The unattributable “db8151dd” data breach
troyhunt.com
The unattributable “db8151dd” data breach
1–10 of 155 posts
Re: The unattributable “db8151dd” data breach
#2For the people that use unique per-merchant e-mail addresses (like someone+amazon@...), could you try some of those aliases on HaveIBeenPwned and see which ones come up in this breach? That might shed some light onto its origin.
Re: The unattributable “db8151dd” data breach
#3> Email addresses, Job titles, Names, Phone numbers, Physical addresses, Social media profiles
I just got the email notification from HIBP (Have I Been Pwned) a few minutes ago [1], but I am not worried about the compromised data because 1) my personal email address, job title and phone number are all visible in my resume which is publicly available in my website, I actually encourage people —mostly tech recruiters— to download the PDF and contact me via email or phone all the time and 2) my physical address is irrelevant because I have been moving houses every year for the last seven (7) years (even across countries a couple of times. All the social media accounts I have are completely empty, I just keep them around to get a hold on to my nickname.
I recently found, in my website’s HTTP logs, several requests from a web crawler controlled by ZoomInfo [3] an American subscription-based software as a service (SaaS) company that sells access to its database of information about business people and companies to sales, marketing and recruiting professionals. I was going to configure my firewall to block these requests but then I remembered —hey! my website only has information I am comfortable sharing, so it doesn’t matter— but I’ve been thinking it is just a matter of time before someone hacks one of their systems and leaks their database.
In my previous-previous job I found a fairly simple (persistent) XSS vulnerability in BambooHR that allowed non-authorized users to access data from all employees registered in the website including Social Security Numbers (SSN). I told my boss and we immediately edited everything before migrating to a different system. We never knew if BambooHR fixed the vulnerabilities and I wouldn’t be surprised if the data was leaked before or after I found the security hole.
Software security is such a Whac-A-Mole game, even if you get the budget to conduct security audits on your code, there is always going to be a weak link somewhere in the chain and that will be your doom. This is one of the many reasons why I left that job as a Security Engineer, the other reasons were Meltdown [3] and Spectre [4] they both made me realize I was fighting for a lost cause.
[1] https://haveibeenpwned.com/NotifyMe
[2] https://en.wikipedia.org/wiki/ZoomInfo
[3] https://en.wikipedia.org/wiki/Meltdown_%28security_vulnerabi...
[4] https://en.wikipedia.org/wiki/Spectre_%28security_vulnerabil...
Re: The unattributable “db8151dd” data breach
#4Is this dump online anywhere? I got the notification from HIBP but it only tells me my email address appeared and I'm curious how accurate the rest of the data is.
Re: The unattributable “db8151dd” data breach
#5For the people that use unique per-merchant e-mail addresses (like someone+amazon@...), could you try some of those aliases on HaveIBeenPwned and see which ones come up in this breach? That might shed some light onto its origin.
That was my first though, I also use "company@mydomain" sometimes. Too many to go through... if only I could get hold of my record....
Re: The unattributable “db8151dd” data breach
#6Is this dump online anywhere? I got the notification from HIBP but it only tells me my email address appeared and I'm curious how accurate the rest of the data is.
exactly what I want to check. it's almost expected that at some point my email address is going to end up in a breach, but there is a chance that by reviewing the data I can ascertain where it came from, at least in part .
Re: The unattributable “db8151dd” data breach
#7For the people that use unique per-merchant e-mail addresses (like someone+amazon@...), could you try some of those aliases on HaveIBeenPwned and see which ones come up in this breach? That might shed some light onto its origin.
That was my first though, I also use "company@mydomain" sometimes. Too many to go through... if only I could get hold of my record....
I believe HIBP offers domain admins a way to get all their pwned users after domain verification.
Re: The unattributable “db8151dd” data breach
#8For the people that use unique per-merchant e-mail addresses (like someone+amazon@...), could you try some of those aliases on HaveIBeenPwned and see which ones come up in this breach? That might shed some light onto its origin.
I use unique emails. My record in this breach is just a generic "contact@" address.
Re: The unattributable “db8151dd” data breach
#9For the people that use unique per-merchant e-mail addresses (like someone+amazon@...), could you try some of those aliases on HaveIBeenPwned and see which ones come up in this breach? That might shed some light onto its origin.
I use unique emails. My record in this breach is just a generic "contact@" address.
Could it be from whois data? Seems like a reasonable place for which to submit such a generic address.