to them. Issuing a statement very soon. Will update both the article and on HN.

In related news, the "Mastermind" behind LulzSec has been arrested: http://thenextweb.com/industry/2011/06/21/suspected-lulzsec-...
Post reply on HN