29 ms·
Hacker Publishes Personal Info of 20,000 FBI Agents
- IIAOPSW 11y agoI don't see the problem. I thought privacy was dead.
- miguelrochefort 11y agoSame here. I wonder how long it will take before people get used to it.
- noodles23 11y agoEvery time I check HN, there's a new crypto tool, encrypted databases, and tips on hardening your servers. No matter how secure your system is technically, there is always the requirement to make parts of it "insecure" (in the sense that people buy enterprise encryption, but expect the company that sells it to keep a spare copy of the keys to recover lost data just in case) The reality in cyber security is that people provide the weakest and easiest point of entry to compromise any computer system. Until the business side and process side of things improve, shit like this will remain common.
- cookiecaper 11y agoThis is a bummer. Most FBI agents are good people trying to help keep a lid on crime in their country. They don't deserve personal exposure or embarrassment for providing what is obviously a necessary, thankless, and underappreciated service. I'm waiting for the day that script kiddies do something useful, like emptying out everyone's credit file or deleting all the pending bills in a major hospital system's computer. Embarrassing and/or exposing normal individuals doesn't provide any real macro-level help to anybody.
- viraptor 11y agoI see where you're coming from, but "deleting all the pending bills in a major hospital system's computer"? In the best case that would affect hospital's budget, in the worst people will be chased by collection agencies due to mixup in records. Edit: actually the most realistic scenario - whoever's on call in IT gets to work the night restoring backups. Meanwhile doctors are pissed off and lose time, because they may not be able to update or trust the medical records, unless it can be proven they were not changed.
- cookiecaper 11y agoYeah, a well-implemented hack would make it more difficult than simply spending a night restoring backups. It would have to be more than a temporary breach to have a substantial effect. The concept is to make it impossible to do business under the existing conditions. If hospital systems are unable to bill their patients because their systems are constantly scrambled by vigilantes, it'll affect the cost-benefit calculation involved in continuing operation under their existing business model. Undoubtedly there would be confusion and misapplied bills involved. I don't see that as detrimental to the overarching cause. The only reason these systems are able to operate as-is is because their architects have devised a carefully fragmented and extremely confusing system that splits American society such that unity on the issue can't be achieved without substantial personal cost to the members of the more powerful/useful social factions. If someone can level that playing field, we'll be well on our way to substantive change. When the powerful people have to feel the indignity of getting their credit wrecked for a decade or more because their kid fell down at a playground and got a concussion, even though they took every precaution that the man said they'd have to take to survive this kind of routine nightmare semi-intact, the rules will change much faster. At present, the poor get their medical care pretty well taken care of through Medicaid. The rich don't care because they can throw infinity money at health problems (which is not to say they actually have to). It's the middle class that's getting raked over the coals, because they're not rich enough to force a change through monetary influence and they have too much to lose to force a change through social action. I'm really not even a single-payer or socialized medicine kind of guy, but the current system is the worst of all worlds. The ACA provided a few useful tweaks but overall the system is just getting worse and worse. It shouldn't be allowed to stand.
- frankydp 11y agoExcellent commentary. Private markets with public motivations are super dangerous. On this specific issue we have ended up with the worst possible combination of a private/free market and a federal market behaving as a huge actor that operates outside of the free market system(ie no requirement to be profitable/sustainable). The presence of that almost majority actor drives decision making and behavior that completely cripples the free market relationship between the consumer and provider. The health care market was already barely a free market due to the nature of the service and availability. I also do not really care what system we have in the US single or federal, we just can not continue to ignore the repeated failures that "sorta" socialized programs leave in their wake.(CRA) Just one or the other.
- valvar 11y agoHow are any of the things you mentioned useful? I think I can quite confidently say that the things you mention will probably cause more rather than less suffering in the long term. And it's exactly this type of naive disregard for the complexity of actions and their consequences that makes 'script kiddies' so harmful.
- omegaham 11y agoYeah, seriously. Credit scores are what separate me from the idiots who are insolvent and going bankrupt. I would be pretty unhappy with paying higher interest for loans because some dickhead wiped the slate clean. "We're all equal now!" Yeah, and we're now all paying for it. Same exact thing with hospital billing - wipe that slate clean, the hospital has to take out loans to stay solvent, and they increase rates to compensate. And you know that they aren't going to be able to get anywhere with Medicaid or the insurance companies... so they're going to hit the people who are least equipped to take the even higher prices for medical care. Thanks, Mr. Script Kiddie!
- cookiecaper 11y ago>Credit scores are what separate me from the idiots who are insolvent and going bankrupt. You'd think that. I know a person that has gone bankrupt 5 times. He's always able to coax his credit score up within 2-3 years to rack up another 100k in credit card debt before he files for bankruptcy again, right on schedule. I also know responsible people who've been completely fucked over by insurance companies who refuse to pay claims based on their own clerical errors, among many other horror stories. Credit reporting is an unreliable, oppressive system, where your financial well-being is left in the hands of 3 companies that have minimal oversight and exist primarily to help lenders fuck the consumer out of money. Anyone who has your social security number can start reporting derogatory accounts on your credit and seriously hurt your life that way. Think twice before you fork that number over to the dental receptionist. The idea of this type of hack is to force a change in the methodology, not just to reset the counter. These hacks would have to be continuous service disruptions to be effective. They can't just do it once and let everything go back to normal. For what it's worth, my credit score is currently in the mid-700s. I personally believe this type of thing is inevitable. There are people in the government who recognize this too, and have been pushing for cybersecurity initiatives to prevent it (though these concerns have been co-opted by politicians for use in forcing down oppressive copyright and surveillance legislation, pleasing media company donors). There is a great deal of latent risk in this hyperconnected world. It'll be amazing and frightening to watch hacks at this type of scale play out. Like I said, I have no doubt whatsoever that they will.
- nefitty 11y agoI'd be surprised if this wasn't done by libertarian "activists". Either that, or any number of other radical terrorist sympathizers. I mean, imagine the philosophical steps that would get someone to the point where they feel justified in doxing thousands of federal agents. This probably wasn't a script kiddie, it was someone who aches to topple society.
- scrollaway 11y agoIt could literally be anybody. Please stop making pointless assumptions.
- miguelrochefort 11y agoAlthough we don't know who's responsible for it (and fairly doesn't really matter), I think any transparency activist would consider this to be a step in the right direction. Looking forward to the next act of transparency.
- joshschreuder 11y agoI take it from your second paragraph you've seen Mr Robot?
- cookiecaper 11y agoI haven't. Does something like this happen in it? I should check it out.
- venomsnake 11y agoYou don't want that. Because a script kid will change some of the info subtly instead of destroying it. Lets say alter randomly patients conditions and allergies. The results could be unpleasant.
- whatnotests 11y ago"Good people" don't work for Evil. They tear it down.
- matt_wulfeck 11y ago> A spokesperson for the DOJ told Motherboard on Monday that the department “is looking into the unauthorized access of a system operated by one of its components... Please don't give us the "we weren't hacked. It was a company we used that was!" Nonsense. I'm tired of hearing this. It's the same thing blue shield said when its/my/your data was pilfered. YOU are responsible for it! If you pass it off to some incompetent third party, then that reflects even more poorly on you!
- ryanlol 11y agoThere's literally no sign of a hack here (I mean, besides the statement that they're investigating), this is OSINT stuff. Trust me, you could hack any recruiting company and they'd be sitting on much more data than this.
- dhimes 11y agoIf, like me, you don't know the term OSINT, it stands for "open source intelligence." What it means is publicly available information: phone books, mailing lists, published documents and other things people can find just by snooping a little and not breaching a security system. (Note: According the Wikipedia, this is a US-centric view of the term and may be different where you live.)
- iheartmemcache 11y agoYep. Even the spooky Stratfor[1] would have more information than this. This is nothing like what Snowden or literally hundreds of thousands of people who hold TS/SCI have access to (identities of NCOs or other espionage operatives, access to recruiting databases for foreign nationals who went abroad to the US for graduate studies and are being assessed as potential intelligence assets by their professors, etc). A pissed off 4channer with good Google-fu could get more information than this. [1] Which I'm sure intelligence agencies are thankful for, because all the tin-foil hatters are misplacing their resources in designing conspiracy theories about an incompetent "private intelligence organization" which amounts to a bunch of people who could easily be outsmarted by a 4chan-er with good Google-fu. You know all those stories you heard about the KGB being incompetent, or now hear about how the Party is in modern China w/r/t information control? Yeah.. the FIVEEYES are about on par when it comes to incompetence.
- ryanlol 11y agoThe meaning of "personal info" sure has been diluted, this is zoominfo level data (in fact, based on a quick look it could very well be scraped from there).
- simplicio 11y agoYea, I've worked for a few gov't agencies over the years, and most of them have had basically the same info on a public facing "who's who" webpage. The identities and job titles of public employees is public information. Internal email addresses and phone numbers might be a little more problematic, since they could be spam targets. But it'd be a pretty brave/dumb spammer or prank caller who targets the FBI.
- ryanlol 11y agoThis stuff might even be covered by FOIA, since it's just official contact info.
- jug 11y agoYes, the problem according to the FBI indeed seems to be more about the unauthorized breach than the information actually contained: > “This unauthorized access is still under investigation; however, there is no indication at this time that there is any breach of sensitive personally identifiable information,” DOJ spokesperson Peter Carr said in a statement.
- danso 11y ago> After tricking a department representative into giving him a token code to access the portal, the hacker claimed he used the compromised credentials to log into the portal, where he gained access to an online virtual machine. From here, the cybercriminal was presented with three different computers to access, he said, one of which belonged to the person behind the compromised email account. The databases of DHS and FBI details were on the DOJ intranet, the hacker said. With public facing sites like Amazon -- who have necessarily engineered and refined security solutions to manage a wide surface area of attack from its customer base -- getting successfully social engineered on occasion, I shudder to think what the situation is at a large, multidecade bureaucracy where internal-only legacy technology stacks and access control procedures have probably resulted in a mindset of "oh just put that on a sticky note" workarounds just to get work done.
- sanatgersappa 11y ago"If you've got nothing to hide, you've got nothing to fear"
- bcook 11y agoExcept that everyone has some data that they want to keep private... Maybe you want to keep your text messages private from your employer, or your browsing history private from your children, or your maximum driving speeds private from your local law-enforcement, or your sexual preference separate from your wife, or etc, etc.
- smcl 11y agoI think the GP is repeating the line that we the public are always sold by these government agencies re privacy for comic effect :)
- rawTruthHurts 11y agoI think you kind of missed the sarcasm.
- bcook 11y agoIf only there were a sarcasm punctuation... Sadly, we only have emoticons. ;)
- nmc 11y agoWhat is this??? In the first <blockquote> of the article: <p> 20,000 FBI EMPLOYEES NAMES, TITLES, PHONE NUMBERS, EMAILS, COUNTRY <a href="</p">penis </a> <a href="https://twitter.com/DotGovs/statuses/696796442850156545">February https://twitter.com/DotGovs/statuses/696796442850156545">Feb... 8, 2016</a> </p> Notice the weird <a> tag in the middle.
- spike021 11y agoLooks like the embedded tweet has the twitter handle's 'name', which is penis.
- SeeDave 11y agoThis is probably the most bizarre hyperlink I've run across. I share your confusion, and couldn't be laughing any harder right now.
- bamdadd 11y agoanyone have attempted to publish these on http://icwatch.wikileaks.org http://icwatch.wikileaks.org ?
- jernigan 11y agoBest Superbowl 50 Commercials http://www.osoti.net/featured/2495/ http://www.osoti.net/featured/2495/
- aluhut 11y agoI wonder when the moment comes where really secret personal/information is going to appear only on paper again. I wouldn't want this happening to me.
- ck2 11y agoEverytime I see something like this I ask "why was this system connected to the internet in the first place". Sure an intranet only computer can be compromised as well, usb drive, social engineering, etc. but it is exponentially harder. Really hoping ICBM systems are not on the internet because some general wanted to monitor them from his smartphone.
- gargravarr 11y agoIn a perfect display of schadenfreude, the FBI might now be getting an idea of why people are reluctant to allow them unfettered access to their private information :) Not really a useful comment, I know, but I had to show my appreciation for this guy for pulling down the FBI's pants!
- ethbro 11y agoI, for one, think privacy concerns over this release are overblown. After all, the news reports I've read only contain metadata about the individuals in question. That the data is out there isn't important. It's not being looked at by me or other humans reading these news articles. Furthermore, collection and access to this information is critical to the fight against terrorism. If professionals aren't able to identify individuals who may be endangering this country, that puts all of America at risk. /congressional hearing
- contingencies 11y agoThe "metadata doesn't matter" argument is a fallacy that has been used to push horrible legislation in many countries.
- moonshinefe 11y agoI find it somewhat interesting that this hacker didn't use this information for leverage, if he's indeed some strong supporter of the free Palestine cause. Instead, he just let it loose and raised the middle finger. It makes me think either the supposed motivation for this hack isn't what it seems, or it was perpetuated by someone who's incredibly naive. It just doesn't seem to add up.
- ryanlol 11y agoWhat leverage could he possibly gain by not releasing this data?
- moonshinefe 11y agoWell, you don't get leverage by not releasing data for no reason... However, if you're in possession of 20k FBI agents' private information, you could probably contact Palestinian politicians, and they could use it in negotiations. It's valuable information to governments at war.
- grkvlt 11y agoAnd then your crime goes from (mere) 'computer misuse' to 'espionage' or even 'treason', with the exciting penalties they draw. I don't think anyone with half a brain wants to go down that road, particularly since the info isn't even that valuable, but the penalties would be the same as TS/SCI information release to an 'enemy government' or similar.
- moonshinefe 11y agoI should also point out, there are probably dozens of parties who are interested in that FBI information, not just Palestinians. He could have sold to the highest bidder but chose not to.
- ryanlol 11y agoBut there's no private information in the leak. Just official contact information.
- hellofunk 11y agoGuys like this give hackers a bad name.
- azraomega 11y agoThis is just a dump of their "phonebook". Not even close to OPM hack... Sensationalist article.
- mineshaftgap 11y agoAnd dumb HN clowns fall right for it...
- sp332 11y agoThe article doesn't say it was like OPM.
- uptown 11y agoTangentially related, but have the people affected by the OPM hack last year been notified?
- jklontz 11y agoThe people I know have been notified.
- Lambent_Cactus 11y agoYes. I got a letter from OPM detailing what may have been compromised an offering me some identity theft protection/monitoring service. They got my SF-86 (https://www.opm.gov/forms/pdf_fill/sf86.pdf https://www.opm.gov/forms/pdf_fill/sf86.pdf) and my fingerprints, so pretty much everything.
- uptown 11y agoAny idea how far back the compromised records go? Trying to determine if records from 2005 may have been exposed, but I've moved a number of times since then, and I haven't been notified. I presume they would have found me if they wanted to, but wish there was a proactive way for me to inquire.
- frankydp 11y agohttps://opmverify.dmdc.osd.mil/ https://opmverify.dmdc.osd.mil/
- grkvlt 11y agoI do love the SF-86 form. "Please list all acts of terrorism you have participated in, in an attempt to overthrow the Government of the United States: Nature of act, Dates from and to" and that sort of thing. I wonder if anyone who answered 'YES' to that section ever got a clearance?
- GSegbar 11y agoI'd answer yes, the nature being voting.
- someonewithpc 11y agoThat's not what "hacker" means. An Hacker is some person who enjoys tinkering with systems. You mean "cracker".
- alexandros 11y agoThere is no universal dictionary in the sky that defines what words mean. To some people, "hacker" means one thing, to some another.
- visarga 11y agoBut there is, it's sitting right there in the cloud for us to access at one click away.
- Dolores12 11y agocracker is a person that cracks software systems.
- sarciszewski 11y agoThat's how things used to be. However, the meaning of words is decided by their usage. My attempt to summarize the new meaning of the word hacker is "any person who employs (especially technological) ingenuity to solve a problem". Full explanation: https://scott.arciszewski.me/blog/2014/08/cause-and-infect-why-people-get-hacked https://scott.arciszewski.me/blog/2014/08/cause-and-infect-w...
- iheartmemcache 11y agoWeev went to jail for literally HTTP GET'ing an AT&T server with a URL that was readily available on any Ipad device. In the RFC there's literally a return code for "Not Authorized", he got a good ol' 200 saying 'come on in' and got convicted of "conspiracy to access a computer without authorization". Federal prison for what was effectively WGET'ing something that was, again, readily available. Still, in the eyes of the public and the law, hacker and cracker are the same thing. The guy is a racist liar but he didn't deserve federal prison. His conviction was later vacated on a venue technicality, which sucks, because had it been overturned in a higher circuit with the judge offering an Opinion, case law would have been set and Aaron Schwarz would have at least some vindication[1]. [1] In no way am I comparing the character of these two men, just the injustice they both suffered at the arms of the technically illiterate law enforcement/legal system. If I were a medical doctor who was before the board being judged for malpractice, I wouldn't want a jury of 12 of my 'peers' deciding my fate - I'd want other doctors.
- max_ 11y agoThe thing in encrypted... i don't thinks is harmful to the US gov.
- awqrre 11y agoIsn't that public data? name, country, phone number, email...
- a3n 11y ago> In any case, a DHS spokesperson said the agency is looking into the reports, though “there is no indication at this time that there is any breach of sensitive or personally identifiable information.” Except, you know, names. Merely being identified as a person moves you from not existing in the criminal universe to target. From name and other information comes yet other information, comes economic damage, or in this case, possibly life threatening damage.
- rhino369 11y agoNames aren't secret or private information. The agents give you their names if you talk with them. A significant portion of them are on linked in. During criminal trials their names are public record. Only four FBI agents died at an "adversaries" hand in the past 20 years, one botched undercover drug bust, an agent who ran into the twin towers on 911 to help people, and two who died in raids. These guys are cops and detectives, not secret agents and spies.
- a3n 11y agoFrom the article, "personally identifiable information." A name is personally identifiable information. For crimes that rely on such lists, not being on the list is your best defense.
- ryanlol 11y ago> The agents give you their names if you talk with them. At least in my case the agents refused to give me their full names, citing personal safety concerns.
- a3n 11y agoI called the police for something a couple years ago, and when I asked for a card after it was over she gave me a card where one of her names was pre-scratched out, I forget if it was her first or last.
- deleted 11y ago[deleted]
- avukich 11y agoThis guy should be captured and killed. Most FBI agents are very dedicated to trying to protect people and doing something like this should be an act of espionage and dealt with accordingly.
- dang 11y ago> This guy should be captured and killed This breaks the HN guidelines. On this site, please comment civilly and substantively, or not at all. Your comment would be fine without that sentence. Your other comments in this thread make it sound like you're knowledgeable about this space in a way that most of us aren't. The way to communicate here is to share that knowledge in a civil way, so we all learn something. We detached this comment from https://news.ycombinator.com/item?id=11064557 https://news.ycombinator.com/item?id=11064557 and marked it off-topic.
- radius 11y agoInteresting that the dataset only goes from A-Je. I wonder what happened to the rest of the data. Also, I didn't realize the surname Acevedo was so popular...
- DamnYuppie 11y agoAnyone else notice that Crytobin appears to be down? Wonder if they took it offline because of this or are they simply blocking traffic in the US to it?
- jackgavigan 11y agoLooks like it's been dropped from DNS servers. $ nslookup cryptobin.org Server: 8.8.8.8 Address: 8.8.8.8#53 ** server can't find cryptobin.org: NXDOMAIN It can still be accessed directly via https://151.236.7.117 https://151.236.7.117